The hyperdbg command interpreter and driver connector. More...

Classes
struct	_COMMAND_DETAIL
	Details of each command. More...

Macros
#define	DEBUGGER_COMMAND_ATTRIBUTE_EVENT 0x1 \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE
	Different attributes of commands.

#define	DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE 0x2

#define	DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION 0x4

#define	DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE 0x8

#define	DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER 0x10

#define	DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN 0x20

#define	DEBUGGER_COMMAND_ATTRIBUTE_HWDBG 0x40

#define	DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
	Absolute local commands.

#define	DEBUGGER_COMMAND_CLEAR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
	Command's attributes.

#define	DEBUGGER_COMMAND_HELP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_CONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_LISTEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_G_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_ATTACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_DETACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_SWITCH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_START_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

#define	DEBUGGER_COMMAND_RESTART_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

#define	DEBUGGER_COMMAND_KILL_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_PROCESS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_THREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_SLEEP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_EVENTS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_DEBUG_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_STATUS_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_LOAD_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_EXIT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_FLUSH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_PAUSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_PRINT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_EVAL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define	DEBUGGER_COMMAND_TEST_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_CPU_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_WRMSR_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_RDMSR_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_VA2PA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_PA2VA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_FORMATS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_PTE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_CORE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_MONITOR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_VMCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_CPUID_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_TSC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_PMC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_DR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_IOIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_IOOUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_SYSRET_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_MODE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_TRACE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define	DEBUGGER_COMMAND_HIDE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_MEASURE_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_LM_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_P_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_T_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_I_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_E_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_S_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_R_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_BP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_BE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_BD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_BC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_BL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_SYM_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_X_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_K_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_DT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_STRUCT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_PE_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_REV_ATTRIBUTES NULL

#define	DEBUGGER_COMMAND_TRACK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define	DEBUGGER_COMMAND_DUMP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define	DEBUGGER_COMMAND_GU_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define	DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

#define	DEBUGGER_COMMAND_A_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

Typedefs
typedef VOID(*	CommandFuncType) (vector< string > SplitCommand, string Command)
	Command's function type.

typedef VOID(*	CommandHelpFuncType) ()
	Command's help function type.

typedef struct _COMMAND_DETAIL	COMMAND_DETAIL
	Details of each command.

typedef struct _COMMAND_DETAIL *	PCOMMAND_DETAIL

typedef std::map< std::string, COMMAND_DETAIL >	CommandType
	Type saving commands and mapping to command string.

Functions
VOID	CommandSettingsLoadDefaultValuesFromConfigFile ()
	Loads default settings values from config file.

VOID	CommandSettingsSetValueFromConfigFile (std::string OptionName, std::string OptionValue)
	Sets the setting values from config file.

BOOLEAN	CommandSettingsGetValueFromConfigFile (std::string OptionName, std::string &OptionValue)
	Gets the setting values from config file.

VOID	CpuReadVendorString (CHAR *Result)
	Reads the CPU vendor string.

int	ReadCpuDetails ()
	Print out supported instruction set extensions.

VOID	ShowMessages (const char *Fmt,...)
	Show messages.

string	SeparateTo64BitValue (UINT64 Value)
	add ` between 64 bit values and convert them to string

void	ShowMemoryCommandDB (unsigned char *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in bytes (DB)

void	ShowMemoryCommandDD (unsigned char *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in dword format (DD)

void	ShowMemoryCommandDC (unsigned char *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in dword format (DC)

void	ShowMemoryCommandDQ (unsigned char *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in qword format (DQ)

VOID	CommandPteShowResults (UINT64 TargetVa, PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PteRead)
	show results of !pte command

DEBUGGER_CONDITIONAL_JUMP_STATUS	HyperDbgIsConditionalJumpTaken (unsigned char *BufferToDisassemble, UINT64 BuffLength, RFLAGS Rflags, BOOLEAN Isx86_64)
	Check whether the jump is taken or not taken (in debugger)

int	HyperDbgDisassembler64 (unsigned char *BufferToDisassemble, UINT64 BaseAddress, UINT64 Size, UINT32 MaximumInstrDecoded, BOOLEAN ShowBranchIsTakenOrNot, PRFLAGS Rflags)
	Disassemble x64 assemblies.

int	HyperDbgDisassembler32 (unsigned char *BufferToDisassemble, UINT64 BaseAddress, UINT64 Size, UINT32 MaximumInstrDecoded, BOOLEAN ShowBranchIsTakenOrNot, PRFLAGS Rflags)
	Disassemble 32 bit assemblies.

UINT32	HyperDbgLengthDisassemblerEngine (unsigned char *BufferToDisassemble, UINT64 BuffLength, BOOLEAN Isx86_64)
	Length Disassembler engine based on Zydis.

BOOLEAN	HyperDbgCheckWhetherTheCurrentInstructionIsCall (unsigned char *BufferToDisassemble, UINT64 BuffLength, BOOLEAN Isx86_64, PUINT32 CallLength)
	Check whether the current instruction is a 'call' or not.

BOOLEAN	HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet (unsigned char *BufferToDisassemble, UINT64 CurrentRip, UINT32 BuffLength, BOOLEAN Isx86_64, PBOOLEAN IsRet)
	Check whether the current instruction is a 'call' or 'ret' or not.

BOOLEAN	HyperDbgCheckWhetherTheCurrentInstructionIsRet (unsigned char *BufferToDisassemble, UINT64 BuffLength, BOOLEAN Isx86_64)
	Check whether the current instruction is a 'ret' or not.

VOID	HyperDbgShowMemoryOrDisassemble (DEBUGGER_SHOW_MEMORY_STYLE Style, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, DEBUGGER_READ_READING_TYPE ReadingType, UINT32 Pid, UINT32 Size, PDEBUGGER_DT_COMMAND_OPTIONS DtDetails)
	Show memory or disassembler.

BOOLEAN	HyperDbgReadMemory (UINT64 TargetAddress, DEBUGGER_READ_MEMORY_TYPE MemoryType, DEBUGGER_READ_READING_TYPE ReadingType, UINT32 Pid, UINT32 Size, BOOLEAN GetAddressMode, DEBUGGER_READ_MEMORY_ADDRESS_MODE AddressMode, BYTE TargetBufferToStore, UINT32 *ReturnLength)
	Read memory and disassembler.

VOID	InitializeCommandsDictionary ()
	Initialize commands and attributes.

VOID	InitializeDebugger ()
	Initialize the debugger and adjust commands for the first run.

BOOLEAN	CheckMultilineCommand (CHAR *CurrentCommand, BOOLEAN Reset)
	check for multi-line commands

BOOLEAN	ContinuePreviousCommand ()
	Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.

VOID	CommandDumpSaveIntoFile (PVOID Buffer, UINT32 Length)
	Saves the received buffers into the files.

VOID	CommandTest (vector< string > SplitCommand, string Command)
	test command handler

VOID	CommandClearScreen (vector< string > SplitCommand, string Command)
	.cls command handler

VOID	CommandReadMemoryAndDisassembler (vector< string > SplitCommand, string Command)
	u* d* !u* !d* commands handler

VOID	CommandConnect (vector< string > SplitCommand, string Command)
	.connect command handler

VOID	CommandLoad (vector< string > SplitCommand, string Command)
	load command handler

VOID	CommandUnload (vector< string > SplitCommand, string Command)
	unload command handler

VOID	CommandScript (vector< string > SplitCommand, string Command)
	.script command handler

VOID	CommandCpu (vector< string > SplitCommand, string Command)
	cpu command handler

VOID	CommandExit (vector< string > SplitCommand, string Command)
	exit command handler

VOID	CommandDisconnect (vector< string > SplitCommand, string Command)
	.disconnect command handler

VOID	CommandFormats (vector< string > SplitCommand, string Command)
	handler of .formats command

VOID	CommandRdmsr (vector< string > SplitCommand, string Command)
	rdmsr command handler

VOID	CommandWrmsr (vector< string > SplitCommand, string Command)
	wrmsr command handler

VOID	CommandPte (vector< string > SplitCommand, string Command)
	!pte command handler

VOID	CommandMonitor (vector< string > SplitCommand, string Command)
	!monitor command handler

VOID	CommandSyscallAndSysret (vector< string > SplitCommand, string Command)
	!syscall, !syscall2 and !sysret, !sysret2 commands handler

VOID	CommandEptHook (vector< string > SplitCommand, string Command)
	!epthook command handler

VOID	CommandEptHook2 (vector< string > SplitCommand, string Command)
	!epthook2 command handler

VOID	CommandCpuid (vector< string > SplitCommand, string Command)
	!cpuid command handler

VOID	CommandMsrread (vector< string > SplitCommand, string Command)
	!msrread command handler

VOID	CommandMsrwrite (vector< string > SplitCommand, string Command)
	!msrwrite command handler

VOID	CommandTsc (vector< string > SplitCommand, string Command)
	handler of !tsc command

VOID	CommandPmc (vector< string > SplitCommand, string Command)
	!pmc command handler

VOID	CommandException (vector< string > SplitCommand, string Command)
	!exception command handler

VOID	CommandCrwrite (vector< string > SplitCommand, string Command)
	!crwrite command handler

VOID	CommandDr (vector< string > SplitCommand, string Command)
	!dr command handler

VOID	CommandInterrupt (vector< string > SplitCommand, string Command)
	!interrupt command handler

VOID	CommandIoin (vector< string > SplitCommand, string Command)
	!ioin command handler

VOID	CommandIoout (vector< string > SplitCommand, string Command)
	!ioout command handler

VOID	CommandVmcall (vector< string > SplitCommand, string Command)
	!vmcall command handler

VOID	CommandMode (vector< string > SplitCommand, string Command)
	!mode command handler

VOID	CommandTrace (vector< string > SplitCommand, string Command)
	!trace command handler

VOID	CommandHide (vector< string > SplitCommand, string Command)
	!hide command handler

VOID	CommandUnhide (vector< string > SplitCommand, string Command)
	!unhide command handler

VOID	CommandLogopen (vector< string > SplitCommand, string Command)
	.logopen command handler

VOID	CommandLogclose (vector< string > SplitCommand, string Command)
	.logclose command handler

VOID	CommandVa2pa (vector< string > SplitCommand, string Command)
	!va2pa command handler

VOID	CommandPa2va (vector< string > SplitCommand, string Command)
	!pa2va command handler

VOID	CommandEvents (vector< string > SplitCommand, string Command)
	events command handler

VOID	CommandG (vector< string > SplitCommand, string Command)
	handler of g command

VOID	CommandLm (vector< string > SplitCommand, string Command)
	handle lm command

VOID	CommandSleep (vector< string > SplitCommand, string Command)
	sleep command help

VOID	CommandEditMemory (vector< string > SplitCommand, string Command)
	!e* and e* commands handler

VOID	CommandSearchMemory (vector< string > SplitCommand, string Command)
	!s* s* commands handler

VOID	CommandMeasure (vector< string > SplitCommand, string Command)
	!measure command handler

VOID	CommandSettings (vector< string > SplitCommand, string Command)
	settings command handler

VOID	CommandFlush (vector< string > SplitCommand, string Command)
	flush command handler

VOID	CommandPause (vector< string > SplitCommand, string Command)
	pause command handler

VOID	CommandListen (vector< string > SplitCommand, string Command)
	listen command handler

VOID	CommandStatus (vector< string > SplitCommand, string Command)
	.status and status command handler

VOID	CommandAttach (vector< string > SplitCommand, string Command)
	.attach command handler

VOID	CommandDetach (vector< string > SplitCommand, string Command)
	.detach command handler

VOID	CommandStart (vector< string > SplitCommand, string Command)
	.start command handler

VOID	CommandRestart (vector< string > SplitCommand, string Command)
	.restart command handler

VOID	CommandSwitch (vector< string > SplitCommand, string Command)
	.switch command handler

VOID	CommandKill (vector< string > SplitCommand, string Command)
	.kill command handler

VOID	CommandT (vector< string > SplitCommand, string Command)
	handler of t command

VOID	CommandI (vector< string > SplitCommand, string Command)
	handler of i command

VOID	CommandPrint (vector< string > SplitCommand, string Command)
	handler of print command

VOID	CommandOutput (vector< string > SplitCommand, string Command)
	output command handler

VOID	CommandDebug (vector< string > SplitCommand, string Command)
	.debug command handler

VOID	CommandP (vector< string > SplitCommand, string Command)
	handler of p command

VOID	CommandCore (vector< string > SplitCommand, string Command)
	~ command handler

VOID	CommandProcess (vector< string > SplitCommand, string Command)
	.process command handler

VOID	CommandThread (vector< string > SplitCommand, string Command)
	.thread command handler

VOID	CommandEval (vector< string > SplitCommand, string Command)
	handler of ? command

VOID	CommandR (vector< string > SplitCommand, string Command)

VOID	CommandBp (vector< string > SplitCommand, string Command)
	bp command handler

VOID	CommandBl (vector< string > SplitCommand, string Command)
	handler of the bl command

VOID	CommandBe (vector< string > SplitCommand, string Command)
	handler of be command

VOID	CommandBd (vector< string > SplitCommand, string Command)
	handler of bd command

VOID	CommandBc (vector< string > SplitCommand, string Command)
	handler of bc command

VOID	CommandSympath (vector< string > SplitCommand, string Command)
	.sympath command handler

VOID	CommandSym (vector< string > SplitCommand, string Command)
	.sym command handler

VOID	CommandX (vector< string > SplitCommand, string Command)
	x command handler

VOID	CommandPrealloc (vector< string > SplitCommand, string Command)
	prealloc command handler

VOID	CommandPreactivate (vector< string > SplitCommand, string Command)
	preactivate command handler

VOID	CommandDtAndStruct (vector< string > SplitCommand, string Command)
	dt and struct command handler

VOID	CommandK (vector< string > SplitCommand, string Command)
	k command handler

VOID	CommandPe (vector< string > SplitCommand, string Command)
	.pe command handler

VOID	CommandRev (vector< string > SplitCommand, string Command)
	!rev command handler

VOID	CommandTrack (vector< string > SplitCommand, string Command)
	handler of !track command

VOID	CommandPagein (vector< string > SplitCommand, string Command)
	.pagein command handler

VOID	CommandDump (vector< string > SplitCommand, string Command)
	.dump command handler

VOID	CommandGu (vector< string > SplitCommand, string Command)
	handler of gu command

VOID	CommandAssemble (vector< string > SplitCommand, string Command)
	a and !a commands handler

VOID	CommandHwClk (vector< string > SplitCommand, string Command)
	!hw_clk command handler

Variables
HANDLE	g_DeviceHandle
	Holds the global handle of device which is used to send the request to the kernel by IOCTL, this handle is not used for IRP Pending of message tracing this handle is used in KD VMM.

Detailed Description

The hyperdbg command interpreter and driver connector.

Author: Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org); Alee Amini (alee@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version: 0.1

Date: 2020-04-11

Copyright: This project is released under the GNU Public License v3.

Macro Definition Documentation

◆ DEBUGGER_COMMAND_A_ATTRIBUTES

#define DEBUGGER_COMMAND_A_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

434#define DEBUGGER_COMMAND_A_ATTRIBUTES \

435 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_ATTACH_ATTRIBUTES

#define DEBUGGER_COMMAND_ATTACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

Value:

DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | \

DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

Definition commands.h:191

DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

#define DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

Definition commands.h:192

Absolute local commands.

#define DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL               \
    DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | \
        DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

◆ DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define DEBUGGER_COMMAND_ATTRIBUTE_EVENT 0x1 | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

Different attributes of commands.

189#define DEBUGGER_COMMAND_ATTRIBUTE_EVENT \

190 0x1 | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

#define DEBUGGER_COMMAND_ATTRIBUTE_HWDBG 0x40

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

#define DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE 0x8

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE 0x2

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

#define DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION 0x4

◆ DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER 0x10

◆ DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

#define DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN 0x20

◆ DEBUGGER_COMMAND_BC_ATTRIBUTES

#define DEBUGGER_COMMAND_BC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

389#define DEBUGGER_COMMAND_BC_ATTRIBUTES \

390 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BD_ATTRIBUTES

#define DEBUGGER_COMMAND_BD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

386#define DEBUGGER_COMMAND_BD_ATTRIBUTES \

387 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BE_ATTRIBUTES

#define DEBUGGER_COMMAND_BE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

383#define DEBUGGER_COMMAND_BE_ATTRIBUTES \

384 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BL_ATTRIBUTES

#define DEBUGGER_COMMAND_BL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

392#define DEBUGGER_COMMAND_BL_ATTRIBUTES \

393 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BP_ATTRIBUTES

#define DEBUGGER_COMMAND_BP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

380#define DEBUGGER_COMMAND_BP_ATTRIBUTES \

381 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_CLEAR_ATTRIBUTES

#define DEBUGGER_COMMAND_CLEAR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

Command's attributes.

