ScriptEngineInternalHeader.h File Reference

Internal Headers of script engine. More...

Go to the source code of this file.

Functions
BOOLEAN	SetRegValueUsingSymbol (PGUEST_REGS GuestRegs, PSYMBOL Symbol, UINT64 Value)
	Set the register value.
UINT64	ScriptEnginePseudoRegGetTid ()
	Implementation of $tid pseudo-register.
UINT64	ScriptEnginePseudoRegGetCore ()
	Implementation of $core pseudo-register.
UINT64	ScriptEnginePseudoRegGetPid ()
	Implementation of $pid pseudo-register.
CHAR *	ScriptEnginePseudoRegGetPname ()
	Implementation of $pname pseudo-register.
UINT64	ScriptEnginePseudoRegGetProc ()
	Implementation of $proc pseudo-register.
UINT64	ScriptEnginePseudoRegGetThread ()
	Implementation of $thread pseudo-register.
UINT64	ScriptEnginePseudoRegGetPeb ()
	Implementation of $peb pseudo-register.
UINT64	ScriptEnginePseudoRegGetTeb ()
	Implementation of $teb pseudo-register.
UINT64	ScriptEnginePseudoRegGetIp ()
	Implementation of $ip pseudo-register.
UINT64	ScriptEnginePseudoRegGetBuffer (UINT64 *CorrespondingAction)
	Implementation of $buffer pseudo-register.
UINT64	ScriptEnginePseudoRegGetEventTag (PACTION_BUFFER ActionBuffer)
	Implementation of $tag pseudo-register.
UINT64	ScriptEnginePseudoRegGetEventId (PACTION_BUFFER ActionBuffer)
	Implementation of $id pseudo-register.
UINT64	ScriptEnginePseudoRegGetEventStage (PACTION_BUFFER ActionBuffer)
	Implementation of stage pseudo-register.
UINT64	ScriptEnginePseudoRegGetTime ()
	Implementation of time pseudo-register.
UINT64	ScriptEnginePseudoRegGetDate ()
	Implementation of date pseudo-register.
UINT64	ScriptEngineKeywordPoi (PUINT64 Address, BOOL *HasError)
	Implementation of poi keyword.
WORD	ScriptEngineKeywordHi (PUINT64 Address, BOOL *HasError)
	Implementation of hi keyword.
WORD	ScriptEngineKeywordLow (PUINT64 Address, BOOL *HasError)
	Implementation of low keyword.
BYTE	ScriptEngineKeywordDb (PUINT64 Address, BOOL *HasError)
	Implementation of db keyword.
DWORD	ScriptEngineKeywordDd (PUINT64 Address, BOOL *HasError)
	Implementation of dd keyword.
WORD	ScriptEngineKeywordDw (PUINT64 Address, BOOL *HasError)
	Implementation of dw keyword.
QWORD	ScriptEngineKeywordDq (PUINT64 Address, BOOL *HasError)
	Implementation of dq keyword.
UINT64	ScriptEngineKeywordPoiPa (PUINT64 Address, BOOL *HasError)
	Implementation of poi_pa keyword.
WORD	ScriptEngineKeywordHiPa (PUINT64 Address, BOOL *HasError)
	Implementation of hi keyword.
WORD	ScriptEngineKeywordLowPa (PUINT64 Address, BOOL *HasError)
	Implementation of low keyword.
BYTE	ScriptEngineKeywordDbPa (PUINT64 Address, BOOL *HasError)
	Implementation of db keyword.
DWORD	ScriptEngineKeywordDdPa (PUINT64 Address, BOOL *HasError)
	Implementation of dd keyword.
WORD	ScriptEngineKeywordDwPa (PUINT64 Address, BOOL *HasError)
	Implementation of dw keyword.
QWORD	ScriptEngineKeywordDqPa (PUINT64 Address, BOOL *HasError)
	Implementation of dq keyword.
BOOLEAN	ScriptEngineFunctionEq (UINT64 Address, QWORD Value, BOOL *HasError)
	Implementation of eq function.
BOOLEAN	ScriptEngineFunctionEd (UINT64 Address, DWORD Value, BOOL *HasError)
	Implementation of ed function.
BOOLEAN	ScriptEngineFunctionEb (UINT64 Address, BYTE Value, BOOL *HasError)
	Implementation of eb function.
BOOLEAN	ScriptEngineFunctionEqPa (UINT64 Address, QWORD Value, BOOL *HasError)
	Implementation of eq function (Physical Memory).
BOOLEAN	ScriptEngineFunctionEdPa (UINT64 Address, DWORD Value, BOOL *HasError)
	Implementation of ed function (Physical Memory).
BOOLEAN	ScriptEngineFunctionEbPa (UINT64 Address, BYTE Value, BOOL *HasError)
	Implementation of eb function (Physical Memory).
BOOLEAN	ScriptEngineFunctionCheckAddress (UINT64 Address, UINT32 Length)
	Check whether the address is valid or not.
VOID	ScriptEngineFunctionMemcpy (UINT64 Destination, UINT64 Source, UINT32 Num, BOOL *HasError)
	A VMX-compatible equivalent of memcpy function in C.
VOID	ScriptEngineFunctionMemcpyPa (UINT64 Destination, UINT64 Source, UINT32 Num, BOOL *HasError)
	A VMX-compatible equivalent of memcpy function in C for physical memory.
VOID	ScriptEngineFunctionPrint (UINT64 Tag, BOOLEAN ImmediateMessagePassing, UINT64 Value)
	Implementation of print function.
VOID	ScriptEngineFunctionTestStatement (UINT64 Tag, BOOLEAN ImmediateMessagePassing, UINT64 Value)
	Implementation of test_statement function.
VOID	ScriptEngineFunctionSpinlockLock (volatile LONG *Lock, BOOL *HasError)
	Implementation of spinlock_lock function.
VOID	ScriptEngineFunctionSpinlockUnlock (volatile LONG *Lock, BOOL *HasError)
	Implementation of spinlock_unlock function.
VOID	ScriptEngineFunctionSpinlockLockCustomWait (volatile long *Lock, unsigned MaxWait, BOOL *HasError)
	Implementation of spinlock_lock_custom_wait function.
UINT64	ScriptEngineFunctionVirtualToPhysical (UINT64 Address)
UINT64	ScriptEngineFunctionPhysicalToVirtual (UINT64 Address)
	Convert physical address to virtual address.
UINT64	ScriptEngineFunctionStrlen (const char *Address)
	Implementation of strlen function.
UINT64	ScriptEngineFunctionDisassembleLen (PVOID Address, BOOLEAN Is32Bit)
	Implementation of disassemble_len function.
UINT64	ScriptEngineFunctionWcslen (const wchar_t *Address)
	Implementation of wcslen function.
VOID	ScriptEngineFunctionMicroSleep (UINT64 Us)
	Implementation of microsleep function.
UINT64	ScriptEngineFunctionRdtsc ()
	Implementation of rdtsc function.
UINT64	ScriptEngineFunctionRdtscp ()
	Implementation of rdtscp function.
long long	ScriptEngineFunctionInterlockedExchange (long long volatile *Target, long long Value, BOOL *HasError)
	Implementation of interlocked_exchange function.
long long	ScriptEngineFunctionInterlockedExchangeAdd (long long volatile *Addend, long long Value, BOOL *HasError)
	Implementation of interlocked_exchange_add function.
long long	ScriptEngineFunctionInterlockedIncrement (long long volatile *Addend, BOOL *HasError)
	Implementation of interlocked_exchange_increment function.
long long	ScriptEngineFunctionInterlockedDecrement (long long volatile *Addend, BOOL *HasError)
	Implementation of interlocked_exchange_decrement function.
long long	ScriptEngineFunctionInterlockedCompareExchange (long long volatile *Destination, long long ExChange, long long Comperand, BOOL *HasError)
	Implementation of interlocked_compare_exchange function.
VOID	ScriptEngineFunctionEventEnable (UINT64 EventId)
	Implementation of event_enable function.
VOID	ScriptEngineFunctionEventDisable (UINT64 EventId)
	Implementation of event_disable function.
VOID	ScriptEngineFunctionEventClear (UINT64 EventId)
	Implementation of event_clear function.
VOID	ScriptEngineFunctionPause (ACTION_BUFFER *ActionDetail, PGUEST_REGS GuestRegs)
	Implementation of pause function.
VOID	ScriptEngineFunctionFlush ()
	Implementation of flush function.
VOID	ScriptEngineFunctionShortCircuitingEvent (UINT64 State, ACTION_BUFFER *ActionDetail)
	Implementation of event_ignore function.
VOID	ScriptEngineFunctionFormats (UINT64 Tag, BOOLEAN ImmediateMessagePassing, UINT64 Value)
	Implementation of formats function.
VOID	ScriptEngineFunctionPrintf (PGUEST_REGS GuestRegs, ACTION_BUFFER *ActionDetail, SCRIPT_ENGINE_GENERAL_REGISTERS *ScriptGeneralRegisters, UINT64 Tag, BOOLEAN ImmediateMessagePassing, char *Format, UINT64 ArgCount, PSYMBOL FirstArg, BOOLEAN *HasError)
	Implementation of printf function.
VOID	ScriptEngineFunctionEventInject (UINT32 InterruptionType, UINT32 Vector, BOOL *HasError)
	Implementation of event_inject function.
VOID	ScriptEngineFunctionEventInjectErrorCode (UINT32 InterruptionType, UINT32 Vector, UINT32 ErrorCode, BOOL *HasError)
	Implementation of event_inject_error_code function.
VOID	ScriptEngineFunctionEventTraceInstrumentationStep ()
	Implementation of event_trace_instrumentation_step function.
VOID	ScriptEngineFunctionEventTraceStepIn ()
	Implementation of event_trace_step_in function.
BOOLEAN	ScriptEngineFunctionLbrSave ()
	Implementation of lbr_save function.
BOOLEAN	ScriptEngineFunctionLbrPrint ()
	Implementation of lbr_print function.
BOOLEAN	ScriptEngineFunctionLbrCheck ()
	Implementation of lbr_check function.
BOOLEAN	ScriptEngineFunctionLbrRestore ()
	Implementation of lbr_restore function.
BOOLEAN	ScriptEngineFunctionLbrRestoreByFilter (UINT64 FilterOptions)
	Implementation of lbr_restore_by_filter function.
UINT64	ScriptEngineFunctionStrcmp (const char *Address1, const char *Address2)
	Implementation of strcmp function.
UINT64	ScriptEngineFunctionStrncmp (const char *Address1, const char *Address2, size_t Num)
	Implementation of strcmp function.
UINT64	ScriptEngineFunctionWcscmp (const wchar_t *Address1, const wchar_t *Address2)
	Implementation of wcscmp function.
UINT64	ScriptEngineFunctionWcsncmp (const wchar_t *Address1, const wchar_t *Address2, size_t Num)
	Implementation of wcsncmp function.
UINT64	ScriptEngineFunctionMemcmp (const char *Address1, const char *Address2, size_t Count)
	Implementation of memcmp function.

