Thread.h File Reference

Header for kernel debugger functions for threads. More...

Go to the source code of this file.

Functions
BOOLEAN	ThreadInterpretThread (PROCESSOR_DEBUGGING_STATE *DbgState, PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET TidRequest)
	change the current thread
VOID	ThreadEnableOrDisableThreadChangeMonitor (PROCESSOR_DEBUGGING_STATE *DbgState, BOOLEAN Enable, BOOLEAN IsSwitchByClockIntrrupt)
	Enable or disable the thread change monitoring detection on the running core.
BOOLEAN	ThreadHandleThreadChange (PROCESSOR_DEBUGGING_STATE *DbgState)
	handle thread changes
BOOLEAN	ThreadQueryCount (PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS DebuggerUsermodeProcessOrThreadQueryRequest)
	Query thread details (count).
BOOLEAN	ThreadQueryList (PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS DebuggerUsermodeProcessOrThreadQueryRequest, PVOID AddressToSaveDetail, UINT32 BufferSize)
	Query thread details (list).
BOOLEAN	ThreadQueryDetails (PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET GetInformationThreadRequest)
	Query thread details.
BOOLEAN	ThreadQueryDebugRegisterInterceptionStateByCoreId (UINT32 CoreId)
	Query for deubg register interception state.

Detailed Description

Header for kernel debugger functions for threads.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-11-23

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ThreadEnableOrDisableThreadChangeMonitor()

VOID ThreadEnableOrDisableThreadChangeMonitor	(	PROCESSOR_DEBUGGING_STATE *	DbgState,
		BOOLEAN	Enable,
		BOOLEAN	IsSwitchByClockIntrrupt )

Enable or disable the thread change monitoring detection on the running core.

should be called on vmx root

Parameters

DbgState	The state of the debugger on the current core
Enable
IsSwitchByClockIntrrupt

Returns

VOID

{
    if (Enable)
    {
        DbgState->ThreadOrProcessTracingDetails.InitialSetThreadChangeEvent = TRUE;
        DbgState->ThreadOrProcessTracingDetails.InitialSetByClockInterrupt  = IsSwitchByClockIntrrupt;
    }
    else
    {
        //
        // Avoid future sets/unsets
        //
        DbgState->ThreadOrProcessTracingDetails.InitialSetThreadChangeEvent = FALSE;
        DbgState->ThreadOrProcessTracingDetails.InitialSetByClockInterrupt  = FALSE;
    }
 
    //
    // Check if it's a HW breakpoint on gs:[188] or a clock interception
    //
    if (!IsSwitchByClockIntrrupt)
    {
        ThreadDetectChangeByDebugRegisterOnGs(DbgState, Enable);
    }
    else
    {
        ThreadDetectChangeByInterceptingClockInterrupts(DbgState, Enable);
    }
}

ThreadHandleThreadChange()

BOOLEAN ThreadHandleThreadChange

(

PROCESSOR_DEBUGGING_STATE *

DbgState

)

handle thread changes

Parameters

DbgState

The state of the debugger on the current core

Returns

BOOLEAN

{
    //
    // Check if we reached to the target thread or not
    //
    if ((g_ThreadSwitch.ThreadId != NULL_ZERO && g_ThreadSwitch.ThreadId == HANDLE_TO_UINT32(PsGetCurrentThreadId())) ||
        (g_ThreadSwitch.Thread != NULL64_ZERO && g_ThreadSwitch.Thread == PsGetCurrentThread()))
    {
        //
        // Halt the debuggee, we have found the target thread
        //
        KdHandleBreakpointAndDebugBreakpoints(DbgState, DEBUGGEE_PAUSING_REASON_DEBUGGEE_THREAD_SWITCHED, NULL);
 
        //
        // Found
        //
        return TRUE;
    }
 
    //
    // Not found
    //
    return FALSE;
}

ThreadInterpretThread()

BOOLEAN ThreadInterpretThread	(	PROCESSOR_DEBUGGING_STATE *	DbgState,
		PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET	TidRequest )

change the current thread

Parameters

DbgState	The state of the debugger on the current core
TidRequest

Returns

BOOLEAN

{
    switch (TidRequest->ActionType)
    {
    case DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS:
 
        //
        // Debugger wants to know current tid, nt!_ETHREAD and process name, etc.
        //
        TidRequest->ProcessId = HANDLE_TO_UINT32(PsGetCurrentProcessId());
        TidRequest->ThreadId  = HANDLE_TO_UINT32(PsGetCurrentThreadId());
        TidRequest->Process   = (UINT64)PsGetCurrentProcess();
        TidRequest->Thread    = (UINT64)PsGetCurrentThread();
        MemoryMapperReadMemorySafe((UINT64)CommonGetProcessNameFromProcessControlBlock(PsGetCurrentProcess()), &TidRequest->ProcessName, 16);
 