210#define DEBUGGER_COMMAND_CLEAR_ATTRIBUTES \

211 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_CONNECT_ATTRIBUTES

#define DEBUGGER_COMMAND_CONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

216#define DEBUGGER_COMMAND_CONNECT_ATTRIBUTES \

217 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_CORE_ATTRIBUTES

#define DEBUGGER_COMMAND_CORE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

310#define DEBUGGER_COMMAND_CORE_ATTRIBUTES \

311 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_CPU_ATTRIBUTES

#define DEBUGGER_COMMAND_CPU_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_CPUID_ATTRIBUTES

#define DEBUGGER_COMMAND_CPUID_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES

#define DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES

#define DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

368#define DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES \

369 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_DEBUG_ATTRIBUTES

#define DEBUGGER_COMMAND_DEBUG_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

254#define DEBUGGER_COMMAND_DEBUG_ATTRIBUTES \

255 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_DETACH_ATTRIBUTES

#define DEBUGGER_COMMAND_DETACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES

#define DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

251#define DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES \

252 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES

#define DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

257#define DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES \

258 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_DR_ATTRIBUTES

#define DEBUGGER_COMMAND_DR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_DT_ATTRIBUTES

#define DEBUGGER_COMMAND_DT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

411#define DEBUGGER_COMMAND_DT_ATTRIBUTES \

412 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_DUMP_ATTRIBUTES

#define DEBUGGER_COMMAND_DUMP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

426#define DEBUGGER_COMMAND_DUMP_ATTRIBUTES \

427 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_E_ATTRIBUTES

#define DEBUGGER_COMMAND_E_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

371#define DEBUGGER_COMMAND_E_ATTRIBUTES \

372 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES

#define DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES

#define DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_EVAL_ATTRIBUTES

#define DEBUGGER_COMMAND_EVAL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

284#define DEBUGGER_COMMAND_EVAL_ATTRIBUTES \

285 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_EVENTS_ATTRIBUTES

#define DEBUGGER_COMMAND_EVENTS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

245#define DEBUGGER_COMMAND_EVENTS_ATTRIBUTES \

246 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES

#define DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_EXIT_ATTRIBUTES

#define DEBUGGER_COMMAND_EXIT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

264#define DEBUGGER_COMMAND_EXIT_ATTRIBUTES \

265 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_FLUSH_ATTRIBUTES

#define DEBUGGER_COMMAND_FLUSH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

267#define DEBUGGER_COMMAND_FLUSH_ATTRIBUTES \

268 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_FORMATS_ATTRIBUTES

#define DEBUGGER_COMMAND_FORMATS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

305#define DEBUGGER_COMMAND_FORMATS_ATTRIBUTES \

306 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_G_ATTRIBUTES

#define DEBUGGER_COMMAND_G_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_GU_ATTRIBUTES

#define DEBUGGER_COMMAND_GU_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

429#define DEBUGGER_COMMAND_GU_ATTRIBUTES \

430 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_HELP_ATTRIBUTES

#define DEBUGGER_COMMAND_HELP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

213#define DEBUGGER_COMMAND_HELP_ATTRIBUTES \

214 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_HIDE_ATTRIBUTES

#define DEBUGGER_COMMAND_HIDE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES

#define DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

◆ DEBUGGER_COMMAND_I_ATTRIBUTES

#define DEBUGGER_COMMAND_I_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

365#define DEBUGGER_COMMAND_I_ATTRIBUTES \

366 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES

#define DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_IOIN_ATTRIBUTES

#define DEBUGGER_COMMAND_IOIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_IOOUT_ATTRIBUTES

#define DEBUGGER_COMMAND_IOOUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_K_ATTRIBUTES

#define DEBUGGER_COMMAND_K_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

408#define DEBUGGER_COMMAND_K_ATTRIBUTES \

409 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_KILL_ATTRIBUTES

#define DEBUGGER_COMMAND_KILL_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_LISTEN_ATTRIBUTES

#define DEBUGGER_COMMAND_LISTEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

219#define DEBUGGER_COMMAND_LISTEN_ATTRIBUTES \

220 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_LM_ATTRIBUTES

#define DEBUGGER_COMMAND_LM_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_LOAD_ATTRIBUTES

#define DEBUGGER_COMMAND_LOAD_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES

#define DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

290#define DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES \

291 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES

#define DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

287#define DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES \

288 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_MEASURE_ATTRIBUTES

#define DEBUGGER_COMMAND_MEASURE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_MODE_ATTRIBUTES

#define DEBUGGER_COMMAND_MODE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_MONITOR_ATTRIBUTES

#define DEBUGGER_COMMAND_MONITOR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES

#define DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES

#define DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES

#define DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

278#define DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES \

279 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_P_ATTRIBUTES

#define DEBUGGER_COMMAND_P_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

359#define DEBUGGER_COMMAND_P_ATTRIBUTES \

360 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_PA2VA_ATTRIBUTES

#define DEBUGGER_COMMAND_PA2VA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES

#define DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PAUSE_ATTRIBUTES

#define DEBUGGER_COMMAND_PAUSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

270#define DEBUGGER_COMMAND_PAUSE_ATTRIBUTES \

271 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_PE_ATTRIBUTES

#define DEBUGGER_COMMAND_PE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_PMC_ATTRIBUTES

#define DEBUGGER_COMMAND_PMC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES

#define DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES

#define DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_PRINT_ATTRIBUTES

#define DEBUGGER_COMMAND_PRINT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

281#define DEBUGGER_COMMAND_PRINT_ATTRIBUTES \

282 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_PROCESS_ATTRIBUTES

#define DEBUGGER_COMMAND_PROCESS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

236#define DEBUGGER_COMMAND_PROCESS_ATTRIBUTES \

237 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PTE_ATTRIBUTES

#define DEBUGGER_COMMAND_PTE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_R_ATTRIBUTES

#define DEBUGGER_COMMAND_R_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

377#define DEBUGGER_COMMAND_R_ATTRIBUTES \

378 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_RDMSR_ATTRIBUTES

#define DEBUGGER_COMMAND_RDMSR_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_RESTART_ATTRIBUTES

#define DEBUGGER_COMMAND_RESTART_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_REV_ATTRIBUTES

#define DEBUGGER_COMMAND_REV_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_S_ATTRIBUTES

#define DEBUGGER_COMMAND_S_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

374#define DEBUGGER_COMMAND_S_ATTRIBUTES \

375 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES

#define DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

275#define DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES \

276 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES

#define DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

248#define DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES \

249 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_SLEEP_ATTRIBUTES

#define DEBUGGER_COMMAND_SLEEP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

242#define DEBUGGER_COMMAND_SLEEP_ATTRIBUTES \

243 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_START_ATTRIBUTES

#define DEBUGGER_COMMAND_START_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_STATUS_ATTRIBUTES

#define DEBUGGER_COMMAND_STATUS_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_STRUCT_ATTRIBUTES

#define DEBUGGER_COMMAND_STRUCT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

414#define DEBUGGER_COMMAND_STRUCT_ATTRIBUTES \

415 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_SWITCH_ATTRIBUTES

#define DEBUGGER_COMMAND_SWITCH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_SYM_ATTRIBUTES

#define DEBUGGER_COMMAND_SYM_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

398#define DEBUGGER_COMMAND_SYM_ATTRIBUTES \

399 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES

#define DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

395#define DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES \

396 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES

#define DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_SYSRET_ATTRIBUTES

#define DEBUGGER_COMMAND_SYSRET_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_T_ATTRIBUTES

#define DEBUGGER_COMMAND_T_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

362#define DEBUGGER_COMMAND_T_ATTRIBUTES \

363 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_TEST_ATTRIBUTES

#define DEBUGGER_COMMAND_TEST_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_THREAD_ATTRIBUTES

#define DEBUGGER_COMMAND_THREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

239#define DEBUGGER_COMMAND_THREAD_ATTRIBUTES \

240 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_TRACE_ATTRIBUTES

#define DEBUGGER_COMMAND_TRACE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_TRACK_ATTRIBUTES

#define DEBUGGER_COMMAND_TRACK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_TSC_ATTRIBUTES

#define DEBUGGER_COMMAND_TSC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES

#define DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES

#define DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_VA2PA_ATTRIBUTES

#define DEBUGGER_COMMAND_VA2PA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_VMCALL_ATTRIBUTES

#define DEBUGGER_COMMAND_VMCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_WRMSR_ATTRIBUTES

#define DEBUGGER_COMMAND_WRMSR_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_X_ATTRIBUTES

#define DEBUGGER_COMMAND_X_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

401#define DEBUGGER_COMMAND_X_ATTRIBUTES \

402 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

Typedef Documentation

◆ COMMAND_DETAIL

typedef struct _COMMAND_DETAIL COMMAND_DETAIL

Details of each command.

◆ CommandFuncType

typedef VOID(* CommandFuncType) (vector< string > SplitCommand, string Command)

Command's function type.

◆ CommandHelpFuncType

typedef VOID(* CommandHelpFuncType) ()

Command's help function type.

◆ CommandType

typedef std::map<std::string, COMMAND_DETAIL> CommandType

Type saving commands and mapping to command string.

◆ PCOMMAND_DETAIL

typedef struct _COMMAND_DETAIL * PCOMMAND_DETAIL

Function Documentation

◆ CheckMultilineCommand()

BOOLEAN CheckMultilineCommand	(	CHAR *	CurrentCommand,
		BOOLEAN	Reset )

check for multi-line commands

Parameters

CurrentCommand
Reset

Returns: BOOLEAN return TRUE if the command needs extra input, otherwise return FALSE

{
    UINT32      CurrentCommandLen = 0;
    std::string CurrentCommandStr(CurrentCommand);
 
    if (Reset)
    {
        g_IsInterpreterOnString                    = FALSE;
        g_IsInterpreterPreviousCharacterABackSlash = FALSE;
        g_InterpreterCountOfOpenCurlyBrackets      = 0;
    }
 
    CurrentCommandLen = (UINT32)CurrentCommandStr.length();
 
    for (size_t i = 0; i < CurrentCommandLen; i++)
    {
        switch (CurrentCommandStr.at(i))
        {
        case '"':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
            {
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
                break; // it's an escaped \" double-quote
            }
 
            if (g_IsInterpreterOnString)
                g_IsInterpreterOnString = FALSE;
            else
                g_IsInterpreterOnString = TRUE;
 
            break;
 
        case '{':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
 
            if (!g_IsInterpreterOnString)
                g_InterpreterCountOfOpenCurlyBrackets++;
 
            break;
 
        case '}':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
 
            if (!g_IsInterpreterOnString && g_InterpreterCountOfOpenCurlyBrackets > 0)
                g_InterpreterCountOfOpenCurlyBrackets--;
 
            break;
 
        case '\\':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE; // it's not a escape character (two backslashes \\ )
            else
                g_IsInterpreterPreviousCharacterABackSlash = TRUE;
 
            break;
 
        default:
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
 
            break;
        }
    }
 
    if (g_IsInterpreterOnString == FALSE && g_InterpreterCountOfOpenCurlyBrackets == 0)
    {
        //
        // either the command is finished or it's a single
        // line command
        //
        return FALSE;
    }
    else
    {
        //
        // There still other lines, this command is incomplete
        //
        return TRUE;
    }
}

◆ CommandAssemble()

VOID CommandAssemble	(	vector< string >	SplitCommand,
		string	Command )

a and !a commands handler

Parameters

SplitCommand
Command

Returns: VOID

{
    DEBUGGER_EDIT_MEMORY_TYPE MemoryType {};
    _CMD                      CMD {};
    UINT64                    Address {};
    UINT64                    StartAddress {};
    UINT32                    ProcId = 0;
 
    CMD = ParseUserCmd(Command);
 
    if (CMD.isEmpty())
    {
        //
        // Error messeges are already printed
        //
        return;
    }
 
    if (!CMD.ProcIdStr.empty())
    {
        if (!ConvertStringToUInt32(CMD.ProcIdStr, &ProcId))
        {
            ShowMessages("please specify a correct hex process id\n\n");
            CommandAssembleHelp();
            return;
        }
    }
 
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ProcId = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CMD.AsmSnippet.empty())
    {
        ShowMessages("no assembly snippet provided\n");
        CommandAssembleHelp();
        return;
    }
    else if (CMD.CommandStr == "a")
    {
        MemoryType = EDIT_VIRTUAL_MEMORY;
    }
    else if (CMD.CommandStr == "!a")
    {
        MemoryType = EDIT_PHYSICAL_MEMORY;
    }
    else
    {
        ShowMessages("unknown assemble command\n\n");
        CommandAssembleHelp();
        return;
    }
 
    //
    // Fetching start_address i.e. address to assemble to
    //
    if (!CMD.AddressStr.empty()) // was any address provided to assemble to?
    {
        if (!SymbolConvertNameOrExprToAddress(CMD.AddressStr, &Address))
        {
            ShowMessages("err, couldn't resolve Address at '%s'\n\n",
                         CMD.AddressStr.c_str());
            CommandAssembleHelp();
            return;
        }
    }
    else if (!CMD.StartAddressStr.empty()) // was a custom start_address provided?
    {
        if (!SymbolConvertNameOrExprToAddress(CMD.StartAddressStr, &StartAddress))
        {
            ShowMessages("err, couldn't resolve Address at '%s'\n\n",
                         CMD.StartAddressStr.c_str());
            CommandAssembleHelp();
            return;
        }
        Address = StartAddress;
    }
    else
    {
        ShowMessages("warning, no start address provided to calculate relative asm commands\n\n");
    }
 
    AssembleData AssembleData;
    AssembleData.AsmRaw = CMD.AsmSnippet; // third element
    AssembleData.ParseAssemblyData();
 
    if (AssembleData.Assemble(Address))
    {
        ShowMessages("err, code: '%u'\n\n", AssembleData.KsErr);
        CommandAssembleHelp();
        return;
    }
 
    if (ProcId == 0)
    {
        ProcId = GetCurrentProcessId();
    }
 
    if (Address) // was the user only trying to get the bytes?
    {
        if (HyperDbgWriteMemory(
                (PVOID)Address,
                MemoryType,
                ProcId,
                (PVOID)AssembleData.EncodedBytes,
                (UINT32)AssembleData.BytesCount))
        {
            ShowMessages("successfully assembled at 0x%016llx address\n", static_cast<UINT64>(Address));
        }
        else
        {
            ShowMessages("failed to write generated assembly to memory\n");
        }
    }
}

◆ CommandAttach()

VOID CommandAttach	(	vector< string >	SplitCommand,
		string	Command )

.attach command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32  TargetPid = 0;
    BOOLEAN NextIsPid = FALSE;
 
    //
    // Disable user-mode debugger in this version
    //
#if ActivateUserModeDebugger == FALSE
 
    if (!g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("the user-mode debugger in VMI Mode is still in the beta version and not stable. "
                     "we decided to exclude it from this release and release it in future versions. "
                     "if you want to test the user-mode debugger in VMI Mode, you should build "
                     "HyperDbg with special instructions. But attaching/switching to other processes\n"
                     "are fully supported in the Debugger Mode.\n"
                     "(it's not recommended to use it in VMI Mode yet!)\n");
        return;
    }
 
#endif // !ActivateUserModeDebugger
 
    //
    // It's a attach to a target PID
    //
    if (SplitCommand.size() >= 4)
    {
        ShowMessages("incorrect use of the '.attach'\n\n");
        CommandAttachHelp();
        return;
    }
 