Detailed Description

Internal Headers of script engine.

Author

M.H. Gholamrezaei (mh@hy.nosp@m.perd.nosp@m.bg.or.nosp@m.g)

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2022-06-29

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ScriptEngineFunctionCheckAddress()

BOOLEAN ScriptEngineFunctionCheckAddress	(	UINT64	Address,
		UINT32	Length )

Check whether the address is valid or not.

Parameters

Address
Length

Returns

BOOLEAN

{
#ifdef SCRIPT_ENGINE_USER_MODE
 
    if (CheckAccessValidityAndSafety(Address, Length))
    {
        return TRUE;
    }
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (CheckAccessValidityAndSafety(Address, Length))
    {
        return TRUE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return FALSE;
}

ScriptEngineFunctionDisassembleLen()

UINT64 ScriptEngineFunctionDisassembleLen	(	PVOID	Address,
		BOOLEAN	Is32Bit )

Implementation of disassemble_len function.

Parameters

Address
Is32Bit

Returns

UINT64

{
    UINT64 Result = 0;
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = HyperDbgLengthDisassemblerEngine((unsigned char *)Address, MAXIMUM_INSTR_SIZE, Is32Bit ? FALSE : TRUE);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess(Address, Is32Bit);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineFunctionEb()

BOOLEAN ScriptEngineFunctionEb	(	UINT64	Address,
		BYTE	Value,
		BOOL *	HasError )

Implementation of eb function.

Parameters

Address
Value
HasError

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety(Address, sizeof(BYTE)))
    {
        //
        // Instead of indicating an error, just return false
        // to assign it as a return result to a variable
        //
        // *HasError = TRUE;
 
        return FALSE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    *(BYTE *)Address = Value;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperWriteMemorySafeOnTargetProcess(Address, &Value, sizeof(BYTE));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return TRUE;
}

ScriptEngineFunctionEbPa()

BOOLEAN ScriptEngineFunctionEbPa	(	UINT64	Address,
		BYTE	Value,
		BOOL *	HasError )

Implementation of eb function (Physical Memory).

Parameters

Address
Value
HasError

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical(Address))
    {
        //
        // Instead of indicating an error, just return false
        // to assign it as a return result to a variable
        //
        // *HasError = TRUE;
 
        return FALSE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address functions (eb_pa) is not possible in user-mode\n");
    return FALSE;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperWriteMemorySafeByPhysicalAddress(Address, (UINT64)&Value, sizeof(BYTE));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return TRUE;
}

ScriptEngineFunctionEd()

BOOLEAN ScriptEngineFunctionEd	(	UINT64	Address,
		DWORD	Value,
		BOOL *	HasError )

Implementation of ed function.

Parameters

Address
Value
HasError

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety(Address, sizeof(DWORD)))
    {
        //
        // Instead of indicating an error, just return false
        // to assign it as a return result to a variable
        //
        // *HasError = TRUE;
 
        return FALSE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    *(DWORD *)Address = Value;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperWriteMemorySafeOnTargetProcess(Address, &Value, sizeof(DWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return TRUE;
}

ScriptEngineFunctionEdPa()

BOOLEAN ScriptEngineFunctionEdPa	(	UINT64	Address,
		DWORD	Value,
		BOOL *	HasError )

Implementation of ed function (Physical Memory).

Parameters

Address
Value
HasError

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical(Address))
    {
        //
        // Instead of indicating an error, just return false
        // to assign it as a return result to a variable
        //
        // *HasError = TRUE;
 
        return FALSE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address functions (ed_pa) is not possible in user-mode\n");
    return FALSE;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperWriteMemorySafeByPhysicalAddress(Address, (UINT64)&Value, sizeof(DWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return TRUE;
}

ScriptEngineFunctionEq()

BOOLEAN ScriptEngineFunctionEq	(	UINT64	Address,
		QWORD	Value,
		BOOL *	HasError )

Implementation of eq function.

Parameters

Address
Value
HasError

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety(Address, sizeof(QWORD)))
    {
        //
        // Instead of indicating an error, just return false
        // to assign it as a return result to a variable
        //
        // *HasError = TRUE;
 
        return FALSE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    *(UINT64 *)Address = Value;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperWriteMemorySafeOnTargetProcess(Address, &Value, sizeof(QWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return TRUE;
}

ScriptEngineFunctionEqPa()

BOOLEAN ScriptEngineFunctionEqPa	(	UINT64	Address,
		QWORD	Value,
		BOOL *	HasError )

Implementation of eq function (Physical Memory).

