|
HyperDbg Debugger
|
Implementation of exported functions from hypervisor. More...
#include "pch.h"Functions | |
| VOID | VmFuncPerformRipIncrement (UINT32 CoreId) |
| Perform the incrementation of RIP. | |
| VOID | VmFuncSuppressRipIncrement (UINT32 CoreId) |
| Suppress the incrementation of RIP. | |
| VOID | VmFuncChangeMtfUnsettingState (UINT32 CoreId, BOOLEAN Set) |
| Suppress unsetting MTF. | |
| VOID | VmFuncChangeIgnoreOneMtfState (UINT32 CoreId, BOOLEAN Set) |
| Change ignore one MTF state. | |
| VOID | VmFuncRegisterMtfBreak (UINT32 CoreId) |
| Register for break in the case of an MTF. | |
| VOID | VmFuncUnRegisterMtfBreak (UINT32 CoreId) |
| Unregister for break in the case of an MTF. | |
| VOID | VmFuncSetMonitorTrapFlag (BOOLEAN Set) |
| Set the monitor trap flag. | |
| VOID | VmFuncSetRflagTrapFlag (BOOLEAN Set) |
| Set Rflag's trap flag. | |
| VOID | VmFuncSetLoadDebugControls (BOOLEAN Set) |
| Set LOAD DEBUG CONTROLS on Vm-entry controls. | |
| VOID | VmFuncSetSaveDebugControls (BOOLEAN Set) |
| Set SAVE DEBUG CONTROLS on Vm-exit controls. | |
| VOID | VmFuncSetPmcVmexit (BOOLEAN Set) |
| Set vm-exit for rdpmc instructions. | |
| VOID | VmFuncSetMovControlRegsExiting (BOOLEAN Set, UINT64 ControlRegister, UINT64 MaskRegister) |
| Set vm-exit for mov-to-cr0/4. | |
| VOID | VmFuncSetMovToCr3Vmexit (UINT32 CoreId, BOOLEAN Set) |
| Set vm-exit for mov-to-cr3. | |
| VOID | VmFuncWriteExceptionBitmap (UINT32 BitmapMask) |
| Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap. | |
| UINT32 | VmFuncReadExceptionBitmap () |
| Read exception bitmap in VMCS. | |
| VOID | VmFuncSetInterruptWindowExiting (BOOLEAN Set) |
| Set Interrupt-window exiting. | |
| VOID | VmFuncSetNmiWindowExiting (BOOLEAN Set) |
| Set NMI-window exiting. | |
| VOID | VmFuncSetNmiExiting (BOOLEAN Set) |
| Set the NMI Exiting. | |
| VOID | VmFuncSetExceptionBitmap (UINT32 CoreId, UINT32 IdtIndex) |
| Set exception bitmap in VMCS. | |
| VOID | VmFuncUnsetExceptionBitmap (UINT32 CoreId, UINT32 IdtIndex) |
| Unset exception bitmap in VMCS. | |
| VOID | VmFuncSetExternalInterruptExiting (UINT32 CoreId, BOOLEAN Set) |
| Set the External Interrupt Exiting. | |
| VOID | VmFuncSetRdtscExiting (UINT32 CoreId, BOOLEAN Set) |
| Set the RDTSC/P Exiting. | |
| VOID | VmFuncSetMovDebugRegsExiting (UINT32 CoreId, BOOLEAN Set) |
| Set or unset the Mov to Debug Registers Exiting. | |
| UINT64 | VmFuncGetLastVmexitRip (UINT32 CoreId) |
| get the last vm-exit RIP | |
| VOID | VmFuncInjectPendingExternalInterrupts (UINT32 CoreId) |
| Inject pending external interrupts. | |
| UINT16 | VmFuncGetCsSelector () |
| Read CS selector. | |
| UINT64 | VmFuncGetRflags () |
| Read guest's RFLAGS. | |
| VOID | VmFuncSetRflags (UINT64 Rflags) |
| Set guest's RFLAGS. | |
| UINT64 | VmFuncGetRip () |
| Read guest's RIP. | |
| VOID | VmFuncSetRip (UINT64 Rip) |
| Set guest's RIP. | |
| UINT64 | VmFuncGetInterruptibilityState () |
| Read guest's interruptibility state. | |
| UINT64 | VmFuncClearSteppingBits (UINT64 Interruptibility) |
| Clear STI and MOV SS bits. | |
| VOID | VmFuncSetInterruptibilityState (UINT64 InterruptibilityState) |
| Set guest's interruptibility state. | |
| BOOLEAN | VmFuncNmiBroadcastRequest (UINT32 CoreId) |
| Broadcast NMI requests. | |
| BOOLEAN | VmFuncNmiBroadcastInvalidateEptSingleContext (UINT32 CoreId) |