    //
    // .attach and .detach commands are only supported in VMI Mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, '.attach', and '.detach' commands are only usable "
                     "in VMI Mode, you can use the '.process', or the '.thread' "
                     "in Debugger Mode\n");
        return;
    }
 
    for (auto item : SplitCommand)
    {
        //
        // Find out whether the user enters pid or not
        //
        if (NextIsPid)
        {
            NextIsPid = FALSE;
 
            if (!ConvertStringToUInt32(item, &TargetPid))
            {
                ShowMessages("please specify a correct hex value for process id\n\n");
                CommandAttachHelp();
                return;
            }
        }
        else if (!item.compare("pid"))
        {
            //
            // next item is a pid for the process
            //
            NextIsPid = TRUE;
        }
    }
 
    //
    // Check if the process id is empty or not
    //
    if (TargetPid == 0)
    {
        ShowMessages("please specify a hex value for process id\n\n");
        CommandAttachHelp();
        return;
    }
 
    //
    // Perform attach to target process
    //
    UdAttachToProcess(TargetPid, NULL, NULL, FALSE);
}

◆ CommandBc()

VOID CommandBc	(	vector< string >	SplitCommand,
		string	Command )

handler of bc command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64                            BreakpointId;
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'bc'\n\n");
        CommandBcHelp();
        return;
    }
 
    //
    // Get the breakpoint id
    //
    if (!ConvertStringToUInt64(SplitCommand.at(1), &BreakpointId))
    {
        ShowMessages("please specify a correct hex value for breakpoint id\n\n");
        CommandBcHelp();
 
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform clearing breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR;
 
        //
        // Set breakpoint id
        //
        Request.BreakpointId = BreakpointId;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
    }
    else
    {
        ShowMessages("err, clearing breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBd()

VOID CommandBd	(	vector< string >	SplitCommand,
		string	Command )

handler of bd command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64                            BreakpointId;
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'bd'\n\n");
        CommandBdHelp();
        return;
    }
 
    //
    // Get the breakpoint id
    //
    if (!ConvertStringToUInt64(SplitCommand.at(1), &BreakpointId))
    {
        ShowMessages("please specify a correct hex value for breakpoint id\n\n");
        CommandBdHelp();
 
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform disabling breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE;
 
        //
        // Set breakpoint id
        //
        Request.BreakpointId = BreakpointId;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
    }
    else
    {
        ShowMessages("err, disabling breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBe()

VOID CommandBe	(	vector< string >	SplitCommand,
		string	Command )

handler of be command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64                            BreakpointId;
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'be'\n\n");
        CommandBeHelp();
        return;
    }
 
    //
    // Get the breakpoint id
    //
    if (!ConvertStringToUInt64(SplitCommand.at(1), &BreakpointId))
    {
        ShowMessages("please specify a correct hex value for breakpoint id\n\n");
        CommandBeHelp();
 
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform enabling breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE;
 
        //
        // Set breakpoint id
        //
        Request.BreakpointId = BreakpointId;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
    }
    else
    {
        ShowMessages("err, enabling breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBl()

VOID CommandBl	(	vector< string >	SplitCommand,
		string	Command )

handler of the bl command

Parameters

SplitCommand
Command

Returns: VOID

{
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the 'bl'\n\n");
        CommandBlHelp();
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform listing breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
        ShowMessages("\n");
    }
    else
    {
        ShowMessages("err, listing breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBp()

VOID CommandBp	(	vector< string >	SplitCommand,
		string	Command )

bp command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL IsNextCoreId = FALSE;
    BOOL IsNextPid    = FALSE;
    BOOL IsNextTid    = FALSE;
 
    BOOLEAN SetCoreId  = FALSE;
    BOOLEAN SetPid     = FALSE;
    BOOLEAN SetTid     = FALSE;
    BOOLEAN SetAddress = FALSE;
 
    UINT32         Tid       = DEBUGGEE_BP_APPLY_TO_ALL_THREADS;
    UINT32         Pid       = DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES;
    UINT32         CoreNumer = DEBUGGEE_BP_APPLY_TO_ALL_CORES;
    UINT64         Address   = NULL;
    vector<string> SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32         IndexInCommandCaseSensitive = 0;
    BOOLEAN        IsFirstCommand              = TRUE;
 
    if (SplitCommand.size() >= 9)
    {
        ShowMessages("incorrect use of the 'bp'\n\n");
        CommandBpHelp();
        return;
    }
 
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        //
        // Ignore the first argument as it's the command string itself (bp)
        //
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextCoreId)
        {
            if (!ConvertStringToUInt32(Section, &CoreNumer))
            {
                ShowMessages("please specify a correct hex value for core id\n\n");
                CommandBpHelp();
                return;
            }
            IsNextCoreId = FALSE;
            continue;
        }
        if (IsNextPid)
        {
            if (!ConvertStringToUInt32(Section, &Pid))
            {
                ShowMessages("please specify a correct hex value for process id\n\n");
                CommandBpHelp();
                return;
            }
            IsNextPid = FALSE;
            continue;
        }
 
        if (IsNextTid)
        {
            if (!ConvertStringToUInt32(Section, &Tid))
            {
                ShowMessages("please specify a correct hex value for thread id\n\n");
                CommandBpHelp();
                return;
            }
            IsNextTid = FALSE;
            continue;
        }
 
        if (!Section.compare("pid"))
        {
            IsNextPid = TRUE;
            continue;
        }
        if (!Section.compare("tid"))
        {
            IsNextTid = TRUE;
            continue;
        }
        if (!Section.compare("core"))
        {
            IsNextCoreId = TRUE;
            continue;
        }
 
        if (!SetAddress)
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1), &Address))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                CommandBpHelp();
                return;
            }
            else
            {
                //
                // Means that address is received
                //
                SetAddress = TRUE;
                continue;
            }
        }
    }
 
    //
    // Check if address is set or not
    //
    if (!SetAddress)
    {
        ShowMessages(
            "please specify a correct hex value as the breakpoint address\n\n");
        CommandBpHelp();
        return;
    }
    if (IsNextPid)
    {
        ShowMessages("please specify a correct hex value for process id\n\n");
        CommandBpHelp();
        return;
    }
    if (IsNextCoreId)
    {
        ShowMessages("please specify a correct hex value for core\n\n");
        CommandBpHelp();
        return;
    }
    if (IsNextTid)
    {
        ShowMessages("please specify a correct hex value for thread id\n\n");
        CommandBpHelp();
        return;
    }
 
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, setting breakpoints is not possible when you're not "
                     "connected to a debuggee\n");
        return;
    }
 
    //
    // Request breakpoint the bp packet
    //
    CommandBpRequest(Address, Pid, Tid, CoreNumer);
}

◆ CommandClearScreen()

VOID CommandClearScreen	(	vector< string >	SplitCommand,
		string	Command )

.cls command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    system("cls");
}

◆ CommandConnect()

VOID CommandConnect	(	vector< string >	SplitCommand,
		string	Command )

.connect command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    string ip;
    string port;
 
    if (g_IsConnectedToHyperDbgLocally || g_IsConnectedToRemoteDebuggee ||
        g_IsConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a debugger, please use '.disconnect' "
                     "command\n");
        return;
    }
 
    if (g_IsSerialConnectedToRemoteDebuggee ||
        g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a an instance of HyperDbg, please use "
                     "'.debug close' command\n");
        return;
    }
 
    if (SplitCommand.size() == 1)
    {
        //
        // Means that user entered just a connect so we have to
        // ask to connect to what ?
        //
        ShowMessages("incorrect use of the '.connect'\n\n");
        CommandConnectHelp();
        return;
    }
    else if (SplitCommand.at(1) == "local" && SplitCommand.size() == 2)
    {
        //
        // connect to local debugger
        //
        ShowMessages("local debugging (vmi-mode)\n");
        ConnectLocalDebugger();
        return;
    }
    else if (SplitCommand.size() == 3 || SplitCommand.size() == 2)
    {
        ip = SplitCommand.at(1);
 
        if (SplitCommand.size() == 3)
        {
            port = SplitCommand.at(2);
        }
 
        //
        // means that probably wants to connect to a remote
        // system, let's first check the if the parameters are
        // valid
        //
        if (!ValidateIP(ip))
        {
            ShowMessages("incorrect ip address\n");
            return;
        }
 
        if (SplitCommand.size() == 3)
        {
            if (!IsNumber(port) || stoi(port) > 65535 || stoi(port) < 0)
            {
                ShowMessages("incorrect port\n");
                return;
            }
 
            //
            // connect to remote debugger
            //
            ConnectRemoteDebugger(ip.c_str(), port.c_str());
        }
        else
        {
            //
            // connect to remote debugger (default port)
            //
            ConnectRemoteDebugger(ip.c_str(), NULL);
        }
    }
    else
    {
        ShowMessages("incorrect use of the '.connect'\n\n");
        CommandConnectHelp();
        return;
    }
}

◆ CommandCore()

VOID CommandCore	(	vector< string >	SplitCommand,
		string	Command )

~ command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32 TargetCore = 0;
 
    if (SplitCommand.size() != 1 && SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the '~'\n\n");
        CommandCoreHelp();
        return;
    }
 
    //
    // Check if it's connected to a remote debuggee or not
    //
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, you're not connected to any debuggee\n");
        return;
    }
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("current processor : 0x%x\n", g_CurrentRemoteCore);
    }
    else if (SplitCommand.size() == 2)
    {
        if (!ConvertStringToUInt32(SplitCommand.at(1), &TargetCore))
        {
            ShowMessages("please specify a correct hex value for the core that you "
                         "want to operate on it\n\n");
            CommandCoreHelp();
            return;
        }
 
        //
        // Send the changing core packet
        //
        KdSendSwitchCorePacketToDebuggee(TargetCore);
    }
}

◆ CommandCpu()

VOID CommandCpu	(	vector< string >	SplitCommand,
		string	Command )

cpu command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the 'cpu'\n\n");
        CommandCpuHelp();
        return;
    }
    ReadCpuDetails();
}

◆ CommandCpuid()

VOID CommandCpuid	(	vector< string >	SplitCommand,
		string	Command )

!cpuid command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    BOOLEAN                            GetEax                = FALSE;
    UINT32                             EventLength;
    UINT64                             SpecialTarget               = 0;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            CPUID_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any), of CPUID EAX index
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!cpuid"))
        {
            continue;
        }
        else if (!GetEax)
        {
            //
            // It's probably an msr
            //
            if (!ConvertStringToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandCpuidHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                //
                // An special EAX is set
                //
                GetEax = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandCpuidHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target EAX (if not specific then it means all msrs)
    //
    Event->Options.OptionalParam1 = GetEax;
 
    if (GetEax)
    {
        Event->Options.OptionalParam2 = SpecialTarget;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandCrwrite()

VOID CommandCrwrite	(	vector< string >	SplitCommand,
		string	Command )

!crwrite command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             TargetRegister              = 1;
    UINT64                             MaskRegister                = 0xFFFFFFFFFFFFFFFF;
    BOOLEAN                            GetRegister                 = FALSE;
    BOOLEAN                            GetMask                     = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (SplitCommand.size() < 2)
    {
        ShowMessages("incorrect use of the '!crwrite'\n");
        CommandCrwriteHelp();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            CONTROL_REGISTER_MODIFIED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!crwrite"))
        {
            continue;
        }
        else if (!GetRegister)
        {
            //
            // It's probably a CR
            //
            if (!ConvertStringToUInt64(Section, &TargetRegister))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandCrwriteHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetRegister = TRUE;
            }
        }
        else if (!GetMask)
        {
            if (!ConvertStringToUInt64(Section, &MaskRegister))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandCrwriteHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetMask = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandCrwriteHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    if (TargetRegister != VMX_EXIT_QUALIFICATION_REGISTER_CR0 && TargetRegister != VMX_EXIT_QUALIFICATION_REGISTER_CR4)
    {
        ShowMessages("please choose either 0 for cr0 or 4 for cr4\n");
        CommandCrwriteHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the target control register
    //
    Event->Options.OptionalParam1 = TargetRegister;
 
    //
    // Set the mask to filter control register bits
    //
    Event->Options.OptionalParam2 = MaskRegister;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandDebug()

VOID CommandDebug	(	vector< string >	SplitCommand,
		string	Command )

.debug command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32 Baudrate;
    UINT32 Port;
 
    if (SplitCommand.size() == 2 && !SplitCommand.at(1).compare("close"))
    {
        //
        // Check if the debugger is attached to a debuggee
        //
        if (g_IsSerialConnectedToRemoteDebuggee)
        {
            KdCloseConnection();
        }
        else
        {
            ShowMessages(
                "err, debugger is not attached to any instance of debuggee\n");
        }
        return;
    }
    else if (SplitCommand.size() <= 3)
    {
        ShowMessages("incorrect use of the '.debug'\n\n");
        CommandDebugHelp();
        return;
    }
 
    //
    // Check the main command
    //
    if (!SplitCommand.at(1).compare("remote"))
    {
        //
        // in the case of the 'remote'
        //
 
        if (!SplitCommand.at(2).compare("serial"))
        {
            //
            // Connect to a remote serial device
            //
            if (SplitCommand.size() != 5)
            {
                ShowMessages("incorrect use of the '.debug'\n\n");
                CommandDebugHelp();
                return;
            }
 
            //
            // Set baudrate
            //
            if (!IsNumber(SplitCommand.at(3)))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             SplitCommand.at(3).c_str());
                CommandDebugHelp();
                return;
            }
 
            Baudrate = stoi(SplitCommand.at(3));
 
            //
            // Check if baudrate is valid or not
            //
            if (!CommandDebugCheckBaudrate(Baudrate))
            {
                //
                // Baud-rate is invalid
                //
                ShowMessages("err, baud rate is invalid\n\n");
                CommandDebugHelp();
                return;
            }
 
            //
            // check if com port address is valid or not
            //
            if (!CommandDebugCheckComPort(SplitCommand.at(4).c_str(), &Port))
            {
                //
                // com port is invalid
                //
                ShowMessages("err, COM port is invalid\n\n");
                CommandDebugHelp();
                return;
            }
 
            //
            // Everything is okay, connect to the remote machine to send (debugger)
            //
            HyperDbgDebugRemoteDeviceUsingComPort(SplitCommand.at(4).c_str(), Baudrate);
        }
        else if (!SplitCommand.at(2).compare("namedpipe"))
        {
            //
            // Connect to a remote namedpipe
            //
            string Delimiter = "namedpipe";
            string Token     = Command.substr(
                Command.find(Delimiter) + Delimiter.size() + 1,
                Command.size());
 
            //
            // Connect to a namedpipe (it's probably a Virtual Machine debugging)
            //
            HyperDbgDebugRemoteDeviceUsingNamedPipe(Token.c_str());
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", SplitCommand.at(2).c_str());
            CommandDebugHelp();
            return;
        }
    }
    else if (!SplitCommand.at(1).compare("prepare"))
    {
        if (SplitCommand.size() != 5)
        {
            ShowMessages("incorrect use of the '.debug'\n\n");
            CommandDebugHelp();
            return;
        }
 
        //
        // in the case of the 'prepare'
        // currently we only support serial
        //
        if (!SplitCommand.at(2).compare("serial"))
        {
            //
            // Set baudrate
            //
            if (!IsNumber(SplitCommand.at(3)))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             SplitCommand.at(3).c_str());
                CommandDebugHelp();
                return;
            }
 
            Baudrate = stoi(SplitCommand.at(3));
 
            //
            // Check if baudrate is valid or not
            //
            if (!CommandDebugCheckBaudrate(Baudrate))
            {
                //
                // Baud-rate is invalid
                //
                ShowMessages("err, baud rate is invalid\n\n");
                CommandDebugHelp();
                return;
            }
 
            //
            // check if com port address is valid or not
            //
            if (!CommandDebugCheckComPort(SplitCommand.at(4).c_str(), &Port))
            {
                //
                // com port is invalid
                //
                ShowMessages("err, COM port is invalid\n\n");
                CommandDebugHelp();
                return;
            }
 
            //
            // Everything is okay, prepare to send (debuggee)
            //
            HyperDbgDebugCurrentDeviceUsingComPort(SplitCommand.at(4).c_str(), Baudrate);
        }
        else
        {
            ShowMessages("invalid parameter '%s'\n\n", SplitCommand.at(2));
            CommandDebugHelp();
            return;
        }
    }
    else
    {
        ShowMessages("invalid parameter '%s'\n\n", SplitCommand.at(1));
        CommandDebugHelp();
        return;
    }
}