Parameters

Address
Value
HasError

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical(Address))
    {
        //
        // Instead of indicating an error, just return false
        // to assign it as a return result to a variable
        //
        // *HasError = TRUE;
 
        return FALSE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address functions (eq_pa) is not possible in user-mode\n");
    return FALSE;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperWriteMemorySafeByPhysicalAddress(Address, (UINT64)&Value, sizeof(QWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return TRUE;
}

ScriptEngineFunctionEventClear()

VOID ScriptEngineFunctionEventClear

(

UINT64

EventId

)

Implementation of event_clear function.

Parameters

EventId

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, disabling events is not possible in user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    BOOLEAN PoolManagerAllocatedMemory = FALSE;
 
    if (g_KernelDebuggerState && EnableInstantEventMechanism)
    {
        PoolManagerAllocatedMemory = TRUE;
    }
 
    if (!DebuggerClearEvent(EventId + DebuggerEventTagStartSeed, VmFuncVmxGetCurrentExecutionMode(), PoolManagerAllocatedMemory))
    {
        LogInfo("Invalid tag id (%x)", EventId);
    }
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionEventDisable()

VOID ScriptEngineFunctionEventDisable

(

UINT64

EventId

)

Implementation of event_disable function.

Parameters

EventId

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, disabling events is not possible in user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    if (!DebuggerDisableEvent(EventId + DebuggerEventTagStartSeed))
    {
        LogInfo("Invalid tag id (%x)", EventId);
    }
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionEventEnable()

VOID ScriptEngineFunctionEventEnable

(

UINT64

EventId

)

Implementation of event_enable function.

Parameters

EventId

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, enabling events is not possible in user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    if (!DebuggerEnableEvent(EventId + DebuggerEventTagStartSeed))
    {
        LogInfo("Invalid tag id (%x)", EventId);
    }
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionEventInject()

VOID ScriptEngineFunctionEventInject	(	UINT32	InterruptionType,
		UINT32	Vector,
		BOOL *	HasError )

Implementation of event_inject function.

Parameters

InterruptionType
Vector
HasError

Returns

VOID

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, event_inject is not supported in user-mode\n");
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Validate the arguments
    //
    if (Vector >= 256 || InterruptionType >= 8)
    {
        LogInfo("Err, invalid event vector or interruption type is specified");
        return;
    }
    else
    {
        VmFuncEventInjectInterruption(InterruptionType, Vector, FALSE, 0);
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionEventInjectErrorCode()

VOID ScriptEngineFunctionEventInjectErrorCode	(	UINT32	InterruptionType,
		UINT32	Vector,
		UINT32	ErrorCode,
		BOOL *	HasError )

Implementation of event_inject_error_code function.

Parameters

InterruptionType
Vector
ErrorCode
HasError

Returns

VOID

{
    UNREFERENCED_PARAMETER(HasError);
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, event_inject is not supported in user-mode\n");
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Validate the arguments
    //
    if (Vector >= 256 || InterruptionType >= 8)
    {
        LogInfo("Err, invalid event vector or interruption type is specified");
        return;
    }
    else
    {
        VmFuncEventInjectInterruption(InterruptionType, Vector, TRUE, ErrorCode);
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionEventTraceInstrumentationStep()

VOID ScriptEngineFunctionEventTraceInstrumentationStep

(

)

Implementation of event_trace_instrumentation_step function.

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to call event_trace_instrumentation_step function in the user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    ULONG CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
 
    //
    // Call instrumentation step in
    //
    TracingPerformInstrumentationStepIn(&g_DbgState[CurrentCore]);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionEventTraceStepIn()

VOID ScriptEngineFunctionEventTraceStepIn

(

)

Implementation of event_trace_step_in function.

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to call event_trace_instrumentation_step function in the user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Call instrumentation step in
    //
    TracingPerformRegularStepInInstruction();
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionFlush()

VOID ScriptEngineFunctionFlush

(

)

Implementation of flush function.

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to flush buffers in user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Mark all buffers as read
    //
    LogMarkAllAsRead(TRUE);
    LogMarkAllAsRead(FALSE);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionFormats()

VOID ScriptEngineFunctionFormats	(	UINT64	Tag,
		BOOLEAN	ImmediateMessagePassing,
		UINT64	Value )

Implementation of formats function.

Parameters

Tag
ImmediateMessagePassing
Value

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ScriptEngineFunctionTestStatement(Tag, ImmediateMessagePassing, Value);
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    if (g_KernelDebuggerState)
    {
        KdSendFormatsFunctionResult(Value);
    }
    else if (g_UserDebuggerState)
    {
        UdSendFormatsFunctionResult(Value);
    }
    else
    {
        //
        // Prepare a buffer to bypass allocating a huge stack space for logging
        //
        char   TempBuffer[20] = {0};
        UINT32 TempBufferLen  = sprintf(TempBuffer, "%llx\n", Value);
 
        LogSimpleWithTag((UINT32)Tag, ImmediateMessagePassing, TempBuffer, TempBufferLen + 1);
    }
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionInterlockedCompareExchange()

long long ScriptEngineFunctionInterlockedCompareExchange	(	long long volatile *	Destination,
		long long	ExChange,
		long long	Comperand,
		BOOL *	HasError )

Implementation of interlocked_compare_exchange function.

Parameters

Destination
ExChange
Comperand
HasError

Returns

long long

{
    long long Result = 0;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Destination, sizeof(long long)))
    {
        *HasError = TRUE;
        return (long long)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    Result = CpuInterlockedCompareExchange64(Destination, ExChange, Comperand);
 
    return Result;
}

ScriptEngineFunctionInterlockedDecrement()

long long ScriptEngineFunctionInterlockedDecrement	(	long long volatile *	Addend,
		BOOL *	HasError )

Implementation of interlocked_exchange_decrement function.

Parameters

Addend
HasError

Returns

long long

{
    long long Result = 0;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Addend, sizeof(long long)))
    {
        *HasError = TRUE;
        return (long long)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    Result = CpuInterlockedDecrement64(Addend);
 
    return Result;
}

ScriptEngineFunctionInterlockedExchange()

long long ScriptEngineFunctionInterlockedExchange	(	long long volatile *	Target,
		long long	Value,
		BOOL *	HasError )

Implementation of interlocked_exchange function.

Parameters

Target
Value
HasError

Returns

long long

{
    long long Result = 0;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Target, sizeof(long long)))
    {
        *HasError = TRUE;
        return (long long)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    Result = CpuInterlockedExchange64(Target, Value);
 
    return Result;
}

ScriptEngineFunctionInterlockedExchangeAdd()

long long ScriptEngineFunctionInterlockedExchangeAdd	(	long long volatile *	Addend,
		long long	Value,
		BOOL *	HasError )

Implementation of interlocked_exchange_add function.

Parameters

Addend
Value
HasError

Returns

long long

{
    long long Result = 0;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Addend, sizeof(long long)))
    {
        *HasError = TRUE;
        return (long long)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    Result = CpuInterlockedExchangeAdd64(Addend, Value);
 
    return Result;
}

ScriptEngineFunctionInterlockedIncrement()

long long ScriptEngineFunctionInterlockedIncrement	(	long long volatile *	Addend,
		BOOL *	HasError )

Implementation of interlocked_exchange_increment function.