| Broadcast NMI requests for single-context EPT invalidation. | |
| BOOLEAN | VmFuncNmiBroadcastInvalidateEptAllContexts (UINT32 CoreId) |
| Broadcast NMI requests for all contexts EPT invalidation. | |
| VOID | VmFuncInvalidateEptSingleContext (UINT32 CoreId) |
| Requests for single-context EPT invalidation. | |
| VOID | VmFuncInvalidateEptAllContexts () |
| Requests for all contexts EPT invalidation. | |
| VOID | VmFuncCheckAndEnableExternalInterrupts (UINT32 CoreId) |
| Check and enable external interrupts. | |
| VOID | VmFuncDisableExternalInterruptsAndInterruptWindow (UINT32 CoreId) |
| Disable external-interrupts and interrupt window. | |
| BOOLEAN | VmFuncInitVmm (VMM_CALLBACKS *VmmCallbacks) |
| Initializes hypervisor. | |
| VOID | VmFuncUninitVmm () |
| Uninitialize Terminate Vmx on all logical cores. | |
| BOOLEAN | VmFuncVmxGetCurrentExecutionMode () |
| Get the current VMX operation state. | |
| BOOLEAN | VmFuncQueryModeExecTrap () |
| Get the current state of mode exec trap mechanism. | |
| VOID | VmFuncSetTriggerEventForVmcalls (BOOLEAN Set) |
| Set triggering events for VMCALLs. | |
| VOID | VmFuncSetTriggerEventForCpuids (BOOLEAN Set) |
| Set triggering events for CPUIDs. | |
| UINT32 | VmFuncVmxCompatibleStrlen (const CHAR *s) |
| VMX-root compatible strlen. | |
| UINT32 | VmFuncVmxCompatibleWcslen (const wchar_t *s) |
| VMX-root compatible strlen. | |
| VOID | VmFuncEventInjectPageFaultWithCr2 (UINT32 CoreId, UINT64 Address, UINT32 PageFaultCode) |
| Inject #PF and configure CR2 register. | |
| VOID | VmFuncEventInjectPageFaultRangeAddress (UINT32 CoreId, UINT64 AddressFrom, UINT64 AddressTo, UINT32 PageFaultCode) |
| Inject a range of page-faults. | |
| VOID | VmFuncEventInjectInterruption (UINT32 InterruptionType, UINT32 Vector, BOOLEAN DeliverErrorCode, UINT32 ErrorCode) |
| Inject interrupt/faults/exceptions. | |
| NTSTATUS | VmFuncVmxVmcall (unsigned long long VmcallNumber, unsigned long long OptionalParam1, unsigned long long OptionalParam2, unsigned long long OptionalParam3) |
| Export for running VMX VMCALLs. | |
| VOID | VmFuncVmxBroadcastInitialize () |
| Export for initialize the VMX Broadcast mechanism. | |
| VOID | VmFuncVmxBroadcastUninitialize () |
| Export for uninitialize the VMX Broadcast mechanism. | |
| VOID | VmFuncEventInjectBreakpoint () |
| Inject #BP to the guest (Event Injection) | |
| INT32 | VmFuncVmxCompatibleStrcmp (const CHAR *Address1, const CHAR *Address2) |
| VMX-root compatible strcmp. | |
| INT32 | VmFuncVmxCompatibleStrncmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Num) |
| VMX-root compatible strncmp. | |
| INT32 | VmFuncVmxCompatibleWcscmp (const wchar_t *Address1, const wchar_t *Address2) |
| VMX-root compatible wcscmp. | |
| INT32 | VmFuncVmxCompatibleWcsncmp (const wchar_t *Address1, const wchar_t *Address2, SIZE_T Num) |
| VMX-root compatible wcsncmp. | |
| INT32 | VmFuncVmxCompatibleMemcmp (const CHAR *Address1, const CHAR *Address2, size_t Count) |
| VMX-root compatible memcmp. | |
| VOID | VmFuncEnableMtfAndChangeExternalInterruptState (UINT32 CoreId) |
| Enables MTF and adjust external interrupt state. | |
| VOID | VmFuncEnableAndCheckForPreviousExternalInterrupts (UINT32 CoreId) |
| Checks to enable and reinject previous interrupts. | |
Implementation of exported functions from hypervisor.