◆ CommandDetach()

VOID CommandDetach	(	vector< string >	SplitCommand,
		string	Command )

.detach command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() >= 2)
    {
        ShowMessages("incorrect use of the '.detach'\n\n");
        CommandDetachHelp();
        return;
    }
 
    //
    // .attach and .detach commands are only supported in VMI Mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, '.attach', and '.detach' commands are only usable "
                     "in VMI Mode, you can use the '.process', or the '.thread' "
                     "in Debugger Mode\n");
        return;
    }
 
    //
    // Perform detach from the process
    //
    DetachFromProcess();
}

◆ CommandDisconnect()

VOID CommandDisconnect	(	vector< string >	SplitCommand,
		string	Command )

.disconnect command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the '.disconnect'\n\n");
        CommandDisconnectHelp();
        return;
    }
 
    if (!g_IsConnectedToHyperDbgLocally && !g_IsConnectedToRemoteDebuggee)
    {
        ShowMessages("you're not connected to any instance of HyperDbg, did you "
                     "use '.connect'? \n");
        return;
    }
 
    //
    // Check if it's local debugger and the driver is still
    // loading (not unloaded)
    //
    if (g_IsConnectedToHyperDbgLocally && g_DeviceHandle)
    {
        ShowMessages("you cannot disconnect in local debugging while the "
                     "driver is still loaded. please use 'unload' command before "
                     "disconnecting from the current instance of debugger\n");
        return;
    }
 
    //
    // Disconnect the session
    //
    g_IsConnectedToHyperDbgLocally = FALSE;
 
    //
    // This computer is connected to a remote system
    //
    if (g_IsConnectedToRemoteDebuggee)
    {
        //
        // We should kill the thread that was listening for the
        // remote commands and close the connection
        //
        TerminateThread(g_RemoteDebuggeeListeningThread, 0);
        CloseHandle(g_RemoteDebuggeeListeningThread);
        CloseHandle(g_EndOfMessageReceivedEvent);
        g_EndOfMessageReceivedEvent = NULL;
 
        RemoteConnectionCloseTheConnectionWithDebuggee();
 
        g_IsConnectedToRemoteDebuggee = FALSE;
    }
 
    ShowMessages("disconnected successfully\n");
}

◆ CommandDr()

VOID CommandDr	(	vector< string >	SplitCommand,
		string	Command )

!dr command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            DEBUG_REGISTERS_ACCESSED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (SplitCommand.size() > 1)
    {
        ShowMessages("incorrect use of the '!dr'\n");
        CommandDrHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandDtAndStruct()

VOID CommandDtAndStruct	(	vector< string >	SplitCommand,
		string	Command )

dt and struct command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    std::string TempTypeNameHolder;
    std::string PdbexArgs                          = "";
    BOOLEAN     IsStruct                           = FALSE;
    UINT64      TargetAddress                      = NULL;
    PVOID       BufferAddressRetrievedFromDebuggee = NULL;
    UINT32      TargetPid                          = NULL;
    BOOLEAN     IsPhysicalAddress                  = FALSE;
 
    //
    // Check if command is 'struct' or not
    //
    if (!SplitCommand.at(0).compare("struct") ||
        !SplitCommand.at(0).compare("structure"))
    {
        IsStruct = TRUE;
    }
    else
    {
        IsStruct = FALSE;
    }
 
    //
    // Check if command is '!dt' for physical address or not
    //
    if (!SplitCommand.at(0).compare("!dt"))
    {
        IsPhysicalAddress = TRUE;
    }
    else
    {
        IsPhysicalAddress = FALSE;
    }
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n", SplitCommand.at(0).c_str());
 
        if (IsStruct)
        {
            CommandStructHelp();
        }
        else
        {
            CommandDtHelp();
        }
 
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove dt, struct, or structure from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Check for the first and second arguments
    //
    vector<string> TempSplitCommand {Split(Command, ' ')};
 
    //
    // If the size is zero, then it's only a type name
    //
    if (TempSplitCommand.size() == 1)
    {
        //
        // Call the dt parser wrapper, it's only a structure (type) name
        // Call it with default configuration
        //
        CommandDtShowDataBasedOnSymbolTypes(TempSplitCommand.at(0).c_str(),
                                            NULL,
                                            IsStruct,
                                            NULL,
                                            TargetPid,
                                            IsPhysicalAddress,
                                            PDBEX_DEFAULT_CONFIGURATION);
    }
    else
    {
        //
        // When we're here, it means we have size() >= 2, so we have to check
        // the first and the second method to see which one is the type and
        // which one is the symbol
        //
 
        //
        // Check if the first parameter is an address or valid expression
        //
        if (IsStruct || !SymbolConvertNameOrExprToAddress(TempSplitCommand.at(0).c_str(),
                                                          &TargetAddress))
        {
            //
            // No it's not, we'll get the first argument as the structure (type) name
            // And we have to check whether the second argument is a buffer address or not
            //
            if (IsStruct || !SymbolConvertNameOrExprToAddress(TempSplitCommand.at(1).c_str(),
                                                              &TargetAddress))
            {
                //
                // The second argument is also not buffer address
                // probably the user entered a structure (type) name along with some params
                //
                TempTypeNameHolder = TempSplitCommand.at(0);
 
                //
                // Remove the first argument
                //
                TempSplitCommand.erase(TempSplitCommand.begin());
 
                //
                // Convert to pdbex args
                //
                if (!CommandDtAndStructConvertHyperDbgArgsToPdbex(TempSplitCommand, PdbexArgs, &TargetPid))
                {
                    if (IsStruct)
                    {
                        CommandStructHelp();
                    }
                    else
                    {
                        CommandDtHelp();
                    }
 
                    return;
                }
 
                //
                // Call the wrapper of pdbex
                //
                CommandDtShowDataBasedOnSymbolTypes(TempTypeNameHolder.c_str(),
                                                    TargetAddress,
                                                    IsStruct,
                                                    BufferAddressRetrievedFromDebuggee,
                                                    TargetPid,
                                                    IsPhysicalAddress,
                                                    PdbexArgs.c_str());
            }
            else
            {
                //
                // The second argument is a buffer address
                // The user entered a structure (type) name along with buffer address
                //
                if (TempSplitCommand.size() == 2)
                {
                    //
                    // There is not parameters, only a symbol name and then a buffer address
                    // Call it with default configuration
                    //
                    CommandDtShowDataBasedOnSymbolTypes(TempSplitCommand.at(0).c_str(),
                                                        TargetAddress,
                                                        IsStruct,
                                                        BufferAddressRetrievedFromDebuggee,
                                                        TargetPid,
                                                        IsPhysicalAddress,
                                                        PDBEX_DEFAULT_CONFIGURATION);
                }
                else
                {
                    //
                    // Other than the first argument which is a structure (type) name, and
                    // the second argument which is buffer address, there are other parameters, so
                    // we WON'T call it with default parameters
                    //
                    TempTypeNameHolder = TempSplitCommand.at(0);
 
                    //
                    // Remove the first, and the second arguments
                    //
                    TempSplitCommand.erase(TempSplitCommand.begin());
                    TempSplitCommand.erase(TempSplitCommand.begin());
 
                    //
                    // Convert to pdbex args
                    //
                    if (!CommandDtAndStructConvertHyperDbgArgsToPdbex(TempSplitCommand, PdbexArgs, &TargetPid))
                    {
                        if (IsStruct)
                        {
                            CommandStructHelp();
                        }
                        else
                        {
                            CommandDtHelp();
                        }
 
                        return;
                    }
 
                    //
                    // Call the wrapper of pdbex
                    //
                    CommandDtShowDataBasedOnSymbolTypes(TempTypeNameHolder.c_str(),
                                                        TargetAddress,
                                                        IsStruct,
                                                        BufferAddressRetrievedFromDebuggee,
                                                        TargetPid,
                                                        IsPhysicalAddress,
                                                        PdbexArgs.c_str());
                }
            }
        }
        else
        {
            //
            // The first argument is a buffer address, so we get the first argument as
            // a buffer address and the second argument as the structure (type) name
            //
            if (TempSplitCommand.size() == 2)
            {
                //
                // There is not parameters, only a buffer address and then a symbol name
                // Call it with default configuration
                //
                CommandDtShowDataBasedOnSymbolTypes(TempSplitCommand.at(1).c_str(),
                                                    TargetAddress,
                                                    IsStruct,
                                                    BufferAddressRetrievedFromDebuggee,
                                                    TargetPid,
                                                    IsPhysicalAddress,
                                                    PDBEX_DEFAULT_CONFIGURATION);
            }
            else
            {
                //
                // Other than the first argument which is a buffer address, and the second
                // argument which is structure (type) name, there are other parameters, so
                // we WON'T call it with default parameters
                //
                TempTypeNameHolder = TempSplitCommand.at(1);
 
                //
                // Remove the first, and the second arguments
                //
                TempSplitCommand.erase(TempSplitCommand.begin());
                TempSplitCommand.erase(TempSplitCommand.begin());
 
                //
                // Convert to pdbex args
                //
                if (!CommandDtAndStructConvertHyperDbgArgsToPdbex(TempSplitCommand, PdbexArgs, &TargetPid))
                {
                    if (IsStruct)
                    {
                        CommandStructHelp();
                    }
                    else
                    {
                        CommandDtHelp();
                    }
 
                    return;
                }
 
                //
                // Call the wrapper of pdbex
                //
                CommandDtShowDataBasedOnSymbolTypes(TempTypeNameHolder.c_str(),
                                                    TargetAddress,
                                                    IsStruct,
                                                    BufferAddressRetrievedFromDebuggee,
                                                    TargetPid,
                                                    IsPhysicalAddress,
                                                    PdbexArgs.c_str());
            }
        }
    }
}

◆ CommandDump()

VOID CommandDump	(	vector< string >	SplitCommand,
		string	Command )

.dump command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    wstring                   Filepath;
    UINT32                    ActualLength;
    UINT32                    Iterator;
    UINT32                    Pid                 = 0;
    UINT32                    Length              = 0;
    UINT64                    StartAddress        = 0;
    UINT64                    EndAddress          = 0;
    BOOLEAN                   IsFirstCommand      = TRUE;
    BOOLEAN                   NextIsProcId        = FALSE;
    BOOLEAN                   NextIsPath          = FALSE;
    BOOLEAN                   IsTheFirstAddr      = FALSE;
    BOOLEAN                   IsTheSecondAddr     = FALSE;
    BOOLEAN                   IsDumpPathSpecified = FALSE;
    string                    FirstCommand        = SplitCommand.front();
    DEBUGGER_READ_MEMORY_TYPE MemoryType          = DEBUGGER_READ_VIRTUAL_ADDRESS;
 
    if (SplitCommand.size() <= 4)
    {
        ShowMessages("err, incorrect use of the '.dump' command\n\n");
        CommandDumpHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    for (auto Section : SplitCommand)
    {
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
        else if (NextIsProcId)
        {
            if (!ConvertStringToUInt32(Section, &Pid))
            {
                ShowMessages("please specify a correct hex value for process id\n\n");
                CommandDumpHelp();
                return;
            }
            NextIsProcId = FALSE;
            continue;
        }
        else if (NextIsPath)
        {
            //
            // Convert path to wstring
            //
            StringToWString(Filepath, Section);
            IsDumpPathSpecified = TRUE;
 
            NextIsPath = FALSE;
        }
        else if (!Section.compare("pid"))
        {
            NextIsProcId = TRUE;
            continue;
        }
        else if (!Section.compare("path"))
        {
            NextIsPath = TRUE;
            continue;
        }
        //
        // Check the 'From' address
        //
        else if (!IsTheFirstAddr && SymbolConvertNameOrExprToAddress(Section, &StartAddress))
        {
            IsTheFirstAddr = TRUE;
        }
        //
        // Check the 'To' address
        //
        else if (!IsTheSecondAddr && SymbolConvertNameOrExprToAddress(Section, &EndAddress))
        {
            IsTheSecondAddr = TRUE;
        }
        else
        {
            //
            // invalid input
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         Section.c_str());
            CommandDumpHelp();
 
            return;
        }
    }
 
    //
    // Check if 'pid' is not specified
    //
    if (NextIsProcId)
    {
        ShowMessages("please specify a correct hex value for process id\n\n");
        CommandDumpHelp();
        return;
    }
 
    //
    // Check if 'path' is either specified, not completely specified
    //
    if (NextIsPath || !IsDumpPathSpecified)
    {
        ShowMessages("please specify a correct path for saving the dump\n\n");
        CommandDumpHelp();
        return;
    }
 
    //
    // Check if start address or end address is null
    //
    if (!IsTheFirstAddr || !IsTheSecondAddr)
    {
        ShowMessages("err, please specify the start and end address in hex format\n");
        return;
    }
 
    //
    // Check if end address is bigger than start address
    //
    if (StartAddress >= EndAddress)
    {
        ShowMessages("err, please note that the 'to' address should be greater than the 'from' address\n");
        return;
    }
 
    //
    // Check to prevent using process id in d* and u* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && Pid != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    if (Pid == 0)
    {
        //
        // Default process we read from current process
        //
        Pid = GetCurrentProcessId();
    }
 
    //
    // Check whether it's physical or virtual address
    //
    if (!FirstCommand.compare("!dump"))
    {
        MemoryType = DEBUGGER_READ_PHYSICAL_ADDRESS;
    }
 
    //
    // Create or open the file for writing the dump file
    //
    DumpFileHandle = CreateFileW(
        Filepath.c_str(),
        GENERIC_WRITE,
        0,
        NULL,
        CREATE_ALWAYS,
        FILE_ATTRIBUTE_NORMAL,
        NULL);
 
    if (DumpFileHandle == INVALID_HANDLE_VALUE)
    {
        ShowMessages("err, unable to create or open the file\n");
        return;
    }
 
    //
    // Compute the length
    //
    Length = (UINT32)(EndAddress - StartAddress);
 
    ActualLength = NULL;
    Iterator     = Length / PAGE_SIZE;
 
    for (size_t i = 0; i <= Iterator; i++)
    {
        UINT64 Address = StartAddress + (i * PAGE_SIZE);
 
        if (Length >= PAGE_SIZE)
        {
            ActualLength = PAGE_SIZE;
        }
        else
        {
            ActualLength = Length;
        }
 
        Length -= ActualLength;
 
        if (ActualLength != 0)
        {
            // ShowMessages("address: 0x%llx | actual length: 0x%llx\n", Address, ActualLength);
 
            HyperDbgShowMemoryOrDisassemble(
                DEBUGGER_SHOW_COMMAND_DUMP,
                Address,
                MemoryType,
                READ_FROM_KERNEL,
                Pid,
                ActualLength,
                NULL);
        }
    }
 
    //
    // Close the file handle if it's not already closed
    //
    if (DumpFileHandle != NULL)
    {
        CloseHandle(DumpFileHandle);
        DumpFileHandle = NULL;
    }
 
    ShowMessages("the dump file is saved at: %ls\n", Filepath.c_str());
}

◆ CommandDumpSaveIntoFile()

VOID CommandDumpSaveIntoFile	(	PVOID	Buffer,
		UINT32	Length )

Saves the received buffers into the files.

