PseudoRegisters.c File Reference

Script engine pseudo-registers implementations. More...

#include "pch.h"

Functions
UINT64	ScriptEnginePseudoRegGetTid ()
	Implementation of $tid pseudo-register.
UINT64	ScriptEnginePseudoRegGetCore ()
	Implementation of $core pseudo-register.
UINT64	ScriptEnginePseudoRegGetPid ()
	Implementation of $pid pseudo-register.
CHAR *	ScriptEnginePseudoRegGetPname ()
	Implementation of $pname pseudo-register.
UINT64	ScriptEnginePseudoRegGetProc ()
	Implementation of $proc pseudo-register.
UINT64	ScriptEnginePseudoRegGetThread ()
	Implementation of $thread pseudo-register.
UINT64	ScriptEnginePseudoRegGetPeb ()
	Implementation of $peb pseudo-register.
UINT64	ScriptEnginePseudoRegGetTeb ()
	Implementation of $teb pseudo-register.
UINT64	ScriptEnginePseudoRegGetIp ()
	Implementation of $ip pseudo-register.
UINT64	ScriptEnginePseudoRegGetBuffer (UINT64 *CorrespondingAction)
	Implementation of $buffer pseudo-register.
UINT64	ScriptEnginePseudoRegGetEventTag (PACTION_BUFFER ActionBuffer)
	Implementation of $tag pseudo-register.
UINT64	ScriptEnginePseudoRegGetEventId (PACTION_BUFFER ActionBuffer)
	Implementation of $id pseudo-register.
UINT64	ScriptEnginePseudoRegGetEventStage (PACTION_BUFFER ActionBuffer)
	Implementation of stage pseudo-register.
UINT64	ScriptEnginePseudoRegGetTime ()
	Implementation of time pseudo-register.
UINT64	ScriptEnginePseudoRegGetDate ()
	Implementation of date pseudo-register.

Detailed Description

Script engine pseudo-registers implementations.

Author

M.H. Gholamrezaei (mh@hy.nosp@m.perd.nosp@m.bg.or.nosp@m.g)

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2022-06-29

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ScriptEnginePseudoRegGetBuffer()

UINT64 ScriptEnginePseudoRegGetBuffer

(

UINT64 *

CorrespondingAction

)

Implementation of $buffer pseudo-register.

Parameters

CorrespondingAction

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    //
    // $buffer doesn't mean anything in user-mode
    //
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ScriptEngineWrapperGetAddressOfReservedBuffer((DEBUGGER_EVENT_ACTION *)CorrespondingAction);
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetCore()

UINT64 ScriptEnginePseudoRegGetCore

(

)

Implementation of $core pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)PlatformGetCurrentProcessorNumber();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformCpuGetCurrentProcessorNumber();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetDate()

UINT64 ScriptEnginePseudoRegGetDate

(

)

Implementation of date pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Get the current core's date
    //
    return ScriptEngineGetTargetCoreDate();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetEventId()

UINT64 ScriptEnginePseudoRegGetEventId

(

PACTION_BUFFER

ActionBuffer

)

Implementation of $id pseudo-register.

Parameters

ActionBuffer

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (ActionBuffer->Tag - DebuggerEventTagStartSeed);
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetEventStage()

UINT64 ScriptEnginePseudoRegGetEventStage

(

PACTION_BUFFER

ActionBuffer

)

Implementation of stage pseudo-register.

Parameters

ActionBuffer

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ActionBuffer->CallingStage;
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetEventTag()

UINT64 ScriptEnginePseudoRegGetEventTag

(

PACTION_BUFFER

ActionBuffer

)

Implementation of $tag pseudo-register.

Parameters

ActionBuffer

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ActionBuffer->Tag;
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetIp()

UINT64 ScriptEnginePseudoRegGetIp

(

)

Implementation of $ip pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    //
    // $ip doesn't have meaning in user-moderds
    //
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ScriptEngineWrapperGetInstructionPointer();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetPeb()

UINT64 ScriptEnginePseudoRegGetPeb

(

)

Implementation of $peb pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
#    ifdef _WIN32
    //
    // Hand-rolled structs ( may cause conflict depending on your dev env )
    //
    struct PROCESS_BASIC_INFORMATION
    {
        PVOID     Reserved1;
        PVOID     PebBaseAddress;
        PVOID     Reserved2[2];
        ULONG_PTR UniqueProcessId;
        PVOID     Reserved3;
    };
 
    struct PEB_LDR_DATA
    {
        BYTE       Reserved1[8];
        PVOID      Reserved2[3];
        LIST_ENTRY InMemoryOrderModuleList;
    };
 