Change ignore one MTF state.
| CoreId | Target core's ID |
| Set | State of setting or unsetting |
Suppress unsetting MTF.
| CoreId | Target core's ID |
| Set | State of setting or unsetting |
Check and enable external interrupts.
| CoreId | Target core's ID |
Clear STI and MOV SS bits.
Disable external-interrupts and interrupt window.
| CoreId |
Checks to enable and reinject previous interrupts.
| UINT32 | CoreId |
Enables MTF and adjust external interrupt state.
| UINT32 | CoreId |
| VOID VmFuncEventInjectBreakpoint | ( | ) |
Inject #BP to the guest (Event Injection)
| VOID VmFuncEventInjectInterruption | ( | UINT32 | InterruptionType, |
| UINT32 | Vector, | ||
| BOOLEAN | DeliverErrorCode, | ||
| UINT32 | ErrorCode ) |
Inject interrupt/faults/exceptions.
| InterruptionType | |
| Vector | |
| DeliverErrorCode | |
| ErrorCode |
| VOID VmFuncEventInjectPageFaultRangeAddress | ( | UINT32 | CoreId, |
| UINT64 | AddressFrom, | ||
| UINT64 | AddressTo, | ||
| UINT32 | PageFaultCode ) |
Inject a range of page-faults.
| CoreId | Target core's ID |
| AddressFrom | Page-fault address (from) |
| AddressTo | Page-fault address (to) |
| Address | Page-fault address |
| PageFaultCode | Page-fault error code |
Inject #PF and configure CR2 register.
| CoreId | Target core's ID |
| Address | Page-fault address |
| PageFaultCode | Page-fault error code |
| UINT16 VmFuncGetCsSelector | ( | ) |
Read CS selector.
| UINT64 VmFuncGetInterruptibilityState | ( | ) |
Read guest's interruptibility state.
get the last vm-exit RIP
| CoreId | Target core's ID |
| UINT64 VmFuncGetRflags | ( | ) |
Read guest's RFLAGS.
| UINT64 VmFuncGetRip | ( | ) |
| BOOLEAN VmFuncInitVmm | ( | VMM_CALLBACKS * | VmmCallbacks | ) |
Inject pending external interrupts.
| CoreId | Target core's ID |
| VOID VmFuncInvalidateEptAllContexts | ( | ) |
Requests for all contexts EPT invalidation.
Requests for single-context EPT invalidation.
| CoreId | Target core's ID |
Broadcast NMI requests for all contexts EPT invalidation.
| CoreId | Target core's ID |
Broadcast NMI requests for single-context EPT invalidation.
| CoreId | Target core's ID |
Broadcast NMI requests.
| CoreId | Target core's ID |
Perform the incrementation of RIP.
| CoreId | Target core's ID |
| BOOLEAN VmFuncQueryModeExecTrap | ( | ) |
Get the current state of mode exec trap mechanism.
| UINT32 VmFuncReadExceptionBitmap | ( | ) |
Read exception bitmap in VMCS.
Should be called in vmx-root
Register for break in the case of an MTF.
| CoreId | Target core's ID |
Set exception bitmap in VMCS.