Parameters

Buffer
Length

Returns: VOID

{
    DWORD BytesWritten;
 
    //
    // Check if handle is valid
    //
    if (DumpFileHandle == NULL)
    {
        ShowMessages("err, invalid handle for saving the dump buffer is specified\n");
        return;
    }
 
    //
    // Write the buffer into the dump file
    //
    if (!WriteFile(DumpFileHandle, Buffer, Length, &BytesWritten, NULL))
    {
        ShowMessages("err, unable to write buffer into the dump\n");
 
        CloseHandle(DumpFileHandle);
        DumpFileHandle = NULL;
 
        return;
    }
}

◆ CommandEditMemory()

VOID CommandEditMemory	(	vector< string >	SplitCommand,
		string	Command )

!e* and e* commands handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64                         Address;
    UINT64 *                       FinalBuffer;
    vector<UINT64>                 ValuesToEdit;
    DEBUGGER_EDIT_MEMORY_TYPE      MemoryType;
    DEBUGGER_EDIT_MEMORY_BYTE_SIZE ByteSize;
    BOOL                           SetAddress    = FALSE;
    BOOL                           SetValue      = FALSE;
    BOOL                           SetProcId     = FALSE;
    BOOL                           NextIsProcId  = FALSE;
    UINT64                         Value         = 0;
    UINT32                         ProcId        = 0;
    UINT32                         CountOfValues = 0;
    UINT32                         FinalSize     = 0;
    vector<string>                 SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32                         IndexInCommandCaseSensitive = 0;
    BOOLEAN                        IsFirstCommand              = TRUE;
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ProcId = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (SplitCommand.size() <= 2)
    {
        ShowMessages("incorrect use of the 'e*'\n\n");
        CommandEditMemoryHelp();
        return;
    }
 
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (IsFirstCommand)
        {
            if (!Section.compare("!eb"))
            {
                MemoryType = EDIT_PHYSICAL_MEMORY;
                ByteSize   = EDIT_BYTE;
            }
            else if (!Section.compare("!ed"))
            {
                MemoryType = EDIT_PHYSICAL_MEMORY;
                ByteSize   = EDIT_DWORD;
            }
            else if (!Section.compare("!eq"))
            {
                MemoryType = EDIT_PHYSICAL_MEMORY;
                ByteSize   = EDIT_QWORD;
            }
            else if (!Section.compare("eb"))
            {
                MemoryType = EDIT_VIRTUAL_MEMORY;
                ByteSize   = EDIT_BYTE;
            }
            else if (!Section.compare("ed"))
            {
                MemoryType = EDIT_VIRTUAL_MEMORY;
                ByteSize   = EDIT_DWORD;
            }
            else if (!Section.compare("eq"))
            {
                MemoryType = EDIT_VIRTUAL_MEMORY;
                ByteSize   = EDIT_QWORD;
            }
            else
            {
                //
                // What's this? :(
                //
                ShowMessages("unknown error happened !\n\n");
                CommandEditMemoryHelp();
                return;
            }
 
            IsFirstCommand = FALSE;
 
            continue;
        }
 
        if (NextIsProcId)
        {
            //
            // It's a process id
            //
            NextIsProcId = FALSE;
 
            if (!ConvertStringToUInt32(Section, &ProcId))
            {
                ShowMessages("please specify a correct hex process id\n\n");
                CommandEditMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the proc id is set, next we should read value
                //
                continue;
            }
        }
 
        //
        // Check if it's a process id or not
        //
        if (!SetProcId && !Section.compare("pid"))
        {
            NextIsProcId = TRUE;
            continue;
        }
 
        if (!SetAddress)
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                                                  &Address))
            {
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                CommandEditMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the address is set, next we should read value
                //
                SetAddress = TRUE;
                continue;
            }
        }
 
        if (SetAddress)
        {
            //
            // Remove the hex notations
            //
            if (Section.rfind("0x", 0) == 0 || Section.rfind("0X", 0) == 0 ||
                Section.rfind("\\x", 0) == 0 || Section.rfind("\\X", 0) == 0)
            {
                Section = Section.erase(0, 2);
            }
            else if (Section.rfind('x', 0) == 0 || Section.rfind('X', 0) == 0)
            {
                Section = Section.erase(0, 1);
            }
            Section.erase(remove(Section.begin(), Section.end(), '`'), Section.end());
 
            //
            // Check if the value is valid based on byte counts
            //
            if (ByteSize == EDIT_BYTE && Section.size() >= 3)
            {
                ShowMessages("please specify a byte (hex) value for 'eb' or '!eb'\n\n");
                return;
            }
            if (ByteSize == EDIT_DWORD && Section.size() >= 9)
            {
                ShowMessages(
                    "please specify a dword (hex) value for 'ed' or '!ed'\n\n");
                return;
            }
            if (ByteSize == EDIT_QWORD && Section.size() >= 17)
            {
                ShowMessages(
                    "please specify a qword (hex) value for 'eq' or '!eq'\n\n");
                return;
            }
 
            //
            // Qword is checked by the following function, no need to double
            // check it above.
            //
 
            if (!ConvertStringToUInt64(Section, &Value))
            {
                ShowMessages("please specify a correct hex value to change the memory "
                             "content\n\n");
                CommandEditMemoryHelp();
                return;
            }
            else
            {
                //
                // Add it to the list
                //
 
                ValuesToEdit.push_back(Value);
 
                //
                // Keep track of values to modify
                //
                CountOfValues++;
 
                if (!SetValue)
                {
                    //
                    // At least on value is there
                    //
                    SetValue = TRUE;
                }
                continue;
            }
        }
    }
 
    //
    // Check to prevent using process id in e* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && ProcId != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    //
    // Only valid for VMI Mode
    //
    if (ProcId == 0)
    {
        ProcId = GetCurrentProcessId();
    }
 
    //
    // Check if address and value are set or not
    //
    if (!SetAddress)
    {
        ShowMessages("please specify a correct hex address\n\n");
        CommandEditMemoryHelp();
        return;
    }
    if (!SetValue)
    {
        ShowMessages(
            "please specify a correct hex value as the content to edit\n\n");
        CommandEditMemoryHelp();
        return;
    }
    if (NextIsProcId)
    {
        ShowMessages("please specify a correct hex value as the process id\n\n");
        CommandEditMemoryHelp();
        return;
    }
 
    //
    // Make the chunks for editing
    //
    FinalSize = (CountOfValues * sizeof(UINT64));
 
    //
    // Allocate structure + buffer
    //
    FinalBuffer = (UINT64 *)malloc(FinalSize);
 
    if (!FinalBuffer)
    {
        ShowMessages("unable to allocate memory\n\n");
        return;
    }
 
    //
    // Zero the buffer
    //
    ZeroMemory(FinalBuffer, FinalSize);
 
    //
    // Put the values in 64 bit structures
    //
    std::copy(ValuesToEdit.begin(), ValuesToEdit.end(), FinalBuffer);
 
    //
    // Perform the write operation
    //
    WriteMemoryContent(Address,
                       MemoryType,
                       ByteSize,
                       ProcId,
                       CountOfValues,
                       FinalBuffer);
 
    //
    // Free the malloc buffer
    //
    free(FinalBuffer);
}

◆ CommandEptHook()

VOID CommandEptHook	(	vector< string >	SplitCommand,
		string	Command )

!epthook command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    BOOLEAN                            GetAddress                  = FALSE;
    UINT64                             OptionalParam1              = 0; // Set the target address
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32                             IndexInCommandCaseSensitive = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (SplitCommand.size() < 2)
    {
        ShowMessages("incorrect use of the '!epthook'\n");
        CommandEptHookHelp();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            HIDDEN_HOOK_EXEC_CC,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check here to make sure that the user didn't specified the calling stages for this ept hook
    //
    if (Event->EventStage != VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION)
    {
        ShowMessages("the utilization of 'post' or 'all' event calling stages is not meaningful "
                     "for the hidden hook; therefore, this command does not support them\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (!Section.compare("!epthook"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably address
            //
            if (!SymbolConvertNameOrExprToAddress(
                    SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                    &OptionalParam1))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                CommandEptHookHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandEptHookHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
    if (OptionalParam1 == 0)
    {
        ShowMessages("please choose an address to put the hidden breakpoint on it\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the optional parameters
    //
    Event->Options.OptionalParam1 = OptionalParam1;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandEptHook2()

VOID CommandEptHook2	(	vector< string >	SplitCommand,
		string	Command )

!epthook2 command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    BOOLEAN                            GetAddress                  = FALSE;
    UINT64                             OptionalParam1              = 0; // Set the target address
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32                             IndexInCommandCaseSensitive = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (SplitCommand.size() < 2)
    {
        ShowMessages("incorrect use of the '!epthook2'\n");
        CommandEptHook2Help();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            HIDDEN_HOOK_EXEC_DETOURS,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check here to make sure that the user didn't specified the calling stages for this ept hook
    //
    if (Event->EventStage != VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION)
    {
        ShowMessages("the utilization of 'post' or 'all' event calling stages is not meaningful "
                     "for the hidden hook; therefore, this command does not support them\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (!Section.compare("!epthook2"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably address
            //
            if (!SymbolConvertNameOrExprToAddress(
                    SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                    &OptionalParam1))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                CommandEptHook2Help();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandEptHook2Help();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
    if (OptionalParam1 == 0)
    {
        ShowMessages("please choose an address to put the hook on it\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the optional parameters
    //
    Event->Options.OptionalParam1 = OptionalParam1;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandEval()

VOID CommandEval	(	vector< string >	SplitCommand,
		string	Command )

handler of ? command

Parameters

SplitCommand
Command

Returns: VOID

{
    PVOID  CodeBuffer;
    UINT64 BufferAddress;
    UINT32 BufferLength;
    UINT32 Pointer;
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("incorrect use of the '?'\n\n");
        CommandEvalHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove the first command from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Check if it's a test-case check or not
    //
    if (!Command.compare("test"))
    {
        //
        // It's a test-case checker
        //
        if (!CommandEvalCheckTestcase())
        {
            ShowMessages("err, testing script engine test-cases was not successful\n");
        }
        else
        {
            ShowMessages("testing script engine test-cases was successful\n");
        }
 
        return;
    }
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Send over serial
        //
 
        //
        // Run script engine handler
        //
        CodeBuffer = ScriptEngineParseWrapper((char *)Command.c_str(), TRUE);
 
        if (CodeBuffer == NULL)
        {
            //
            // return to show that this item contains an script
            //
            return;
        }
 
        //
        // Print symbols (test)
        //
        // PrintSymbolBufferWrapper(CodeBuffer);
 
        //
        // Set the buffer and length
        //
        BufferAddress = ScriptEngineWrapperGetHead(CodeBuffer);
        BufferLength  = ScriptEngineWrapperGetSize(CodeBuffer);
        Pointer       = ScriptEngineWrapperGetPointer(CodeBuffer);
 
        //
        // Send it to the remote debuggee
        //
        KdSendScriptPacketToDebuggee(BufferAddress, BufferLength, Pointer, FALSE);
 
        //
        // Remove the buffer of script engine interpreted code
        //
        ScriptEngineWrapperRemoveSymbolBuffer(CodeBuffer);
    }
    else
    {
        //
        // It's a test
        //
        ShowMessages("this command should not be used while you're in VMI-Mode or not in debugger-mode, "
                     "the results that you see is a simulated result for TESTING script-engine "
                     "and is not based on the status of your system. You can use this command, "
                     "ONLY in debugger-mode\n\n");
 
        ShowMessages("test expression : %s \n", Command.c_str());
        ScriptEngineWrapperTestParser(Command);
    }
}

◆ CommandEvents()

VOID CommandEvents	(	vector< string >	SplitCommand,
		string	Command )

events command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    DEBUGGER_MODIFY_EVENTS_TYPE RequestedAction;
    UINT64                      RequestedTag;
 
    //
    // Validate the parameters (size)
    //
    if (SplitCommand.size() != 1 && SplitCommand.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n", SplitCommand.at(0).c_str());
        CommandEventsHelp();
        return;
    }
 
    if (SplitCommand.size() == 1)
    {
        if (!g_EventTraceInitialized)
        {
            ShowMessages("no active/disabled events \n");
            return;
        }
 
        CommandEventsShowEvents();
 
        //
        // No need to continue any further
        //
        return;
    }
 
    //
    // Validate second argument as it's not just a simple
    // events without any parameter
    //
    if (!SplitCommand.at(1).compare("e"))
    {
        RequestedAction = DEBUGGER_MODIFY_EVENTS_ENABLE;
    }
    else if (!SplitCommand.at(1).compare("d"))
    {
        RequestedAction = DEBUGGER_MODIFY_EVENTS_DISABLE;
    }
    else if (!SplitCommand.at(1).compare("c"))
    {
        RequestedAction = DEBUGGER_MODIFY_EVENTS_CLEAR;
    }
    else if (!SplitCommand.at(1).compare("sc"))
    {
        if (!SplitCommand.at(2).compare("on"))
        {
            KdSendShortCircuitingEventToDebuggee(TRUE);
        }
        else if (!SplitCommand.at(2).compare("off"))
        {
            KdSendShortCircuitingEventToDebuggee(FALSE);
        }
        else
        {
            ShowMessages(
                "please specify a correct 'on' or 'off' state for the short-circuiting state\n\n");
            CommandEventsHelp();
            return;
        }
 
        //
        // No need to further continue
        //
        return;
    }
    else
    {
        //
        // unknown second command
        //
        ShowMessages("incorrect use of the '%s'\n\n", SplitCommand.at(0).c_str());
        CommandEventsHelp();
        return;
    }
 
    //
    // Validate third argument as it's not just a simple
    // events without any parameter
    //
    if (!SplitCommand.at(2).compare("all"))
    {
        RequestedTag = DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG;
    }
    else if (!ConvertStringToUInt64(SplitCommand.at(2), &RequestedTag))
    {
        ShowMessages(
            "please specify a correct hex value for tag id (event number)\n\n");
        CommandEventsHelp();
        return;
    }
 
    //
    // Send the request to the kernel, we add it to a constant
    // that's because we want start tags from that constant
    //
    if (RequestedTag != DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG)
    {
        RequestedTag = RequestedTag + DebuggerEventTagStartSeed;
    }
 
    //
    // Perform event related tasks
    //
    CommandEventsModifyAndQueryEvents(RequestedTag, RequestedAction);
}

◆ CommandException()

VOID CommandException	(	vector< string >	SplitCommand,
		string	Command )

!exception command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_EXCEPTIONS_ALL_FIRST_32_ENTRIES;
    BOOLEAN                            GetEntry                    = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            EXCEPTION_OCCURRED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!exception"))
        {
            continue;
        }
        else if (!GetEntry)
        {
            //
            // It's probably an index
            //
            if (!ConvertStringToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandExceptionHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                //
                // Check if entry is valid or not (start from zero)
                //
                if (SpecialTarget >= 31)
                {
                    //
                    // Entry is invalid (this command is designed for just first 32
                    // entries)
                    //
                    ShowMessages("the entry should be between 0x0 to 0x1f or first 32 "
                                 "entries'\n\n");
                    CommandExceptionHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                GetEntry = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandExceptionHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target exception (if not specific then it means all exceptions)
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandExit()

VOID CommandExit	(	vector< string >	SplitCommand,
		string	Command )

exit command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the 'exit'\n\n");
        CommandExitHelp();
        return;
    }
 
    if (g_IsConnectedToHyperDbgLocally)
    {
        //
        // It is in VMI mode
        //
 
        //
        // unload and exit if the vmm module is loaded
        //
        if (g_DeviceHandle)
        {
            HyperDbgUnloadVmm();
        }
    }
    else if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // It is in debugger mode
        //
 
        KdCloseConnection();
    }
 
    exit(0);
}

◆ CommandFlush()

VOID CommandFlush	(	vector< string >	SplitCommand,
		string	Command )

flush command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the 'flush'\n\n");
        CommandFlushHelp();
        return;
    }
 
    //
    // Flush the buffer
    //
    CommandFlushRequestFlush();
}

◆ CommandFormats()

VOID CommandFormats	(	vector< string >	SplitCommand,
		string	Command )

handler of .formats command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64  ConstantValue = 0;
    BOOLEAN HasError      = TRUE;
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("incorrect use of the '.formats'\n\n");
        CommandFormatsHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove .formats from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Evaluate a single expression
    //
    ConstantValue = ScriptEngineEvalSingleExpression(Command, &HasError);
 
    if (HasError)
    {
        ShowMessages("err, couldn't resolve error at '%s'\n", Command.c_str());
    }
    else
    {
        //
        // Show formats results for a constant
        //
        CommandFormatsShowResults(ConstantValue);
    }
}

◆ CommandG()

VOID CommandG	(	vector< string >	SplitCommand,
		string	Command )

handler of g command

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the 'g'\n\n");
        CommandGHelp();
        return;
    }
 
    CommandGRequest();
}

◆ CommandGu()

VOID CommandGu	(	vector< string >	SplitCommand,
		string	Command )

handler of gu command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32                           StepCount;
    DEBUGGER_REMOTE_STEPPING_REQUEST RequestFormat;
    BOOLEAN                          BreakOnNextInstruction = FALSE;
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 1 && SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'gu'\n\n");
        CommandGuHelp();
        return;
    }
 
    //
    // Set type of request
    //
    RequestFormat = DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU;
 