Parameters

Addend
HasError

Returns

long long

{
    long long Result = 0;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Addend, sizeof(long long)))
    {
        *HasError = TRUE;
        return (long long)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    Result = CpuInterlockedIncrement64(Addend);
 
    return Result;
}

ScriptEngineFunctionLbrCheck()

BOOLEAN ScriptEngineFunctionLbrCheck

(

)

Implementation of lbr_check function.

Returns

BOOLEAN

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to call lbr_check function in the user-mode\n");
    return FALSE;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    return HyperTraceLbrCheck();
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionLbrPrint()

BOOLEAN ScriptEngineFunctionLbrPrint

(

)

Implementation of lbr_print function.

Returns

BOOLEAN

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to call lbr_print function in the user-mode\n");
    return FALSE;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Depending if we are in VMX-root then a VMCALL is issued by default instead, otherwise the VMCALL is ignored
    //
    return HyperTraceLbrPrint(NULL);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionLbrRestore()

BOOLEAN ScriptEngineFunctionLbrRestore

(

)

Implementation of lbr_restore function.

Returns

BOOLEAN

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to call lbr_restore function in the user-mode\n");
    return FALSE;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    return HyperTraceLbrRestore();
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionLbrRestoreByFilter()

BOOLEAN ScriptEngineFunctionLbrRestoreByFilter

(

UINT64

FilterOptions

)

Implementation of lbr_restore_by_filter function.

Returns

BOOLEAN

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to call lbr_restore_by_filter function in the user-mode\n");
    return FALSE;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    return HyperTraceLbrRestoreByFilter(FilterOptions);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionLbrSave()

BOOLEAN ScriptEngineFunctionLbrSave

(

)

Implementation of lbr_save function.

Returns

BOOLEAN

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to call lbr_save function in the user-mode\n");
    return FALSE;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Depending if we are in VMX-root then a VMCALL is issued by default instead, otherwise the VMCALL is ignored
    //
    return HyperTraceLbrSave(NULL);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionMemcmp()

UINT64 ScriptEngineFunctionMemcmp	(	const char *	Address1,
		const char *	Address2,
		size_t	Count )

Implementation of memcmp function.

Parameters

Address1
Address2
Count

Returns

UINT64

{
    UINT64 Result = 0;
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = memcmp(Address1, Address2, Count);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = VmFuncVmxCompatibleMemcmp(Address1, Address2, Count);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineFunctionMemcpy()

VOID ScriptEngineFunctionMemcpy	(	UINT64	Destination,
		UINT64	Source,
		UINT32	Num,
		BOOL *	HasError )

A VMX-compatible equivalent of memcpy function in C.

Parameters

Destination
Source
Num
HasError

Returns

VOID

{
    UINT64 PrevReadLen                                              = 0;
    BYTE   MovingBuffer[DebuggerScriptEngineMemcpyMovingBufferSize] = {0};
 
    //
    // Reject zero-length copies: a Num of 0 would pass address-range
    // validation vacuously (checking 0 bytes at any mapped page succeeds),
    // which could be abused as a kernel address-mapping oracle.
    //
    if (Num == 0)
    {
        *HasError = TRUE;
        return;
    }
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    //
    // Check the destination address
    //
    if (!CheckAccessValidityAndSafety(Destination, Num))
    {
        *HasError = TRUE;
        return;
    }
 
    //
    // Check the source address
    //
    if (!CheckAccessValidityAndSafety(Source, Num))
    {
        *HasError = TRUE;
        return;
    }
 
    //
    // Address is valid, perform the memcpy in user-mode
    //
    memcpy((void *)Destination, (void *)Source, Num);
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Check the destination address
    //
    if (!CheckAccessValidityAndSafety(Destination, Num))
    {
        *HasError = TRUE;
        return;
    }
 
    //
    // Check the source address
    //
    if (!CheckAccessValidityAndSafety(Source, Num))
    {
        *HasError = TRUE;
        return;
    }
 
    //
    // Address is valid, perform the memcpy in kernel-mode (VMX-root mode)
    //
    while (Num > 0)
    {
        //
        // Check the target buffer size
        //
        if (Num > DebuggerScriptEngineMemcpyMovingBufferSize)
        {
            //
            // *** The size of read buffer is greater to maximum the moving buffer size ***
            //
 
            //
            // Read memory into the buffer
            //
            MemoryMapperReadMemorySafeOnTargetProcess(Source + PrevReadLen, MovingBuffer, DebuggerScriptEngineMemcpyMovingBufferSize);
 
            //
            // Write the moving buffer into the target buffer
            //
            MemoryMapperWriteMemorySafeOnTargetProcess(Destination + PrevReadLen, MovingBuffer, DebuggerScriptEngineMemcpyMovingBufferSize);
 
            //
            // Computing the bytes that we read
            //
            PrevReadLen += DebuggerScriptEngineMemcpyMovingBufferSize;
            Num -= DebuggerScriptEngineMemcpyMovingBufferSize;
        }
        else
        {
            //
            // *** The size of read buffer is lower than or equal to the moving buffer size ***
            //
 
            //
            // Read memory into the buffer
            //
            MemoryMapperReadMemorySafeOnTargetProcess(Source + PrevReadLen, MovingBuffer, Num);
 
            //
            // Write the moving buffer into the target buffer
            //
            MemoryMapperWriteMemorySafeOnTargetProcess(Destination + PrevReadLen, MovingBuffer, Num);
 
            //
            // Computing the bytes that we gonna read
            //
            PrevReadLen += Num;
            Num = 0; // or Num -= Num;
        }
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionMemcpyPa()

VOID ScriptEngineFunctionMemcpyPa	(	UINT64	Destination,
		UINT64	Source,
		UINT32	Num,
		BOOL *	HasError )

A VMX-compatible equivalent of memcpy function in C for physical memory.

Parameters

Destination
Source
Num
HasError

Returns

VOID

{
    UINT64 PrevReadLen                                              = 0;
    BYTE   MovingBuffer[DebuggerScriptEngineMemcpyMovingBufferSize] = {0};
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    //
    // Show an error message in user-mode
    //
    ShowMessages("err, using physical address functions (memcpy_pa) is not possible in user-mode\n");
    return;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Check the destination address (physical)
    //
    if (!CheckAddressPhysical(Destination))
    {
        *HasError = TRUE;
        return;
    }
 
    //
    // Check the source address (physical)
    //
    if (!CheckAddressPhysical(Source))
    {
        *HasError = TRUE;
        return;
    }
 
    //
    // Address is valid, perform the memcpy in kernel-mode (VMX-root mode)
    //
    while (Num > 0)
    {
        //
        // Check the target buffer size
        //
        if (Num > DebuggerScriptEngineMemcpyMovingBufferSize)
        {
            //
            // *** The size of read buffer is greater to maximum the moving buffer size ***
            //
 
            //
            // Read memory into the buffer
            //
            MemoryMapperReadMemorySafeByPhysicalAddress(Source + PrevReadLen, (UINT64)MovingBuffer, DebuggerScriptEngineMemcpyMovingBufferSize);
 
            //
            // Write the moving buffer into the target buffer
            //
            MemoryMapperWriteMemorySafeByPhysicalAddress(Destination + PrevReadLen, (UINT64)MovingBuffer, DebuggerScriptEngineMemcpyMovingBufferSize);
 
            //
            // Computing the bytes that we read
            //
            PrevReadLen += DebuggerScriptEngineMemcpyMovingBufferSize;
            Num -= DebuggerScriptEngineMemcpyMovingBufferSize;
        }
        else
        {
            //
            // *** The size of read buffer is lower than or equal to the moving buffer size ***
            //
 
            //
            // Read memory into the buffer
            //
            MemoryMapperReadMemorySafeByPhysicalAddress(Source + PrevReadLen, (UINT64)MovingBuffer, Num);
 
            //
            // Write the moving buffer into the target buffer
            //
            MemoryMapperWriteMemorySafeByPhysicalAddress(Destination + PrevReadLen, (UINT64)MovingBuffer, Num);
 
            //
            // Computing the bytes that we gonna read
            //
            PrevReadLen += Num;
            Num = 0; // or Num -= Num;
        }
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionMicroSleep()

VOID ScriptEngineFunctionMicroSleep

(

UINT64

Us

)

Implementation of microsleep function.