        //
        // Operation was successful
        //
        TidRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
        break;
 
    case DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH:
 
        //
        // Perform the thread switch
        //
        if (!ThreadSwitch(DbgState,
                          TidRequest->ThreadId,
                          (PETHREAD)TidRequest->Thread,
                          TidRequest->CheckByClockInterrupt))
        {
            TidRequest->Result = DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER;
            break;
        }
 
        //
        // Operation was successful
        //
        TidRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
        break;
 
    case DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LIST:
 
        //
        // Show the threads list
        //
        if (!ThreadShowList(&TidRequest->ThreadListSymDetails,
                            DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_SHOW_INSTANTLY,
                            NULL,
                            NULL,
                            (UINT64)NULL))
        {
            TidRequest->Result = DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER;
            break;
        }
 
        //
        // Operation was successful
        //
        TidRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
        break;
 
    default:
 
        //
        // Invalid type of action
        //
        TidRequest->Result = DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER;
 
        break;
    }
 
    //
    // Check if the above operation contains error
    //
    if (TidRequest->Result == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

ThreadQueryCount()

BOOLEAN ThreadQueryCount

(

PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS

DebuggerUsermodeProcessOrThreadQueryRequest

)

Query thread details (count).

Parameters

DebuggerUsermodeProcessOrThreadQueryRequest

Returns

BOOLEAN

{
    BOOLEAN Result = FALSE;
 
    //
    // Getting the count results
    //
    Result = ThreadShowList(&DebuggerUsermodeProcessOrThreadQueryRequest->ThreadListNeededDetails,
                            DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT,
                            &DebuggerUsermodeProcessOrThreadQueryRequest->Count,
                            NULL,
                            (UINT64)NULL);
 
    if (Result && DebuggerUsermodeProcessOrThreadQueryRequest->Count != 0)
    {
        DebuggerUsermodeProcessOrThreadQueryRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
        return TRUE;
    }
 
    DebuggerUsermodeProcessOrThreadQueryRequest->Result = DEBUGGER_ERROR_UNABLE_TO_QUERY_COUNT_OF_PROCESSES_OR_THREADS;
    return FALSE;
}

ThreadQueryDebugRegisterInterceptionStateByCoreId()

BOOLEAN ThreadQueryDebugRegisterInterceptionStateByCoreId

(

UINT32

CoreId

)

Query for deubg register interception state.

Parameters

CoreId

Returns

BOOLEAN whether it's activated or not

{
    BOOLEAN                     Result   = FALSE;
    PROCESSOR_DEBUGGING_STATE * DbgState = &g_DbgState[CoreId];
 
    Result = DbgState->ThreadOrProcessTracingDetails.DebugRegisterInterceptionState;
 
    return Result;
}

ThreadQueryDetails()

BOOLEAN ThreadQueryDetails

(

PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET

GetInformationThreadRequest

)

Query thread details.

Parameters

GetInformationThreadRequest

Returns

BOOLEAN

{
    GetInformationThreadRequest->ProcessId = HANDLE_TO_UINT32(PsGetCurrentProcessId());
    GetInformationThreadRequest->Process   = (UINT64)PsGetCurrentProcess();
    GetInformationThreadRequest->Thread    = (UINT64)PsGetCurrentThread();
    GetInformationThreadRequest->ThreadId  = HANDLE_TO_UINT32(PsGetCurrentThreadId());
 
    RtlCopyMemory(&GetInformationThreadRequest->ProcessName,
                  CommonGetProcessNameFromProcessControlBlock(PsGetCurrentProcess()),
                  15);
 
    GetInformationThreadRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
    return TRUE;
}

ThreadQueryList()

BOOLEAN ThreadQueryList	(	PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS	DebuggerUsermodeProcessOrThreadQueryRequest,
		PVOID	AddressToSaveDetail,
		UINT32	BufferSize )

Query thread details (list).

Parameters

DebuggerUsermodeProcessOrThreadQueryRequest
AddressToSaveDetail
BufferSize

Returns

BOOLEAN

{
    BOOLEAN Result = FALSE;
 
    //
    // Getting the list of threads
    //
    Result = ThreadShowList(&DebuggerUsermodeProcessOrThreadQueryRequest->ThreadListNeededDetails,
                            DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_SAVE_DETAILS,
                            NULL,
                            AddressToSaveDetail,
                            BufferSize);
 
    return Result;
}