    //
    // Check if the command has a counter parameter
    //
    if (SplitCommand.size() == 2)
    {
        if (!ConvertStringToUInt32(SplitCommand.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandGuHelp();
            return;
        }
    }
    else
    {
        StepCount = DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Check if the thread is paused or not
        //
        if (g_ActiveProcessDebuggingState.IsActive && !g_ActiveProcessDebuggingState.IsPaused)
        {
            ShowMessages("the target process is running, use the "
                         "'pause' command or press CTRL+C to pause the process\n");
            return;
        }
 
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (size_t i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            //
            // Check if the current instruction is 'ret' or not
            //
            if (HyperDbgCheckWhetherTheCurrentInstructionIsRet(
                    g_CurrentRunningInstruction,
                    MAXIMUM_INSTR_SIZE,
                    g_IsRunningInstruction32Bit ? FALSE : TRUE // equals to !g_IsRunningInstruction32Bit
                    ))
            {
                BreakOnNextInstruction = TRUE;
 
                //
                // It's the last instruction, so we gonna show the instruction
                //
                RequestFormat = DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU_LAST_INSTRUCTION;
            }
 
            if (g_IsSerialConnectedToRemoteDebuggee)
            {
                //
                // It's stepping over serial connection in kernel debugger
                //
                KdSendStepPacketToDebuggee(RequestFormat);
            }
            else
            {
                //
                // It's stepping over user debugger
                //
                UdSendStepPacketToDebuggee(g_ActiveProcessDebuggingState.ProcessDebuggingToken,
                                           g_ActiveProcessDebuggingState.ThreadId,
                                           RequestFormat);
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
 
            //
            // Check if we see 'ret' in the previous instruction or not
            //
            if (BreakOnNextInstruction)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, going up (gu) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandHide()

VOID CommandHide	(	vector< string >	SplitCommand,
		string	Command )

!hide command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOLEAN                                      Status;
    ULONG                                        ReturnedLength;
    UINT64                                       TargetPid;
    BOOLEAN                                      TrueIfProcessIdAndFalseIfProcessName;
    DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE  HideRequest        = {0};
    PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE FinalRequestBuffer = 0;
    size_t                                       RequestBufferSize  = 0;
 
    if (SplitCommand.size() <= 2 && SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the '!hide'\n\n");
        CommandHideHelp();
        return;
    }
 
    //
    // Find out whether the user enters pid or name
    //
    if (SplitCommand.size() == 1)
    {
        if (g_ActiveProcessDebuggingState.IsActive)
        {
            TrueIfProcessIdAndFalseIfProcessName = TRUE;
            TargetPid                            = g_ActiveProcessDebuggingState.ProcessId;
        }
        else
        {
            //
            // There is no user-debugging process
            //
            ShowMessages("you're not attached to any user-mode process, "
                         "please explicitly specify the process id or process name\n");
            return;
        }
    }
    else if (!SplitCommand.at(1).compare("pid"))
    {
        TrueIfProcessIdAndFalseIfProcessName = TRUE;
 
        //
        // Check for the user to not add extra arguments
        //
        if (SplitCommand.size() != 3)
        {
            ShowMessages("incorrect use of the '!hide'\n\n");
            CommandHideHelp();
            return;
        }
 
        //
        // It's just a pid for the process
        //
        if (!ConvertStringToUInt64(SplitCommand.at(2), &TargetPid))
        {
            ShowMessages("incorrect process id\n\n");
            return;
        }
    }
    else if (!SplitCommand.at(1).compare("name"))
    {
        TrueIfProcessIdAndFalseIfProcessName = FALSE;
 
        //
        // Trim the command
        //
        Trim(Command);
 
        //
        // Remove !hide from it
        //
        Command.erase(0, SplitCommand.at(0).size());
 
        //
        // remove name + space
        //
        Command.erase(0, 4 + 1);
 
        //
        // Trim it again
        //
        Trim(Command);
    }
    else
    {
        //
        // Invalid argument for the second parameter to the command
        //
        ShowMessages("incorrect use of the '!hide'\n\n");
        CommandHideHelp();
        return;
    }
 
    //
    // Check if the user used !measure or not
    //
    if (!g_TransparentResultsMeasured || !g_CpuidAverage ||
        !g_CpuidStandardDeviation || !g_CpuidMedian)
    {
        ShowMessages("the average, median and standard deviation is not measured. "
                     "Did you use '!measure' command?\n");
        return;
    }
 
    //
    // Check if debugger is loaded or not
    //
    AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    //
    // We wanna hide the debugger and make transparent vm-exits
    //
    HideRequest.IsHide = TRUE;
 
    //
    // Set the measured times cpuid
    //
    HideRequest.CpuidAverage           = g_CpuidAverage;
    HideRequest.CpuidMedian            = g_CpuidMedian;
    HideRequest.CpuidStandardDeviation = g_CpuidStandardDeviation;
 
    //
    // Set the measured times rdtsc/p
    //
    HideRequest.RdtscAverage           = g_RdtscAverage;
    HideRequest.RdtscMedian            = g_RdtscMedian;
    HideRequest.RdtscStandardDeviation = g_RdtscStandardDeviation;
 
    HideRequest.TrueIfProcessIdAndFalseIfProcessName =
        TrueIfProcessIdAndFalseIfProcessName;
 
    if (TrueIfProcessIdAndFalseIfProcessName)
    {
        //
        // It's a process id
        //
        HideRequest.ProcId = (UINT32)TargetPid;
 
        RequestBufferSize = sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE);
    }
    else
    {
        //
        // It's a process name
        //
        HideRequest.LengthOfProcessName = (UINT32)Command.size() + 1;
        RequestBufferSize               = sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) + Command.size() + 1;
    }
 
    //
    // Allocate the requested buffer
    //
    FinalRequestBuffer =
        (PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE)malloc(RequestBufferSize);
 
    if (FinalRequestBuffer == NULL)
    {
        ShowMessages("insufficient space\n");
        return;
    }
 
    //
    // Zero the memory
    //
    RtlZeroMemory(FinalRequestBuffer, RequestBufferSize);
 
    //
    // Copy the buffer on the top of the final buffer
    // to send the kernel
    //
    memcpy(FinalRequestBuffer, &HideRequest, sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE));
 
    //
    // If it's a name then we should add it to the end of the buffer
    //
    memcpy(((UINT64 *)((UINT64)FinalRequestBuffer +
                       sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE))),
           Command.c_str(),
           Command.size());
 
    //
    // Send the request to the kernel
    //
 
    Status = DeviceIoControl(
        g_DeviceHandle,                                             // Handle to device
        IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER, // IO Control
                                                                    // code
        FinalRequestBuffer,                                         // Input Buffer to driver.
        (DWORD)RequestBufferSize,                                   // Input buffer length
        FinalRequestBuffer,                                         // Output Buffer from driver.
        SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE,         // Length of output
                                                                    // buffer in bytes.
        &ReturnedLength,                                            // Bytes placed in buffer.
        NULL                                                        // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        free(FinalRequestBuffer);
        return;
    }
 
    if (FinalRequestBuffer->KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("transparent debugging successfully enabled :)\n");
    }
    else if (FinalRequestBuffer->KernelStatus ==
             DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER)
    {
        ShowMessages("unable to hide the debugger (transparent-debugging) :(\n");
        free(FinalRequestBuffer);
        return;
    }
    else
    {
        ShowMessages("unknown error occurred :(\n");
        free(FinalRequestBuffer);
        return;
    }
 
    //
    // free the buffer
    //
    free(FinalRequestBuffer);
}

◆ CommandHwClk()

VOID CommandHwClk	(	vector< string >	SplitCommand,
		string	Command )

!hw_clk command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT64                             SpecialTarget                         = 0;
    UINT32                             ActionBreakToDebuggerLength           = 0;
    UINT32                             ActionCustomCodeLength                = 0;
    UINT32                             ActionScriptLength                    = 0;
    UINT32                             NumberOfStagesForScript               = 0;
    UINT32                             NumberOfOperandsForScript             = 0;
    size_t                             NewCompressedBufferSize               = 0;
    size_t                             NumberOfNeededFlipFlopsInTargetDevice = 0;
    size_t                             NumberOfBytesPerChunk                 = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
    HWDBG_SHORT_SYMBOL *               NewScriptBuffer = NULL;
 
    if (SplitCommand.size() >= 2 && !SplitCommand.at(1).compare("test"))
    {
        TCHAR        TestFilePath[MAX_PATH] = {0};
        const SIZE_T BufferSize             = 256; // Adjust based on the number of memory entries of the file
        UINT32       PortNum                = 0;
        UINT32       MemoryBuffer[BufferSize];
 
        if (SetupPathForFileName(HWDBG_TEST_READ_INSTANCE_INFO_PATH, TestFilePath, sizeof(TestFilePath), TRUE) &&
            HwdbgInterpreterFillMemoryFromFile(TestFilePath, MemoryBuffer, BufferSize))
        {
            //
            // Print the content of MemoryBuffer for verification
            //
            for (SIZE_T I = 0; I < BufferSize; ++I)
            {
                ShowMessages("%08x ", MemoryBuffer[I]);
                ShowMessages("\n");
            }
        }
 
        //
        // Interpret packet
        //
        if (HwdbgInterpretPacket(MemoryBuffer, BufferSize))
        {
            ShowMessages("instance info interpreted successfully\n");
 
            ShowMessages("Debuggee Version: 0x%x\n", g_HwdbgInstanceInfo.version);
            ShowMessages("Debuggee Maximum Number Of Stages: 0x%x\n", g_HwdbgInstanceInfo.maximumNumberOfStages);
            ShowMessages("Debuggee Script Variable Length: 0x%x\n", g_HwdbgInstanceInfo.scriptVariableLength);
            ShowMessages("Debuggee Number of Supported Local (and global) Variables: 0x%x\n", g_HwdbgInstanceInfo.numberOfSupportedLocalAndGlobalVariables);
            ShowMessages("Debuggee Number of Supported Temporary Variables: 0x%x\n", g_HwdbgInstanceInfo.numberOfSupportedTemporaryVariables);
            ShowMessages("Debuggee Maximum Number Of Supported GET Script Operators: 0x%x\n", g_HwdbgInstanceInfo.maximumNumberOfSupportedGetScriptOperators);
            ShowMessages("Debuggee Maximum Number Of Supported SET Script Operators: 0x%x\n", g_HwdbgInstanceInfo.maximumNumberOfSupportedSetScriptOperators);
            ShowMessages("Debuggee Shared Memory Size: 0x%x\n", g_HwdbgInstanceInfo.sharedMemorySize);
            ShowMessages("Debuggee Debugger Area Offset: 0x%x\n", g_HwdbgInstanceInfo.debuggerAreaOffset);
            ShowMessages("Debuggee Debuggee Area Offset: 0x%x\n", g_HwdbgInstanceInfo.debuggeeAreaOffset);
            ShowMessages("Debuggee Script Capabilities Mask: 0x%llx\n", g_HwdbgInstanceInfo.scriptCapabilities);
 
            //
            // Show script capabilities
            //
            HwdbgInterpreterShowScriptCapabilities(&g_HwdbgInstanceInfo);
 
            ShowMessages("Debuggee Number Of Pins: 0x%x\n", g_HwdbgInstanceInfo.numberOfPins);
            ShowMessages("Debuggee Number Of Ports: 0x%x\n", g_HwdbgInstanceInfo.numberOfPorts);
 
            ShowMessages("Debuggee BRAM Address Width: 0x%x\n", g_HwdbgInstanceInfo.bramAddrWidth);
            ShowMessages("Debuggee BRAM Data Width: 0x%x (%d bit)\n", g_HwdbgInstanceInfo.bramDataWidth, g_HwdbgInstanceInfo.bramDataWidth);
 
            for (auto item : g_HwdbgPortConfiguration)
            {
                ShowMessages("Port number %d ($hw_port%d): 0x%x\n", PortNum, PortNum, item);
                PortNum++;
            }
        }
        else
        {
            ShowMessages("err, unable to interpret instance info packet of the debuggee");
            return;
        }
 
        //
        // Interpret and fill the general event and action fields
        //
        //
        if (!InterpretGeneralEventAndActionsFields(
                &SplitCommand,
                &SplitCommandCaseSensitive,
                (VMM_EVENT_TYPE_ENUM)NULL, // not an event
                &Event,
                &EventLength,
                &ActionBreakToDebugger,
                &ActionBreakToDebuggerLength,
                &ActionCustomCode,
                &ActionCustomCodeLength,
                &ActionScript,
                &ActionScriptLength,
                &EventParsingErrorCause))
        {
            return;
        }
 
        //
        // Print the actual script
        //
        ShowMessages("\nHyperDbg (general) script buffer (size=%d, flip-flops (just script)=%d):\n\n",
                     ActionScript->ScriptBufferSize,
                     ActionScript->ScriptBufferSize * 8 // Converted to bits
        );
 
        CHAR * ScriptBuffer = (CHAR *)((UINT64)ActionScript + sizeof(DEBUGGER_GENERAL_ACTION));
 
        for (size_t i = 0; i < ActionScript->ScriptBufferSize; i++)
        {
            ShowMessages("%02X ", (UINT8)ScriptBuffer[i]);
        }
 
        ShowMessages("\n");
 
        //
        // Check the script capabilities with the generated script
        //
        if (HwdbgInterpreterCheckScriptBufferWithScriptCapabilities(&g_HwdbgInstanceInfo,
                                                                    ScriptBuffer,
                                                                    ActionScript->ScriptBufferSize / sizeof(SYMBOL),
                                                                    &NumberOfStagesForScript,
                                                                    &NumberOfOperandsForScript))
        {
            ShowMessages("\n[+] target script is supported by this instance of hwdbg!\n");
 
            //
            // Now, converting the script based on supported script variable length
            //
            if (g_HwdbgInstanceInfoIsValid)
            {
                //
                // Conversion needed
                //
                if (g_HwdbgInstanceInfo.scriptVariableLength >= sizeof(BYTE) * 8)
                {
                    //
                    // The script variable length is valid (at least 8 bit (1 byte)
                    //
 
                    //
                    // Compress script buffer
                    //
                    if (HwdbgInterpreterConvertSymbolToHwdbgShortSymbolBuffer(&g_HwdbgInstanceInfo,
                                                                              (SYMBOL *)ScriptBuffer,
                                                                              ActionScript->ScriptBufferSize,
                                                                              NumberOfStagesForScript,
                                                                              &NewScriptBuffer,
                                                                              &NewCompressedBufferSize) == TRUE &&
 
                        //
                        // we put bram data width size here instead of script variable length (g_HwdbgInstanceInfo.scriptVariableLength)
                        // since we want it to read one symbol filed at a time
                        //
                        HwdbgInterpreterCompressBuffer((UINT64 *)NewScriptBuffer,
                                                       NewCompressedBufferSize,
                                                       g_HwdbgInstanceInfo.scriptVariableLength,
                                                       g_HwdbgInstanceInfo.bramDataWidth,
                                                       &NewCompressedBufferSize,
                                                       &NumberOfBytesPerChunk) == TRUE)
                    {
                        ShowMessages("\n---------------------------------------------------------\n");
 
                        UINT32 NumberOfOperandsImplemented = NumberOfStagesForScript * (g_HwdbgInstanceInfo.maximumNumberOfSupportedGetScriptOperators + g_HwdbgInstanceInfo.maximumNumberOfSupportedSetScriptOperators);
 