Parameters

Us	delay in micro second

{
#ifdef SCRIPT_ENGINE_USER_MODE
    UserModeMicroSleep(Us);
#endif
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    VmFuncVmxCompatibleMicroSleep(Us);
#endif
}

ScriptEngineFunctionPause()

VOID ScriptEngineFunctionPause	(	ACTION_BUFFER *	ActionDetail,
		PGUEST_REGS	GuestRegs )

Implementation of pause function.

Parameters

ActionDetail
GuestRegs

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, breaking is not possible in user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // pause(); function is only working when kernel debugger is working
    // it's not designed to work on vmi-mode (local debugging)
    //
    if (g_KernelDebuggerState && g_DebuggeeHaltReason == DEBUGGEE_PAUSING_REASON_NOT_PAUSED)
    {
        DEBUGGER_TRIGGERED_EVENT_DETAILS TriggeredEventDetail = {0};
        ULONG                            CurrentCore          = KeGetCurrentProcessorNumberEx(NULL);
 
        //
        // Make the details of context
        //
        TriggeredEventDetail.Tag     = ActionDetail->Tag;
        TriggeredEventDetail.Context = (PVOID)ActionDetail->Context;
 
        if (ActionDetail->CallingStage == 1)
        {
            TriggeredEventDetail.Stage = VMM_CALLBACK_CALLING_STAGE_POST_EVENT_EMULATION;
        }
        else
        {
            TriggeredEventDetail.Stage = VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION;
        }
 
        if (VmFuncVmxGetCurrentExecutionMode() == TRUE)
        {
            //
            // The guest is already in vmx-root mode
            // Halt other cores
            //
 
            KdHandleBreakpointAndDebugBreakpointsCallback(
                CurrentCore,
                DEBUGGEE_PAUSING_REASON_DEBUGGEE_EVENT_TRIGGERED,
                &TriggeredEventDetail);
        }
        else
        {
            //
            // The guest is on vmx non-root mode, the first parameter
            // is context and the second parameter is tag
            //
            VmFuncVmxVmcall(DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM_AS_A_RESULT_OF_TRIGGERING_EVENT,
                            (UINT64)&TriggeredEventDetail,
                            (UINT64)GuestRegs,
                            (UINT64)NULL);
        }
    }
    else
    {
        LogInfo("The 'pause();' function is either called from the vmi-mode or is "
                "evaluated by the '?' command. It's not allowed to use it on vmi-mode "
                "(local debugging) or by the '?' command");
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionPhysicalToVirtual()

UINT64 ScriptEngineFunctionPhysicalToVirtual

(

UINT64

Address

)

Convert physical address to virtual address.

Parameters

Address

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
 
    //
    // There is no conversion in user-mode
    //
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    return PhysicalAddressToVirtualAddressOnTargetProcess((PVOID)Address);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionPrint()

VOID ScriptEngineFunctionPrint	(	UINT64	Tag,
		BOOLEAN	ImmediateMessagePassing,
		UINT64	Value )

Implementation of print function.

Parameters

Tag
ImmediateMessagePassing
Value

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("%llx\n", Value);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Prepare a buffer to bypass allocating a huge stack space for logging
    //
    char   TempBuffer[20] = {0};
    UINT32 TempBufferLen  = sprintf(TempBuffer, "%llx\n", Value);
 
    LogSimpleWithTag((UINT32)Tag, ImmediateMessagePassing, TempBuffer, TempBufferLen + 1);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionPrintf()

VOID ScriptEngineFunctionPrintf	(	PGUEST_REGS	GuestRegs,
		ACTION_BUFFER *	ActionDetail,
		SCRIPT_ENGINE_GENERAL_REGISTERS *	ScriptGeneralRegisters,
		UINT64	Tag,
		BOOLEAN	ImmediateMessagePassing,
		char *	Format,
		UINT64	ArgCount,
		PSYMBOL	FirstArg,
		BOOLEAN *	HasError )

Implementation of printf function.

Parameters

GuestRegs
ActionDetail
ScriptGeneralRegisters
Tag
ImmediateMessagePassing
Format
ArgCount
FirstArg
HasError

Returns

VOID

{
    //
    // *** The printf function ***
    //
 
    char    FinalBuffer[PacketChunkSize]              = {0};
    UINT32  CurrentPositionInFinalBuffer              = 0;
    UINT32  CurrentProcessedPositionFromStartOfFormat = 0;
    BOOLEAN WithoutAnyFormatSpecifier                 = TRUE;
 
    UINT64  Val;
    UINT32  Position;
    UINT32  LenOfFormats = (UINT32)strlen(Format) + 1;
    PSYMBOL Symbol;
 
    *HasError = FALSE;
 
    for (int i = 0; i < ArgCount; i++)
    {
        WithoutAnyFormatSpecifier = FALSE;
        Symbol                    = FirstArg + i;
 
        //
        // Address is either wstring (%ws) or string (%s)
        //
 
        Position = (Symbol->Type >> 32) + 1;
 
        SYMBOL TempSymbol = {0};
        memcpy(&TempSymbol, Symbol, sizeof(SYMBOL));
        TempSymbol.Type &= 0x7fffffff;
 
        Val = GetValue(GuestRegs, ActionDetail, ScriptGeneralRegisters, &TempSymbol, FALSE);
 
        CHAR PercentageChar = Format[Position];
 
        // printf("position = %d is %c%c \n", Position, PercentageChar, IndicatorChar1);
 
        if (CurrentProcessedPositionFromStartOfFormat != Position)
        {
            //
            // There is some strings before this format specifier
            // we should move it to the buffer
            //
            UINT32 StringLen = Position - CurrentProcessedPositionFromStartOfFormat;
 
            //
            // Check final buffer capacity
            //
            if (CurrentPositionInFinalBuffer + StringLen < sizeof(FinalBuffer))
            {
                memcpy(&FinalBuffer[CurrentPositionInFinalBuffer],
                       &Format[CurrentProcessedPositionFromStartOfFormat],
                       StringLen);
 
                CurrentProcessedPositionFromStartOfFormat += StringLen;
                CurrentPositionInFinalBuffer += StringLen;
            }
        }
 
        //
        // Double check and apply
        //
        if (PercentageChar == '%')
        {
            //
            // Set first character of specifier
            //
            CHAR FormatSpecifier[5] = {0};
            FormatSpecifier[0]      = '%';
 
            //
            // Read second char
            //
            CHAR IndicatorChar2 = Format[Position + 1];
 
            //
            // Check if IndicatorChar2 is 2 character long or more
            //
            if (IndicatorChar2 == 'l' || IndicatorChar2 == 'w' ||
                IndicatorChar2 == 'h')
            {
                //
                // Set second char in format specifier
                //
                FormatSpecifier[1] = IndicatorChar2;
 
                if (IndicatorChar2 == 'l' && Format[Position + 2] == 'l')
                {
                    //
                    // Set third character in format specifier "ll"
                    //
                    FormatSpecifier[2] = 'l';
 
