HyperDbg Debugger
Loading...
Searching...
No Matches
Logging.h
Go to the documentation of this file.
1
13#pragma once
14
16// Global Variables //
18
24
30
32// Structures //
34
39typedef struct _NOTIFY_RECORD
40{
42
43 union
44 {
45 PKEVENT Event;
48
49 KDPC Dpc;
50 BOOLEAN CheckVmxRootMessagePool; // Set so that notify callback can understand where to check (Vmx root or Vmx non-root)
52
57typedef struct _BUFFER_HEADER
58{
59 UINT32 OperationNumber; // Operation ID to user-mode
60 UINT32 BufferLength; // The actual length
61 BOOLEAN Valid; // Determine whether the buffer was valid to send or not
63
69{
70 KSPIN_LOCK BufferLock; // SpinLock to protect access to the queue
71 KSPIN_LOCK BufferLockForNonImmMessage; // SpinLock to protect access to the queue of non-imm messages
72
73 UINT64 BufferForMultipleNonImmediateMessage; // Start address of the buffer for accumulating non-immadiate messages
74 UINT32 CurrentLengthOfNonImmBuffer; // the current size of the buffer for accumulating non-immadiate messages
75
76 //
77 // Regular buffers
78 //
79 UINT64 BufferStartAddress; // Start address of the buffer
80 UINT64 BufferEndAddress; // End address of the buffer
81
82 UINT32 CurrentIndexToSend; // Current buffer index to send to user-mode
83 UINT32 CurrentIndexToWrite; // Current buffer index to write new messages
84
85 //
86 // Priority buffers
87 //
88 UINT64 BufferStartAddressPriority; // Start address of the buffer
89 UINT64 BufferEndAddressPriority; // End address of the buffer
90
91 UINT32 CurrentIndexToSendPriority; // Current buffer index to send to user-mode for priority buffers
92 UINT32 CurrentIndexToWritePriority; // Current buffer index to write new messages for priority buffers
93
95
97// Global Variables //
99
105
110volatile LONG VmxRootLoggingLock;
111
117
119// Illustration //
121
122/*
123
124A core buffer is like this , it's divided into MaximumPacketsCapacity chucks,
125each chunk has PacketChunkSize + sizeof(BUFFER_HEADER) size
126
127 _________________________
128 | BUFFER_HEADER |
129 |_________________________|
130 | |
131 | BODY |
132 | (Buffer) |
133 | size = PacketChunkSize |
134 | |
135 |_________________________|
136 | BUFFER_HEADER |
137 |_________________________|
138 | |
139 | BODY |
140 | (Buffer) |
141 | size = PacketChunkSize |
142 | |
143 |_________________________|
144 | |
145 | |
146 | |
147 | |
148 | |
149 | . |
150 | . |
151 | . |
152 | |
153 | |
154 | |
155 |_________________________|
156 | BUFFER_HEADER |
157 |_________________________|
158 | |
159 | BODY |
160 | (Buffer) |
161 | size = PacketChunkSize |
162 | |
163 |_________________________|
164
165*/
166
168// Global Variables //
170
176
182
184// Functions //
186
188LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLength);
189
190VOID
191LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2);
UCHAR BOOLEAN
Definition BasicTypes.h:39
#define VOID
Definition BasicTypes.h:33
unsigned __int64 UINT64
Definition BasicTypes.h:21
unsigned int UINT32
Definition BasicTypes.h:48
enum _NOTIFY_TYPE NOTIFY_TYPE
Type of transferring buffer between user-to-kernel.
BOOLEAN LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 *ReturnedLength)
Attempt to read the buffer.
Definition Logging.c:697
volatile LONG VmxRootLoggingLock
Vmx-root lock for logging.
Definition Logging.h:110
struct _NOTIFY_RECORD * PNOTIFY_RECORD
struct _NOTIFY_RECORD NOTIFY_RECORD
The usermode request.
VOID LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
Complete the IRP in IRP Pending state and fill the usermode buffers with pool data.
Definition Logging.c:1350
struct _BUFFER_HEADER BUFFER_HEADER
Message buffer structure.
volatile LONG VmxRootLoggingLockForNonImmBuffers
Vmx-root lock for logging.
Definition Logging.h:116
LOG_BUFFER_INFORMATION * MessageBufferInformation
Global Variable for buffer on all cores.
Definition Logging.h:104
char * VmxTempMessage
VMX temporary buffer for logging messages.
Definition Logging.h:29
NOTIFY_RECORD * g_GlobalNotifyRecord
Save the state of the thread that waits for messages to deliver to user-mode.
Definition Logging.h:175
struct _BUFFER_HEADER * PBUFFER_HEADER
struct _LOG_BUFFER_INFORMATION LOG_BUFFER_INFORMATION
Core-specific buffers.
struct _LOG_BUFFER_INFORMATION * PLOG_BUFFER_INFORMATION
char * VmxLogMessage
VMX buffer for logging messages.
Definition Logging.h:23
MESSAGE_TRACING_CALLBACKS g_MsgTracingCallbacks
Global variable that holds callbacks.
Definition Logging.h:181
Message buffer structure.
Definition Logging.h:58
UINT32 BufferLength
Definition Logging.h:60
UINT32 OperationNumber
Definition Logging.h:59
BOOLEAN Valid
Definition Logging.h:61
Core-specific buffers.
Definition Logging.h:69
KSPIN_LOCK BufferLockForNonImmMessage
Definition Logging.h:71
UINT32 CurrentIndexToSend
Definition Logging.h:82
UINT64 BufferEndAddressPriority
Definition Logging.h:89
UINT32 CurrentLengthOfNonImmBuffer
Definition Logging.h:74
UINT64 BufferStartAddress
Definition Logging.h:79
UINT64 BufferStartAddressPriority
Definition Logging.h:88
UINT32 CurrentIndexToSendPriority
Definition Logging.h:91
UINT32 CurrentIndexToWritePriority
Definition Logging.h:92
UINT64 BufferEndAddress
Definition Logging.h:80
UINT32 CurrentIndexToWrite
Definition Logging.h:83
UINT64 BufferForMultipleNonImmediateMessage
Definition Logging.h:73
KSPIN_LOCK BufferLock
Definition Logging.h:70
Prototype of each function needed by message tracer.
Definition HyperLog.h:49
The usermode request.
Definition Logging.h:40
PIRP PendingIrp
Definition Logging.h:46
NOTIFY_TYPE Type
Definition Logging.h:41
union _NOTIFY_RECORD::@55 Message
PKEVENT Event
Definition Logging.h:45
BOOLEAN CheckVmxRootMessagePool
Definition Logging.h:50
KDPC Dpc
Definition Logging.h:49