                        //
                        // Calculate the number of flip-flops needed in the target device
                        // + operator symbol itself which only contains value (type is always equal to SYMBOL_SEMANTIC_RULE_TYPE)
                        // so, it is not counted as a flip-flop
                        //
                        NumberOfNeededFlipFlopsInTargetDevice = (NumberOfStagesForScript * (g_HwdbgInstanceInfo.maximumNumberOfSupportedGetScriptOperators + g_HwdbgInstanceInfo.maximumNumberOfSupportedSetScriptOperators) * g_HwdbgInstanceInfo.scriptVariableLength * sizeof(HWDBG_SHORT_SYMBOL) / sizeof(UINT64)) + // size of operator (GET and SET)
                                                                (NumberOfStagesForScript * g_HwdbgInstanceInfo.scriptVariableLength * (sizeof(HWDBG_SHORT_SYMBOL) / sizeof(UINT64)) / 2) +                                                                                                                               // size of main operator (/ 2 is becasue Type is not inffered)
                                                                (NumberOfStagesForScript * g_HwdbgInstanceInfo.numberOfSupportedLocalAndGlobalVariables * g_HwdbgInstanceInfo.scriptVariableLength) +                                                                                                                    // size of local (and global) variables
                                                                (NumberOfStagesForScript * g_HwdbgInstanceInfo.numberOfSupportedTemporaryVariables * g_HwdbgInstanceInfo.scriptVariableLength) +                                                                                                                         // size of temporary variables
                                                                (NumberOfStagesForScript * Log2Ceil(g_HwdbgInstanceInfo.maximumNumberOfStages * (g_HwdbgInstanceInfo.maximumNumberOfSupportedGetScriptOperators + g_HwdbgInstanceInfo.maximumNumberOfSupportedSetScriptOperators + 1)) * 2) +                            // size of stage index register + targetStage (* 2)
                                                                (NumberOfStagesForScript) +                                                                                                                                                                                                                              // stage enable flip-flop
                                                                (NumberOfStagesForScript * g_HwdbgInstanceInfo.numberOfPins);                                                                                                                                                                                            // input => output flip-flop
 
                        ShowMessages("hwdbg script buffer (buffer size=%d, stages=%d, operands needed: %d - operands used: %d (%.2f%%), total used flip-flops=%d, number of bytes per chunk: %d):\n\n",
                                     NewCompressedBufferSize,
                                     NumberOfStagesForScript,
                                     NumberOfOperandsImplemented,
                                     NumberOfOperandsForScript,
                                     ((float)NumberOfOperandsForScript / (float)NumberOfOperandsImplemented) * 100,
                                     NumberOfNeededFlipFlopsInTargetDevice,
                                     NumberOfBytesPerChunk);
 
                        for (size_t i = 0; i < NewCompressedBufferSize; i++)
                        {
                            ShowMessages("%02X ", (UINT8)((CHAR *)NewScriptBuffer)[i]);
                        }
 
                        ShowMessages("\n\nwriting script configuration packet into the file\n");
 
                        //
                        // *** Write script configuration packet into a file ***
                        //
                        if (SetupPathForFileName(HWDBG_TEST_WRITE_SCRIPT_BUFFER_PATH, TestFilePath, sizeof(TestFilePath), FALSE) &&
                            HwdbgInterpreterSendScriptPacket(&g_HwdbgInstanceInfo,
                                                             TestFilePath,
                                                             NumberOfStagesForScript + NumberOfOperandsImplemented - 1, // Number of symbols = Number of stages + Number of operands - 1
                                                             NewScriptBuffer,
                                                             (UINT32)NewCompressedBufferSize))
                        {
                            ShowMessages("\n[*] script buffer successfully written into file: %s\n", TestFilePath);
                        }
                        else
                        {
                            ShowMessages("err, unable to write script buffer\n");
                        }
 
                        //
                        // *** Write test instance info request into a file ***
                        //
                        if (SetupPathForFileName(HWDBG_TEST_WRITE_INSTANCE_INFO_PATH, TestFilePath, sizeof(TestFilePath), FALSE) &&
                            HwdbgInterpreterSendPacketAndBufferToHwdbg(
                                &g_HwdbgInstanceInfo,
                                TestFilePath,
                                DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_HARDWARE_LEVEL,
                                hwdbgActionSendInstanceInfo,
                                NULL,
                                NULL_ZERO))
                        {
                            ShowMessages("[*] instance info successfully written into file: %s\n", TestFilePath);
                        }
                    }
                }
                else
                {
                    //
                    // The script variable length is not valid (at least 8 bit (1 byte)
                    //
                    ShowMessages("err, the script variable length should be at least 8 bits (1 byte)\n");
                }
            }
        }
        else
        {
            ShowMessages("\n[-] target script is NOT supported by this instance of hwdbg!\n");
        }
 
        //
        // Free the allocated memory
        //
        if (NewScriptBuffer != NULL)
        {
            free(NewScriptBuffer);
        }
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n", SplitCommand.at(0).c_str());
        CommandHwClkHelp();
        return;
    }
}

◆ CommandI()

VOID CommandI	(	vector< string >	SplitCommand,
		string	Command )

handler of i command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32                           StepCount;
    DEBUGGER_REMOTE_STEPPING_REQUEST RequestFormat;
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 1 && SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'i'\n\n");
        CommandIHelp();
        return;
    }
 
    //
    // Check if we're in VMI mode
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ShowMessages("the instrumentation step-in is only supported in Debugger Mode\n");
        return;
    }
 
    //
    // Set type of step
    //
    RequestFormat = DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN;
 
    //
    // Check if the command has a counter parameter
    //
    if (SplitCommand.size() == 2)
    {
        if (!ConvertStringToUInt32(SplitCommand.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandIHelp();
            return;
        }
    }
    else
    {
        StepCount = 1;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (size_t i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            //
            // It's stepping over serial connection in kernel debugger
            //
            KdSendStepPacketToDebuggee(RequestFormat);
 
            if (!SplitCommand.at(0).compare("ir"))
            {
                //
                // Show registers
                //
                HyperDbgRegisterShowAll();
 
                if (i != StepCount - 1)
                {
                    ShowMessages("\n");
                }
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, stepping (i) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandInterrupt()

VOID CommandInterrupt	(	vector< string >	SplitCommand,
		string	Command )

!interrupt command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = 0;
    BOOLEAN                            GetEntry                    = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            EXTERNAL_INTERRUPT_OCCURRED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!interrupt"))
        {
            continue;
        }
        else if (!GetEntry)
        {
            //
            // It's probably an index
            //
            if (!ConvertStringToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandInterruptHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                //
                // Check if entry is valid or not
                //
                if (!(SpecialTarget >= 32 && SpecialTarget <= 0xff))
                {
                    //
                    // Entry is invalid (this command is designed for just entries
                    // between 32 to 255)
                    //
                    ShowMessages("the entry should be between 0x20 to 0xFF or the "
                                 "entries between 32 to 255\n\n");
                    CommandInterruptHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                GetEntry = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandInterruptHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    if (SpecialTarget == 0)
    {
        //
        // The user didn't set the target interrupt, even though it's possible to
        // get all interrupts but it makes the system not responsive so it's wrong
        // to trigger event on all interrupts and we're not going to support it
        //
        ShowMessages("please specify an interrupt index to monitor, HyperDbg "
                     "doesn't support to trigger events on all interrupts because "
                     "it's not reasonable and make the system unresponsive\n");
        CommandInterruptHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the target interrupt
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandIoin()

VOID CommandIoin	(	vector< string >	SplitCommand,
		string	Command )

!ioin command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_ALL_IO_PORTS;
    BOOLEAN                            GetPort                     = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            IN_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!ioin"))
        {
            continue;
        }
        else if (!GetPort)
        {
            //
            // It's probably an I/O port
            //
            if (!ConvertStringToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandIoinHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetPort = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandIoinHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target I/O port
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandIoout()

VOID CommandIoout	(	vector< string >	SplitCommand,
		string	Command )

!ioout command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_ALL_IO_PORTS;
    BOOLEAN                            GetPort                     = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            OUT_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!ioout"))
        {
            continue;
        }
        else if (!GetPort)
        {
            //
            // It's probably an I/O port
            //
            if (!ConvertStringToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandIooutHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetPort = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandIooutHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target I/O port
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandK()

VOID CommandK	(	vector< string >	SplitCommand,
		string	Command )

k command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64         BaseAddress = NULL;  // Null base address means current RSP register
    UINT32         Length      = 0x100; // Default length
    vector<string> SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32         IndexInCommandCaseSensitive = 0;
    BOOLEAN        IsFirstCommand              = TRUE;
    BOOLEAN        IsNextBase                  = FALSE;
    BOOLEAN        IsNextLength                = FALSE;
 
    string FirstCommand = SplitCommand.front();
 
    if (SplitCommand.size() >= 6)
    {
        ShowMessages("incorrect use of the '%s'\n\n", FirstCommand.c_str());
        CommandKHelp();
        return;
    }
 
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, tracing callstack is not possible when you're not "
                     "connected to a debuggee\n");
        return;
    }
 
    //
    // Set the default length
    //
    if (g_IsRunningInstruction32Bit)
    {
        Length = 0x100;
    }
    else
    {
        Length = 0x200;
    }
 
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (IsFirstCommand)
        {
            IsFirstCommand = FALSE;
            continue;
        }
        if (IsNextBase == TRUE)
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                                                  &BaseAddress))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                return;
            }
 
            IsNextBase = FALSE;
            continue;
        }
 
        if (IsNextLength == TRUE)
        {
            if (!ConvertStringToUInt32(Section, &Length))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
            IsNextLength = FALSE;
            continue;
        }
 
        if (!Section.compare("l"))
        {
            IsNextLength = TRUE;
            continue;
        }
 
        if (!Section.compare("base"))
        {
            IsNextBase = TRUE;
            continue;
        }
 
        //
        // User inserts unexpected input
        //
        ShowMessages("err, incorrect use of the '%s' command\n\n",
                     FirstCommand.c_str());
        CommandKHelp();
 
        return;
    }
 
    if (IsNextLength || IsNextBase)
    {
        ShowMessages("incorrect use of the '%s' command\n\n", FirstCommand.c_str());
        CommandKHelp();
        return;
    }
 
    //
    // Send callstack request
    //
 
    if (!FirstCommand.compare("k"))
    {
        KdSendCallStackPacketToDebuggee(BaseAddress,
                                        Length,
                                        DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITHOUT_PARAMS,
                                        g_IsRunningInstruction32Bit);
    }
    else if (!FirstCommand.compare("kq"))
    {
        KdSendCallStackPacketToDebuggee(BaseAddress,
                                        Length,
                                        DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS,
                                        FALSE);
    }
    else if (!FirstCommand.compare("kd"))
    {
        KdSendCallStackPacketToDebuggee(BaseAddress,
                                        Length,
                                        DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS,
                                        TRUE);
    }
}

◆ CommandKill()

VOID CommandKill	(	vector< string >	SplitCommand,
		string	Command )

.kill command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the '.kill'\n\n");
        CommandKillHelp();
        return;
    }
 
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Kill the current active process
        //
        if (!UdKillProcess(g_ActiveProcessDebuggingState.ProcessId))
        {
            ShowMessages("process does not exists, is it already terminated?\n");
        }
    }
    else if (g_ProcessIdOfLatestStartingProcess != NULL)
    {
        if (!UdKillProcess(g_ProcessIdOfLatestStartingProcess))
        {
            ShowMessages("process does not exists, is it already terminated?\n");
        }
 
        //
        // No longer the last process exists
        //
        g_ProcessIdOfLatestStartingProcess = NULL;
    }
    else
    {
        ShowMessages("nothing to terminate!\n");
        return;
    }
}

◆ CommandListen()

VOID CommandListen	(	vector< string >	SplitCommand,
		string	Command )

listen command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    string port;
 
    if (SplitCommand.size() >= 3)
    {
        //
        // Means that user entered invalid parameters
        //
        ShowMessages("incorrect use of the '.listen'\n\n");
        CommandListenHelp();
        return;
    }
 
    if (g_IsConnectedToHyperDbgLocally || g_IsConnectedToRemoteDebuggee ||
        g_IsConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a debugger, please use '.disconnect' "
                     "command\n");
        return;
    }
 
    //
    // Check to avoid using this command in debugger-mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a an instance of HyperDbg, please use "
                     "'.debug close' command\n");
        return;
    }
 
    if (SplitCommand.size() == 1)
    {
        //
        // listen on default port
        //
        ShowMessages("listening on %s ...\n", DEFAULT_PORT);
        RemoteConnectionListen(DEFAULT_PORT);
 
        return;
    }
    else if (SplitCommand.size() == 2)
    {
        port = SplitCommand.at(1);
 
        //
        // means that probably wants to listen
        // on a specific port, let's see if the
        // port is valid or not
        //
        if (!IsNumber(port) || stoi(port) > 65535 || stoi(port) < 0)
        {
            ShowMessages("incorrect port\n");
            return;
        }
 
        //
        // listen on the port
        //
        ShowMessages("listening on %s ...\n", port.c_str());
        RemoteConnectionListen(port.c_str());
    }
    else
    {
        ShowMessages("incorrect use of the '.listen'\n\n");
        CommandListenHelp();
        return;
    }
}

◆ CommandLm()

VOID CommandLm	(	vector< string >	SplitCommand,
		string	Command )

handle lm command

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOLEAN SetPid                = FALSE;
    BOOLEAN SetSearchFilter       = FALSE;
    BOOLEAN SearchStringEntered   = FALSE;
    BOOLEAN OnlyShowKernelModules = FALSE;
    BOOLEAN OnlyShowUserModules   = FALSE;
    UINT32  TargetPid             = NULL;
    char    Search[MAX_PATH]      = {0};
    char *  SearchString          = NULL;
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("lm"))
        {
            continue;
        }
        else if (!Section.compare("pid") && !SetPid)
        {
            SetPid = TRUE;
        }
        else if (!Section.compare("m") && !SetSearchFilter)
        {
            SetSearchFilter = TRUE;
        }
        else if (SetPid)
        {
            if (!ConvertStringToUInt32(Section, &TargetPid))
            {
                //
                // couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             Section.c_str());
                CommandLmHelp();
                return;
            }
            SetPid = FALSE;
        }
        else if (SetSearchFilter)
        {
            if (Section.length() >= MAX_PATH)
            {
                ShowMessages("err, string is too large for search, please enter "
                             "smaller string\n");
 
                return;
            }
 
            SearchStringEntered = TRUE;
            strcpy(Search, Section.c_str());
 
            SetSearchFilter = FALSE;
        }
        else if (!Section.compare("km"))
        {
            if (OnlyShowUserModules)
            {
                ShowMessages("err, you cannot use both 'um', and 'km', by default "
                             "HyperDbg shows both user-mode and kernel-mode modules\n");
                return;
            }
 
            OnlyShowKernelModules = TRUE;
        }
        else if (!Section.compare("um"))
        {
            if (OnlyShowKernelModules)
            {
                ShowMessages("err, you cannot use both 'um', and 'km', by default "
                             "HyperDbg shows both user-mode and kernel-mode modules\n");
                return;
            }
 
            OnlyShowUserModules = TRUE;
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         Section.c_str());
            CommandLmHelp();
            return;
        }
    }
 
    if (SetPid)
    {
        ShowMessages("err, please enter a valid process id in hex format, "
                     "or if you want to use it in decimal format, add '0n' "
                     "prefix to the number\n");
        return;
    }
 
    if (SetSearchFilter)
    {
        ShowMessages("err, please enter a valid string to search in modules\n");
        return;
    }
 
    //
    // Check if we have string to search
    //
    if (SearchStringEntered)
    {
        SearchString = Search;
    }
 
    //
    // Show user mode modules
    //
    if (!OnlyShowKernelModules)
    {
        if (TargetPid != NULL)
        {
            CommandLmShowUserModeModule(TargetPid, SearchString);
        }
        else if (g_ActiveProcessDebuggingState.IsActive)
        {
            CommandLmShowUserModeModule(g_ActiveProcessDebuggingState.ProcessId, SearchString);
        }
        else
        {
            CommandLmShowUserModeModule(GetCurrentProcessId(), SearchString);
        }
    }
 
    //
    // Show kernel mode modules
    //
    if (!OnlyShowUserModules)
    {
        if (!OnlyShowKernelModules)
        {
            ShowMessages("\n==============================================================================\n\n");
        }
 
        CommandLmShowKernelModeModule(SearchString);
    }
}

◆ CommandLoad()

VOID CommandLoad	(	vector< string >	SplitCommand,
		string	Command )

load command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'load'\n\n");
        CommandLoadHelp();
        return;
    }
 
    if (!g_IsConnectedToHyperDbgLocally)
    {
        ShowMessages("you're not connected to any instance of HyperDbg, did you "
                     "use '.connect'? \n");
        return;
    }
 
    //
    // Check for the module
    //
    if (!SplitCommand.at(1).compare("vmm"))
    {
        //
        // Check to make sure that the driver is not already loaded
        //
        if (g_DeviceHandle)
        {
            ShowMessages("handle of the driver found, if you use 'load' before, please "
                         "first unload it then call 'unload'\n");
            return;
        }
 