    struct PEB
    {
        BYTE                  Reserved1[2];
        BYTE                  BeingDebugged;
        BYTE                  Reserved2[1];
        PVOID                 Reserved3[2];
        struct PEB_LDR_DATA * Ldr;
        PVOID                 ProcessParameters; /* PRTL_USER_PROCESS_PARAMETERS */
        BYTE                  Reserved4[104];
        PVOID                 Reserved5[52];
        PVOID                 PostProcessInitRoutine; /* PPS_POST_PROCESS_INIT_ROUTINE */
        BYTE                  Reserved6[128];
        PVOID                 Reserved7[1];
        ULONG                 SessionId;
    };
 
    struct UNICODE_STRING
    {
        USHORT Length;
        USHORT MaximumLength;
        PWSTR  Buffer;
    };
 
    struct LDR_MODULE
    {
        LIST_ENTRY            InLoadOrderModuleList;
        LIST_ENTRY            InMemoryOrderModuleList;
        LIST_ENTRY            InInitializationOrderModuleList;
        PVOID                 BaseAddress;
        PVOID                 EntryPoint;
        ULONG                 SizeOfImage;
        struct UNICODE_STRING FullDllName;
        struct UNICODE_STRING BaseDllName;
        ULONG                 Flags;
        SHORT                 LoadCount;
        SHORT                 TlsIndex;
        LIST_ENTRY            HashTableEntry;
        ULONG                 TimeDateStamp;
    };
 
    enum PROCESSINFOCLASS
    {
        ProcessBasicInformation = 0,
        ProcessDebugPort        = 7,
        ProcessWow64Information = 26,
        ProcessImageFileName    = 27
    };
 
    LPCWSTR NTDLL_NAME       = L"ntdll.dll";
    LPCSTR  NTQUERYINFO_NAME = "NtQueryInformationProcess";
 
    HMODULE  NtdllMod;
    HANDLE   ThisProcess;
    NTSTATUS NtCallRet;
    ULONG    BytesReturned;
 
    //
    // function pointer to house result from GetProcAddress
    //
    NTSTATUS(WINAPI * QueryInfoProcPtr)
    (HANDLE, enum PROCESSINFOCLASS, PVOID, ULONG, PULONG);
 
    struct PROCESS_BASIC_INFORMATION BasicInfo;
    struct PEB *                     PebPtr;
 
    /* retrieve pseudo-handle */
    ThisProcess = GetCurrentProcess();
 
    //
    // get address to already loaded module
    //
    NtdllMod = LoadLibraryW(NTDLL_NAME);
 
    //
    // get pointer to query function
    //
    QueryInfoProcPtr =
        (NTSTATUS(WINAPI *)(HANDLE, enum PROCESSINFOCLASS, PVOID, ULONG, PULONG))GetProcAddress(NtdllMod, NTQUERYINFO_NAME);
 
    //
    // call function on self; introspect
    //
    NtCallRet = QueryInfoProcPtr(ThisProcess, ProcessBasicInformation, &BasicInfo, sizeof(BasicInfo), &BytesReturned);
 
    //
    // get peb ptr and decode some if its fields
    //
    PebPtr = (struct PEB *)BasicInfo.PebBaseAddress;
 
    return (UINT64)PebPtr;
 
#    else // !_WIN32
 
    //
    // The PEB (Process Environment Block) is a Windows NT-specific structure
    // maintained by the kernel for every user-mode process. It holds loader
    // data, heap pointers, the image path, and other process-wide state that
    // has no direct equivalent in the Linux process model.
    //
    // TODO: investigate whether a meaningful substitute exists on Linux
    //       (e.g. /proc/self/maps, dl_iterate_phdr, or a custom auxv walk)
    //       and implement it here if HyperDbg user-mode on Linux ever needs $peb.
    //
    return 0;
 
#    endif // _WIN32
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // PEB doesn't make sense in kernel-mode
    //
    return NULL64_ZERO;
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetPid()

UINT64 ScriptEnginePseudoRegGetPid

(

)

Implementation of $pid pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)PlatformGetCurrentProcessId();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentProcessId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetPname()

CHAR * ScriptEnginePseudoRegGetPname

(

)

Implementation of $pname pseudo-register.

Returns

CHAR*

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return PlatformGetCurrentProcessName();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return CommonGetProcessNameFromProcessControlBlock(PlatformProcessGetCurrentProcess());
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetProc()

UINT64 ScriptEnginePseudoRegGetProc

(

)

Implementation of $proc pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentProcess();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetTeb()

UINT64 ScriptEnginePseudoRegGetTeb

(

)

Implementation of $teb pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentThreadTeb();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetThread()

UINT64 ScriptEnginePseudoRegGetThread

(

)

Implementation of $thread pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentThread();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetTid()

UINT64 ScriptEnginePseudoRegGetTid

(

)

Implementation of $tid pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)PlatformGetCurrentThreadId();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentThreadId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetTime()

UINT64 ScriptEnginePseudoRegGetTime

(

)

Implementation of time pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Get the current core's time
    //
    return ScriptEngineGetTargetCoreTime();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}