Should be called in vmx-root
| CoreId | Target core's ID |
| IdtIndex | Interrupt Descriptor Table index of exception |
Set the External Interrupt Exiting.
| CoreId | Target core's ID |
| Set | Set or unset the External Interrupt Exiting |
Set guest's interruptibility state.
| InterruptibilityState |
Set Interrupt-window exiting.
| Set | Set or unset the Interrupt-window exiting |
Set LOAD DEBUG CONTROLS on Vm-entry controls.
| Set | Set or unset |
Set the monitor trap flag.
| Set | Set or unset the MTFs |
Set vm-exit for mov-to-cr0/4.
Should be called in vmx-root
| Set | or unset the vm-exits |
| Control | Register |
| Mask | Register |
Set or unset the Mov to Debug Registers Exiting.
| CoreId | Target core's ID |
| Set | Set or unset the Mov to Debug Registers Exiting |
Set vm-exit for mov-to-cr3.
Should be called in vmx-root
| CoreId | target core id |
| Set | Set or unset the vm-exits |
Set the NMI Exiting.
| Set | Set or unset the NMI Exiting |
Set NMI-window exiting.
| Set | Set or unset the NMI-window exiting |
Set vm-exit for rdpmc instructions.
Should be called in vmx-root
| Set | Set or unset the vm-exits |
Set the RDTSC/P Exiting.
| CoreId | Target core's ID |
| Set | Set or unset the RDTSC/P Exiting |
Set Rflag's trap flag.
| Set | Set or unset the TF |
Set SAVE DEBUG CONTROLS on Vm-exit controls.
| Set | Set or unset |
Set triggering events for CPUIDs.
| Set | Set or unset the trigger |
Set triggering events for VMCALLs.
| Set | Set or unset the trigger |
Suppress the incrementation of RIP.
| CoreId | Target core's ID |
| VOID VmFuncUninitVmm | ( | ) |
Uninitialize Terminate Vmx on all logical cores.
Unregister for break in the case of an MTF.
| CoreId | Target core's ID |
Unset exception bitmap in VMCS.
Should be called in vmx-root
| CoreId | Target core's ID |
| IdtIndex | Interrupt Descriptor Table index of exception |
| VOID VmFuncVmxBroadcastInitialize | ( | ) |
Export for initialize the VMX Broadcast mechanism.
| VOID VmFuncVmxBroadcastUninitialize | ( | ) |
Export for uninitialize the VMX Broadcast mechanism.
VMX-root compatible memcmp.
| Address1 | |
| Address2 | |
| Count |
VMX-root compatible strcmp.
| Address1 | |
| Address2 |
VMX-root compatible strlen.
| s | A pointer to the string |
VMX-root compatible strncmp.
| Address1 | |
| Address2 | |
| Num |
| INT32 VmFuncVmxCompatibleWcscmp | ( | const wchar_t * | Address1, |
| const wchar_t * | Address2 ) |
VMX-root compatible wcscmp.
| Address1 | |
| Address2 |
| UINT32 VmFuncVmxCompatibleWcslen | ( | const wchar_t * | s | ) |
VMX-root compatible strlen.
| s | A pointer to the string |
| INT32 VmFuncVmxCompatibleWcsncmp | ( | const wchar_t * | Address1, |
| const wchar_t * | Address2, | ||
| SIZE_T | Num ) |
VMX-root compatible wcsncmp.
| Address1 | |
| Address2 | |
| Num |
| BOOLEAN VmFuncVmxGetCurrentExecutionMode | ( | ) |
Get the current VMX operation state.
| NTSTATUS VmFuncVmxVmcall | ( | unsigned long long | VmcallNumber, |
| unsigned long long | OptionalParam1, | ||
| unsigned long long | OptionalParam2, | ||
| unsigned long long | OptionalParam3 ) |
Export for running VMX VMCALLs.
| VmcallNumber | |
| OptionalParam1 | |
| OptionalParam2 | |
| OptionalParam3 |
Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap.
Should be called in vmx-root
| BitmapMask | The content to write on exception bitmap |