                    //
                    // Set last character
                    //
                    FormatSpecifier[3] = Format[Position + 3];
                }
                else
                {
                    //
                    // Set last character
                    //
                    FormatSpecifier[2] = Format[Position + 2];
                }
            }
            else
            {
                //
                // It's a one char specifier (Set last character)
                //
                FormatSpecifier[1] = IndicatorChar2;
            }
 
            //
            // Apply the specifier
            //
            if (!strncmp(FormatSpecifier, "%s", 2))
            {
                //
                // for string
                //
                if (!ApplyStringFormatSpecifier(
                        "%s",
                        FinalBuffer,
                        &CurrentProcessedPositionFromStartOfFormat,
                        &CurrentPositionInFinalBuffer,
                        Val,
                        FALSE,
                        sizeof(FinalBuffer)))
                {
                    *HasError = TRUE;
                    return;
                }
            }
            else if (!strncmp(FormatSpecifier, "%ls", 3) ||
                     !strncmp(FormatSpecifier, "%ws", 3))
            {
                //
                // for wide string (not important if %ls or %ws , only the length is
                // important)
                //
                if (!ApplyStringFormatSpecifier(
                        "%ws",
                        FinalBuffer,
                        &CurrentProcessedPositionFromStartOfFormat,
                        &CurrentPositionInFinalBuffer,
                        Val,
                        TRUE,
                        sizeof(FinalBuffer)))
                {
                    *HasError = TRUE;
                    return;
                }
            }
            else
            {
                ApplyFormatSpecifier(FormatSpecifier, FinalBuffer, &CurrentProcessedPositionFromStartOfFormat, &CurrentPositionInFinalBuffer, Val, sizeof(FinalBuffer));
            }
        }
    }
 
    if (WithoutAnyFormatSpecifier)
    {
        //
        // Means that it's just a simple print without any format specifier
        //
        if (LenOfFormats < sizeof(FinalBuffer))
        {
            memcpy(FinalBuffer, Format, LenOfFormats);
        }
    }
    else
    {
        //
        // Check if there is anything after the last format specifier
        //
        if (LenOfFormats > CurrentProcessedPositionFromStartOfFormat)
        {
            UINT32 RemainedLen =
                LenOfFormats - CurrentProcessedPositionFromStartOfFormat;
 
            if (CurrentPositionInFinalBuffer + RemainedLen < sizeof(FinalBuffer))
            {
                memcpy(&FinalBuffer[CurrentPositionInFinalBuffer],
                       &Format[CurrentProcessedPositionFromStartOfFormat],
                       RemainedLen);
            }
        }
    }
 
//
// Print final result
//
#ifdef SCRIPT_ENGINE_USER_MODE
    printf("%s", FinalBuffer);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Prepare a buffer to bypass allocating a huge stack space for logging
    //
    LogSimpleWithTag((UINT32)Tag, ImmediateMessagePassing, FinalBuffer, (UINT32)strlen(FinalBuffer) + 1);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionRdtsc()

UINT64 ScriptEngineFunctionRdtsc

(

)

Implementation of rdtsc function.

{
    return CpuReadTsc();
}

ScriptEngineFunctionRdtscp()

UINT64 ScriptEngineFunctionRdtscp

(

)

Implementation of rdtscp function.

{
    UINT32 Aux;
    return CpuReadTscp(&Aux);
}

ScriptEngineFunctionShortCircuitingEvent()

VOID ScriptEngineFunctionShortCircuitingEvent	(	UINT64	State,
		ACTION_BUFFER *	ActionDetail )

Implementation of event_ignore function.

Parameters

State
ActionDetail

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
    ShowMessages("err, it's not possible to short-circuit events in user-mode\n");
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (ActionDetail->CallingStage == 1)
    {
        LogWarning("Warning, calling the 'event_sc' function in the 'post' calling stage doesn't make sense as the emulation is already performed!\n"
                   "You can use this function in the 'pre' calling stage");
        return;
    }
 
    ULONG CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
 
    if (State != 0)
    {
        g_DbgState[CurrentCore].ShortCircuitingEvent = TRUE;
    }
    else
    {
        g_DbgState[CurrentCore].ShortCircuitingEvent = FALSE;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionSpinlockLock()

VOID ScriptEngineFunctionSpinlockLock	(	volatile LONG *	Lock,
		BOOL *	HasError )

Implementation of spinlock_lock function.

Parameters

Lock
HasError

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
 
    SpinlockLock(Lock);
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Lock, sizeof(LONG)))
    {
        *HasError = TRUE;
        return;
    }
 
    SpinlockLock(Lock);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionSpinlockLockCustomWait()

VOID ScriptEngineFunctionSpinlockLockCustomWait	(	volatile long *	Lock,
		unsigned	MaxWait,
		BOOL *	HasError )

Implementation of spinlock_lock_custom_wait function.

Parameters

Lock
MaxWait
HasError

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
 
    SpinlockLockWithCustomWait(Lock, MaxWait);
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Lock, sizeof(LONG)))
    {
        *HasError = TRUE;
        return;
    }
 
    SpinlockLockWithCustomWait(Lock, MaxWait);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionSpinlockUnlock()

VOID ScriptEngineFunctionSpinlockUnlock	(	volatile LONG *	Lock,
		BOOL *	HasError )

Implementation of spinlock_unlock function.

Parameters

Lock
HasError

Returns

VOID

{
#ifdef SCRIPT_ENGINE_USER_MODE
 
    SpinlockUnlock(Lock);
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Lock, sizeof(LONG)))
    {
        *HasError = TRUE;
        return;
    }
 
    SpinlockUnlock(Lock);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionStrcmp()

UINT64 ScriptEngineFunctionStrcmp	(	const char *	Address1,
		const char *	Address2 )

Implementation of strcmp function.

Parameters

Address1
Address2

Returns

UINT64

{
    UINT64 Result = 0;
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = strcmp(Address1, Address2);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = VmFuncVmxCompatibleStrcmp(Address1, Address2);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineFunctionStrlen()

UINT64 ScriptEngineFunctionStrlen

(

const char *

Address

)

Implementation of strlen function.

Parameters

Address

Returns

UINT64

{
    UINT64 Result = 0;
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = strlen(Address);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = VmFuncVmxCompatibleStrlen(Address);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineFunctionStrncmp()

UINT64 ScriptEngineFunctionStrncmp	(	const char *	Address1,
		const char *	Address2,
		size_t	Num )

Implementation of strcmp function.

Parameters

Address1
Address2
Num

Returns

UINT64

{
    UINT64 Result = 0;
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = strncmp(Address1, Address2, Num);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = VmFuncVmxCompatibleStrncmp(Address1, Address2, Num);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineFunctionTestStatement()

VOID ScriptEngineFunctionTestStatement	(	UINT64	Tag,
		BOOLEAN	ImmediateMessagePassing,
		UINT64	Value )

Implementation of test_statement function.

Parameters

Tag
ImmediateMessagePassing
Value

Returns

VOID

{
    UNREFERENCED_PARAMETER(Tag);
    UNREFERENCED_PARAMETER(ImmediateMessagePassing);
    UNREFERENCED_PARAMETER(Value);
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    g_CurrentExprEvalResult         = Value;
    g_CurrentExprEvalResultHasError = FALSE;
 
#endif // SCRIPT_ENGINE_USER_MODE
}

ScriptEngineFunctionVirtualToPhysical()

UINT64 ScriptEngineFunctionVirtualToPhysical

(

UINT64

Address

)

{
#ifdef SCRIPT_ENGINE_USER_MODE
 
    //
    // There is no conversion in user-mode
    //
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    return VirtualAddressToPhysicalAddressOnTargetProcess((PVOID)Address);
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEngineFunctionWcscmp()

UINT64 ScriptEngineFunctionWcscmp	(	const wchar_t *	Address1,
		const wchar_t *	Address2 )

Implementation of wcscmp function.

Parameters

Address1
Address2

Returns

UINT64

{
    UINT64 Result = 0;
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = wcscmp(Address1, Address2);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = VmFuncVmxCompatibleWcscmp(Address1, Address2);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineFunctionWcslen()

UINT64 ScriptEngineFunctionWcslen

(

const wchar_t *

Address

)

Implementation of wcslen function.

Parameters

Address

Returns

UINT64

{
    UINT64 Result = 0;
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = wcslen(Address);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = VmFuncVmxCompatibleWcslen(Address);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineFunctionWcsncmp()

UINT64 ScriptEngineFunctionWcsncmp	(	const wchar_t *	Address1,
		const wchar_t *	Address2,
		size_t	Num )

Implementation of wcsncmp function.

Parameters

Address1
Address2
Num

Returns

UINT64

{
    UINT64 Result = 0;
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = wcsncmp(Address1, Address2, Num);
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    Result = VmFuncVmxCompatibleWcsncmp(Address1, Address2, Num);
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDb()

BYTE ScriptEngineKeywordDb	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of db keyword.

Parameters

Address
HasError

Returns

BYTE

{
    BYTE Result = NULL_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(BYTE)))
    {
        *HasError = TRUE;
 
        return NULL_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = (BYTE)*Address;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(BYTE));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDbPa()

BYTE ScriptEngineKeywordDbPa	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of db keyword.

Parameters

Address
HasError

Returns

BYTE

{
    BYTE Result = NULL_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical((UINT64)Address))
    {
        *HasError = TRUE;
 
        return NULL_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address keywords (db_pa) is not possible in user-mode\n");
    return (BYTE)NULL;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(BYTE));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDd()

DWORD ScriptEngineKeywordDd	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of dd keyword.

Parameters

Address
HasError

Returns

DWORD

{
    DWORD Result = NULL_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(DWORD)))
    {
        *HasError = TRUE;
 
        return NULL_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = (DWORD)*Address;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(DWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDdPa()

DWORD ScriptEngineKeywordDdPa	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of dd keyword.

Parameters

Address
HasError

Returns

DWORD

{
    DWORD Result = NULL_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical((UINT64)Address))
    {
        *HasError = TRUE;
 
        return NULL_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address keywords (dd_pa) is not possible in user-mode\n");
    return (DWORD)NULL;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(DWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDq()

QWORD ScriptEngineKeywordDq	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of dq keyword.

Parameters

Address
HasError

Returns

QWORD

{
    QWORD Result = (QWORD)NULL;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(DWORD)))
    {
        *HasError = TRUE;
 
        return (QWORD)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = *Address;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(QWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDqPa()

QWORD ScriptEngineKeywordDqPa	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of dq keyword.

Parameters

Address
HasError

Returns

QWORD

{
    QWORD Result = (QWORD)NULL;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical((UINT64)Address))
    {
        *HasError = TRUE;
 
        return (QWORD)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address keywords (dq_pa) is not possible in user-mode\n");
    return (QWORD)NULL;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(QWORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDw()

WORD ScriptEngineKeywordDw	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of dw keyword.

Parameters

Address
HasError

Returns

WORD

{
    WORD Result = NULL_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(WORD)))
    {
        *HasError = TRUE;
 
        return NULL_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = (WORD)*Address;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(WORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordDwPa()

WORD ScriptEngineKeywordDwPa	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of dw keyword.

Parameters

Address
HasError

Returns

WORD

{
    WORD Result = NULL_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical((UINT64)Address))
    {
        *HasError = TRUE;
 
        return NULL_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address keywords (dw_pa) is not possible in user-mode\n");
    return (WORD)NULL;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(WORD));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordHi()

WORD ScriptEngineKeywordHi	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of hi keyword.

Parameters

Address
HasError

Returns

WORD

{
    QWORD Result = NULL64_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(UINT64)))
    {
        *HasError = TRUE;
 
        return NULL64_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = *Address;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(UINT64));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return HIWORD(Result);
}

ScriptEngineKeywordHiPa()

WORD ScriptEngineKeywordHiPa	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of hi keyword.

Parameters

Address
HasError

Returns

WORD

{
    QWORD Result = NULL64_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical((UINT64)Address))
    {
        *HasError = TRUE;
 
        return NULL64_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address keywords (hi_pa) is not possible in user-mode\n");
    return (WORD)NULL;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(UINT64));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return HIWORD(Result);
}

ScriptEngineKeywordLow()

WORD ScriptEngineKeywordLow	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of low keyword.

Parameters

Address
HasError

Returns

WORD

{
    QWORD Result = NULL64_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(UINT64)))
    {
        *HasError = TRUE;
 
        return NULL64_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = *Address;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(UINT64));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return LOWORD(Result);
}

ScriptEngineKeywordLowPa()

WORD ScriptEngineKeywordLowPa	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of low keyword.

Parameters

Address
HasError

Returns

WORD

{
    QWORD Result = NULL64_ZERO;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical((UINT64)Address))
    {
        *HasError = TRUE;
 
        return NULL64_ZERO;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address keywords (low_pa) is not possible in user-mode\n");
    return (WORD)NULL;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(UINT64));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return LOWORD(Result);
}

ScriptEngineKeywordPoi()

UINT64 ScriptEngineKeywordPoi	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of poi keyword.

Parameters

Address
HasError

Returns

UINT64

{
    UINT64 Result = (UINT64)NULL;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(UINT64)))
    {
        *HasError = TRUE;
 
        return (UINT64)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
    Result = *Address;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(UINT64));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEngineKeywordPoiPa()

UINT64 ScriptEngineKeywordPoiPa	(	PUINT64	Address,
		BOOL *	HasError )

Implementation of poi_pa keyword.

Parameters

Address
HasError

Returns

UINT64

{
    UINT64 Result = (UINT64)NULL;
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    if (!CheckAddressPhysical((UINT64)Address))
    {
        *HasError = TRUE;
 
        return (UINT64)NULL;
    }
 
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
#ifdef SCRIPT_ENGINE_USER_MODE
 
    ShowMessages("err, using physical address keywords (poi_pa) is not possible in user-mode\n");
    return (UINT64)NULL;
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(UINT64));
#endif // SCRIPT_ENGINE_KERNEL_MODE
 
    return Result;
}

ScriptEnginePseudoRegGetBuffer()

UINT64 ScriptEnginePseudoRegGetBuffer

(

UINT64 *

CorrespondingAction

)

Implementation of $buffer pseudo-register.

Parameters

CorrespondingAction

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    //
    // $buffer doesn't mean anything in user-mode
    //
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ScriptEngineWrapperGetAddressOfReservedBuffer((DEBUGGER_EVENT_ACTION *)CorrespondingAction);
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetCore()

UINT64 ScriptEnginePseudoRegGetCore

(

)

Implementation of $core pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)PlatformGetCurrentProcessorNumber();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformCpuGetCurrentProcessorNumber();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetDate()

UINT64 ScriptEnginePseudoRegGetDate

(

)

Implementation of date pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Get the current core's date
    //
    return ScriptEngineGetTargetCoreDate();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetEventId()

UINT64 ScriptEnginePseudoRegGetEventId

(

PACTION_BUFFER

ActionBuffer

)

Implementation of $id pseudo-register.

Parameters

ActionBuffer

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (ActionBuffer->Tag - DebuggerEventTagStartSeed);
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetEventStage()

UINT64 ScriptEnginePseudoRegGetEventStage

(

PACTION_BUFFER

ActionBuffer

)

Implementation of stage pseudo-register.

Parameters

ActionBuffer

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ActionBuffer->CallingStage;
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetEventTag()

UINT64 ScriptEnginePseudoRegGetEventTag

(

PACTION_BUFFER

ActionBuffer

)

Implementation of $tag pseudo-register.

Parameters

ActionBuffer

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ActionBuffer->Tag;
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetIp()

UINT64 ScriptEnginePseudoRegGetIp

(

)

Implementation of $ip pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    //
    // $ip doesn't have meaning in user-moderds
    //
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return ScriptEngineWrapperGetInstructionPointer();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetPeb()

UINT64 ScriptEnginePseudoRegGetPeb

(

)

Implementation of $peb pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
#    ifdef _WIN32
    //
    // Hand-rolled structs ( may cause conflict depending on your dev env )
    //
    struct PROCESS_BASIC_INFORMATION
    {
        PVOID     Reserved1;
        PVOID     PebBaseAddress;
        PVOID     Reserved2[2];
        ULONG_PTR UniqueProcessId;
        PVOID     Reserved3;
    };
 
    struct PEB_LDR_DATA
    {
        BYTE       Reserved1[8];
        PVOID      Reserved2[3];
        LIST_ENTRY InMemoryOrderModuleList;
    };
 
    struct PEB
    {
        BYTE                  Reserved1[2];
        BYTE                  BeingDebugged;
        BYTE                  Reserved2[1];
        PVOID                 Reserved3[2];
        struct PEB_LDR_DATA * Ldr;
        PVOID                 ProcessParameters; /* PRTL_USER_PROCESS_PARAMETERS */
        BYTE                  Reserved4[104];
        PVOID                 Reserved5[52];
        PVOID                 PostProcessInitRoutine; /* PPS_POST_PROCESS_INIT_ROUTINE */
        BYTE                  Reserved6[128];
        PVOID                 Reserved7[1];
        ULONG                 SessionId;
    };
 
    struct UNICODE_STRING
    {
        USHORT Length;
        USHORT MaximumLength;
        PWSTR  Buffer;
    };
 
    struct LDR_MODULE
    {
        LIST_ENTRY            InLoadOrderModuleList;
        LIST_ENTRY            InMemoryOrderModuleList;
        LIST_ENTRY            InInitializationOrderModuleList;
        PVOID                 BaseAddress;
        PVOID                 EntryPoint;
        ULONG                 SizeOfImage;
        struct UNICODE_STRING FullDllName;
        struct UNICODE_STRING BaseDllName;
        ULONG                 Flags;
        SHORT                 LoadCount;
        SHORT                 TlsIndex;
        LIST_ENTRY            HashTableEntry;
        ULONG                 TimeDateStamp;
    };
 
    enum PROCESSINFOCLASS
    {
        ProcessBasicInformation = 0,
        ProcessDebugPort        = 7,
        ProcessWow64Information = 26,
        ProcessImageFileName    = 27
    };
 
    LPCWSTR NTDLL_NAME       = L"ntdll.dll";
    LPCSTR  NTQUERYINFO_NAME = "NtQueryInformationProcess";
 
    HMODULE  NtdllMod;
    HANDLE   ThisProcess;
    NTSTATUS NtCallRet;
    ULONG    BytesReturned;
 
    //
    // function pointer to house result from GetProcAddress
    //
    NTSTATUS(WINAPI * QueryInfoProcPtr)
    (HANDLE, enum PROCESSINFOCLASS, PVOID, ULONG, PULONG);
 
    struct PROCESS_BASIC_INFORMATION BasicInfo;
    struct PEB *                     PebPtr;
 
    /* retrieve pseudo-handle */
    ThisProcess = GetCurrentProcess();
 
    //
    // get address to already loaded module
    //
    NtdllMod = LoadLibraryW(NTDLL_NAME);
 
    //
    // get pointer to query function
    //
    QueryInfoProcPtr =
        (NTSTATUS(WINAPI *)(HANDLE, enum PROCESSINFOCLASS, PVOID, ULONG, PULONG))GetProcAddress(NtdllMod, NTQUERYINFO_NAME);
 
    //
    // call function on self; introspect
    //
    NtCallRet = QueryInfoProcPtr(ThisProcess, ProcessBasicInformation, &BasicInfo, sizeof(BasicInfo), &BytesReturned);
 
    //
    // get peb ptr and decode some if its fields
    //
    PebPtr = (struct PEB *)BasicInfo.PebBaseAddress;
 
    return (UINT64)PebPtr;
 
#    else // !_WIN32
 
    //
    // The PEB (Process Environment Block) is a Windows NT-specific structure
    // maintained by the kernel for every user-mode process. It holds loader
    // data, heap pointers, the image path, and other process-wide state that
    // has no direct equivalent in the Linux process model.
    //
    // TODO: investigate whether a meaningful substitute exists on Linux
    //       (e.g. /proc/self/maps, dl_iterate_phdr, or a custom auxv walk)
    //       and implement it here if HyperDbg user-mode on Linux ever needs $peb.
    //
    return 0;
 
#    endif // _WIN32
 
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // PEB doesn't make sense in kernel-mode
    //
    return NULL64_ZERO;
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetPid()

UINT64 ScriptEnginePseudoRegGetPid

(

)

Implementation of $pid pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)PlatformGetCurrentProcessId();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentProcessId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetPname()

CHAR * ScriptEnginePseudoRegGetPname

(

)

Implementation of $pname pseudo-register.

Returns

CHAR*

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return PlatformGetCurrentProcessName();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return CommonGetProcessNameFromProcessControlBlock(PlatformProcessGetCurrentProcess());
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetProc()

UINT64 ScriptEnginePseudoRegGetProc

(

)

Implementation of $proc pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentProcess();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetTeb()

UINT64 ScriptEnginePseudoRegGetTeb

(

)

Implementation of $teb pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentThreadTeb();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetThread()

UINT64 ScriptEnginePseudoRegGetThread

(

)

Implementation of $thread pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentThread();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetTid()

UINT64 ScriptEnginePseudoRegGetTid

(

)

Implementation of $tid pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return (UINT64)PlatformGetCurrentThreadId();
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
    return (UINT64)PlatformProcessGetCurrentThreadId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

ScriptEnginePseudoRegGetTime()

UINT64 ScriptEnginePseudoRegGetTime

(

)

Implementation of time pseudo-register.

Returns

UINT64

{
#ifdef SCRIPT_ENGINE_USER_MODE
    return NULL;
#endif // SCRIPT_ENGINE_USER_MODE
 
#ifdef SCRIPT_ENGINE_KERNEL_MODE
 
    //
    // Get the current core's time
    //
    return ScriptEngineGetTargetCoreTime();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}

SetRegValueUsingSymbol()

BOOLEAN SetRegValueUsingSymbol	(	PGUEST_REGS	GuestRegs,
		PSYMBOL	Symbol,
		UINT64	Value )

Set the register value.

Parameters

GuestRegs
Symbol
Value
ActionBuffer

Returns

BOOLEAN

{
#if defined(SCRIPT_ENGINE_USER_MODE) && defined(HYPERDBG_LIBHYPERDBG)
    if (g_HwdbgInstanceInfoIsValid == FALSE)
        return SetRegValue(GuestRegs, (UINT32)Symbol->Value, Value);
    else
        return SetRegValueHwdbg((UINT64 *)GuestRegs, (UINT32)Symbol->Value, Value);
#else
    return SetRegValue(GuestRegs, (UINT32)Symbol->Value, Value);
#endif // defined(SCRIPT_ENGINE_USER_MODE) && defined(HYPERDBG_LIBHYPERDBG)
}