        //
        // Load VMM Module
        //
        ShowMessages("loading the vmm driver\n");
 
        if (HyperDbgInstallVmmDriver() == 1 || HyperDbgLoadVmmModule() == 1)
        {
            ShowMessages("failed to install or load the driver\n");
            return;
        }
 
        //
        // If in vmi-mode then initialize and load symbols (pdb)
        // for previously downloaded symbols
        // When the VMM module is loaded, we use the current
        // process (HyperDbg's process) as the base for user-mode
        // symbols
        //
        SymbolLocalReload(GetCurrentProcessId());
    }
    else
    {
        //
        // Module not found
        //
        ShowMessages("err, module not found\n");
    }
}

◆ CommandLogclose()

VOID CommandLogclose	(	vector< string >	SplitCommand,
		string	Command )

.logclose command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the '.logclose'\n\n");
        CommandLogcloseHelp();
        return;
    }
    if (!g_LogOpened)
    {
        ShowMessages("there is no opened log, did you use '.logopen'? \n");
        return;
    }
 
    //
    // Show the time and message before close
    //
    time_t    t  = time(NULL);
    struct tm tm = *localtime(&t);
    ShowMessages("log file closed (%d-%02d-%02d "
                 "%02d:%02d:%02d)\n",
                 tm.tm_year + 1900,
                 tm.tm_mon + 1,
                 tm.tm_mday,
                 tm.tm_hour,
                 tm.tm_min,
                 tm.tm_sec);
    //
    // close the file
    //
    g_LogOpenFile.close();
 
    //
    // Globally indicate that file is no longer available
    //
    g_LogOpened = FALSE;
}

◆ CommandLogopen()

VOID CommandLogopen	(	vector< string >	SplitCommand,
		string	Command )

.logopen command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() == 1)
    {
        ShowMessages("please specify a file\n");
        CommandLogopenHelp();
        return;
    }
 
    if (g_LogOpened)
    {
        ShowMessages("log was opened previously, you have the close it first "
                     "(using .logclose)\n");
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove .logopen from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Try to open it as file
    //
    g_LogOpenFile.open(Command.c_str());
 
    //
    // Check if it's okay
    //
    if (g_LogOpenFile.is_open())
    {
        //
        // Start intercepting logs
        //
        g_LogOpened = TRUE;
 
        //
        // Enable save to the file (Message + time)
        //
        time_t    t  = time(NULL);
        struct tm tm = *localtime(&t);
 
        ShowMessages("save commands and results into file : %s (%d-%02d-%02d "
                     "%02d:%02d:%02d)\n",
                     Command.c_str(),
                     tm.tm_year + 1900,
                     tm.tm_mon + 1,
                     tm.tm_mday,
                     tm.tm_hour,
                     tm.tm_min,
                     tm.tm_sec);
    }
    else
    {
        ShowMessages("unable to open file : %s\n", Command.c_str());
        return;
    }
}

◆ CommandMeasure()

VOID CommandMeasure	(	vector< string >	SplitCommand,
		string	Command )

!measure command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOLEAN DefaultMode = FALSE;
 
    if (SplitCommand.size() >= 3)
    {
        ShowMessages("incorrect use of the '!measure'\n\n");
        CommandMeasureHelp();
        return;
    }
 
    if (SplitCommand.size() == 2 && SplitCommand.at(1).compare("default"))
    {
        ShowMessages("incorrect use of the '!measure'\n\n");
        CommandMeasureHelp();
        return;
    }
    else if (SplitCommand.size() == 2 &&
             !SplitCommand.at(1).compare("default"))
    {
        DefaultMode = TRUE;
    }
 
    //
    // Check if debugger is loaded or not
    //
    if (g_DeviceHandle && !DefaultMode)
    {
        ShowMessages(
            "Debugger is loaded and your machine is already in a hypervisor, you "
            "should measure the times before 'load'-ing the debugger, please "
            "'unload' the debugger and use '!measure' again or use '!measure "
            "default' to use hardcoded measurements\n");
        return;
    }
 
    if (!DefaultMode)
    {
        if (TransparentModeCheckHypervisorPresence(
                &g_CpuidAverage,
                &g_CpuidStandardDeviation,
                &g_CpuidMedian))
        {
            ShowMessages(
                "we detected that there is a hypervisor, on your system, it "
                "leads to wrong measurement results for our transparent-mode, please "
                "make sure that you're not in a hypervisor then measure the result "
                "again; otherwise the transparent-mode will not work but you can use "
                "'!measure default' to use the hardcoded measurements !\n\n");
 
            return;
        }
 
        if (TransparentModeCheckRdtscpVmexit(
                &g_RdtscAverage,
                &g_RdtscStandardDeviation,
                &g_RdtscMedian))
        {
            ShowMessages(
                "we detected that there is a hypervisor, on your system, it "
                "leads to wrong measurement results for our transparent-mode, please "
                "make sure that you're not in a hypervisor then measure the result "
                "again; otherwise the transparent-mode will not work but you can use "
                "'!measure default' to use the hardcoded measurements !\n\n");
 
            return;
        }
    }
    else
    {
        //
        // It's a default mode
        //
 
        //
        // Default values for cpuid
        //
        g_CpuidAverage           = 0x5f;
        g_CpuidStandardDeviation = 0x10;
        g_CpuidMedian            = 0x5f;
 
        //
        // Default values for rdtsc/p
        //
        g_RdtscAverage           = 0x16;
        g_RdtscStandardDeviation = 0x5;
        g_RdtscMedian            = 0x16;
    }
 
    ShowMessages("the measurements were successful\nyou can use the '!hide' command now\n");
 
    //
    // Indicate that the measurements was successful
    //
    g_TransparentResultsMeasured = TRUE;
}

◆ CommandMode()

VOID CommandMode	(	vector< string >	SplitCommand,
		string	Command )

!mode command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
    BOOLEAN                            SetMode                = FALSE;
    DEBUGGER_EVENT_MODE_TYPE           TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_INVALID;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            TRAP_EXECUTION_MODE_CHANGED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check here to make sure that the user didn't specified the calling stages for this mode change execution trap
    //
    if (Event->EventStage != VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION)
    {
        ShowMessages("the utilization of 'post' or 'all' event calling stages is not meaningful "
                     "for the mode (user-mode/kernel-mode) change traps; therefore, this command does not support them\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check for size
    //
    if (SplitCommand.size() > 2)
    {
        ShowMessages("incorrect use of the '!mode'\n");
        CommandModeHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!mode"))
        {
            continue;
        }
        else if (!Section.compare("u") && !SetMode)
        {
            TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_USER_MODE;
            SetMode                = TRUE;
        }
        else if (!Section.compare("k") && !SetMode)
        {
            TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE;
            SetMode                = TRUE;
        }
        else if ((!Section.compare("uk") || !Section.compare("ku")) && !SetMode)
        {
            TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_USER_MODE_AND_KERNEL_MODE;
            SetMode                = TRUE;
        }
        else
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         Section.c_str());
 
            CommandModeHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        }
    }
 
    //
    // Check if user specified the execution mode or not
    //
    if (!SetMode)
    {
        ShowMessages("please specify the mode(s) that you want to intercept their execution (u, k, ku)\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check if user specified the process id or not
    //
    if (Event->ProcessId == DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES)
    {
        ShowMessages("this event only applies to the selected process(es). please specify "
                     "the 'pid' or the process id of the target process that you want to trap its execution\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the first parameter to the required execution mode
    //
    Event->Options.OptionalParam1 = (UINT64)TargetInterceptionMode;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandMonitor()

VOID CommandMonitor	(	vector< string >	SplitCommand,
		string	Command )

!monitor command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT32                             HookLength                  = 0;
    UINT64                             OptionalParam1              = 0; // Set the 'from' target address
    UINT64                             OptionalParam2              = 0; // Set the 'to' target address
    BOOLEAN                            SetFrom                     = FALSE;
    BOOLEAN                            SetTo                       = FALSE;
    BOOLEAN                            IsNextLength                = FALSE;
    BOOLEAN                            LengthAlreadySet            = FALSE;
    BOOLEAN                            SetAttributes               = FALSE;
    BOOLEAN                            HookMemoryTypeSet           = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_HOOK_MEMORY_TYPE          HookMemoryType              = DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS; // by default virtual address
    UINT32                             IndexInCommandCaseSensitive = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (SplitCommand.size() < 4)
    {
        ShowMessages("incorrect use of the '!monitor'\n");
        CommandMonitorHelp();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    // We use HIDDEN_HOOK_READ_AND_WRITE here but it might be changed to
    // HIDDEN_HOOK_READ or HIDDEN_HOOK_WRITE or other events it is because
    // we are not sure what kind event the user need
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (!Section.compare("!monitor"))
        {
            continue;
        }
        else if (IsNextLength)
        {
            if (!ConvertStringToUInt32(Section, &HookLength))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
 
            IsNextLength     = FALSE;
            LengthAlreadySet = TRUE;
            SetTo            = TRUE; // No longer need a second address
        }
        else if (!Section.compare("r") && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ;
            SetAttributes    = TRUE;
        }
        else if (!Section.compare("w") && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_WRITE;
            SetAttributes    = TRUE;
        }
        else if (!Section.compare("x") && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if ((!Section.compare("rw") || !Section.compare("wr")) && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ_AND_WRITE;
            SetAttributes    = TRUE;
        }
        else if ((!Section.compare("rx") || !Section.compare("xr")) &&
                 !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ_AND_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if ((!Section.compare("wx") || !Section.compare("xw")) &&
                 !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_WRITE_AND_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if ((!Section.compare("rwx") ||
                  !Section.compare("rxw") ||
                  !Section.compare("wrx") ||
                  !Section.compare("wxr") ||
                  !Section.compare("xrw") ||
                  !Section.compare("xwr")) &&
                 !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if (!Section.compare("l") && !SetTo && !LengthAlreadySet)
        {
            IsNextLength = TRUE;
            continue;
        }
        else if (!Section.compare("va") && !HookMemoryTypeSet)
        {
            HookMemoryType    = DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS;
            HookMemoryTypeSet = TRUE;
            continue;
        }
        else if (!Section.compare("pa") && !HookMemoryTypeSet)
        {
            HookMemoryType    = DEBUGGER_MEMORY_HOOK_PHYSICAL_ADDRESS;
            HookMemoryTypeSet = TRUE;
            continue;
        }
        else
        {
            //
            // It's probably address
            //
            if (!SetFrom)
            {
                if (!SymbolConvertNameOrExprToAddress(
                        SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                        &OptionalParam1))
                {
                    //
                    // couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                    CommandMonitorHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                SetFrom = TRUE;
            }
            else if (!SetTo && !LengthAlreadySet)
            {
                if (!SymbolConvertNameOrExprToAddress(
                        SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                        &OptionalParam2))
                {
                    //
                    // Couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
 
                    CommandMonitorHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                SetTo = TRUE;
            }
            else
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandMonitorHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
        }
    }
 
    //
    // Check  if all parameters are received
    //
    if (!SetFrom || !SetTo)
    {
        ShowMessages("please choose the 'from' or 'to' values or specify the length\n");
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check if user specified the 'l' rather than providing two addresses
    //
    if (LengthAlreadySet)
    {
        //
        // Because when the user specifies length, the last byte should be ignored
        //
        OptionalParam2 = OptionalParam1 + HookLength - 1;
    }
 
    //
    // Check for invalid order of address
    //
    if (OptionalParam1 > OptionalParam2)
    {
        //
        // 'from' is greater than 'to'
        //
        ShowMessages("please choose the 'from' value first, then choose the 'to' "
                     "value\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check if user set the attributes of !monitor or not
    //
    if (!SetAttributes)
    {
        ShowMessages("please specify the attribute(s) that you want to monitor (r, w, x, rw, rx, wx, rwx)\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the optional parameters
    //
    Event->Options.OptionalParam1 = OptionalParam1;
    Event->Options.OptionalParam2 = OptionalParam2;
    Event->Options.OptionalParam3 = HookMemoryType;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandMsrread()

VOID CommandMsrread	(	vector< string >	SplitCommand,
		string	Command )

!msrread command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS;
    BOOLEAN                            GetAddress                  = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            RDMSR_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any), it is because we can use
    // special msr bitmap here
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!msrread") || !Section.compare("!msread"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably an msr
            //
            if (!ConvertStringToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandMsrreadHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandMsrreadHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target msr (if not specific then it means all msrs)
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandMsrwrite()

VOID CommandMsrwrite	(	vector< string >	SplitCommand,
		string	Command )

!msrwrite command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS;
    BOOLEAN                            GetAddress                  = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            WRMSR_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any), it is because we can use
    // special msr bitmap here
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!msrwrite"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably an msr
            //
            if (!ConvertStringToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
                CommandMsrwriteHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
            CommandMsrwriteHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target msr (if not specific then it means all msrs)
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandOutput()

VOID CommandOutput	(	vector< string >	SplitCommand,
		string	Command )

output command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_EVENT_FORWARDING     EventForwardingObject;
    DEBUGGER_EVENT_FORWARDING_TYPE Type;
    DEBUGGER_OUTPUT_SOURCE_STATUS  Status;
    string                         DetailsOfSource;
    UINT32                         IndexToShowList;
    PLIST_ENTRY                    TempList          = 0;
    BOOLEAN                        OutputSourceFound = FALSE;
    HANDLE                         SourceHandle      = INVALID_HANDLE_VALUE;
    SOCKET                         Socket            = NULL;
    HMODULE                        Module            = NULL;
    vector<string>                 SplitCommandCaseSensitive {Split(Command, ' ')};
 
    if (SplitCommand.size() <= 2)
    {
        ShowMessages("incorrect use of the 'output'\n\n");
        CommandOutputHelp();
        return;
    }
 
    //
    // Check if the user needs a list of outputs or not
    //
    if (SplitCommand.size() == 1)
    {
        IndexToShowList = 0;
 
        if (g_OutputSourcesInitialized)
        {
            TempList = &g_OutputSources;
 
            while (&g_OutputSources != TempList->Blink)
            {
                TempList = TempList->Blink;
 
                PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails =
                    CONTAINING_RECORD(TempList, DEBUGGER_EVENT_FORWARDING, OutputSourcesList);
 
                //
                // Increase index
                //
                IndexToShowList++;
 
                string TempStateString = "";
                string TempTypeString  = "";
 
                if (CurrentOutputSourceDetails->State ==
                    EVENT_FORWARDING_STATE_NOT_OPENED)
                {
                    TempStateString = "not opened";
                }
                else if (CurrentOutputSourceDetails->State ==
                         EVENT_FORWARDING_STATE_OPENED)
                {
                    TempStateString = "opened    ";
                }
                else if (CurrentOutputSourceDetails->State ==
                         EVENT_FORWARDING_CLOSED)
                {
                    TempStateString = "closed    ";
                }
 
                if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_NAMEDPIPE)
                {
                    TempTypeString = "namedpipe";
                }
                else if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_FILE)
                {
                    TempTypeString = "file     ";
                }
                else if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_TCP)
                {
                    TempTypeString = "tcp      ";
                }
                else if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_MODULE)
                {
                    TempTypeString = "module   ";
                }
 
                ShowMessages("%x  %s   %s\t%s\n", IndexToShowList, TempTypeString.c_str(), TempStateString.c_str(), CurrentOutputSourceDetails->Name);
            }
        }
        else
        {
            ShowMessages("output forwarding list is empty\n");
        }
 
        return;
    }
 
    //
    // Check if it's a create, open, or close
    //
    if (!SplitCommand.at(1).compare("create"))
    {
        //
        // It's a create
        //
 
        //
        // check if the parameters are okay for a create or not
        //
        if (SplitCommand.size() <= 4)
        {
            ShowMessages("incorrect use of the 'output'\n\n");
            CommandOutputHelp();
            return;
        }
 
        //
        // Check for the type of the output source
        //
        if (!SplitCommand.at(3).compare("file"))
        {
            Type = EVENT_FORWARDING_FILE;
        }
        else if (!SplitCommand.at(3).compare("namedpipe"))
        {
            Type = EVENT_FORWARDING_NAMEDPIPE;
        }
        else if (!SplitCommand.at(3).compare("tcp"))
        {
            Type = EVENT_FORWARDING_TCP;
        }
        else if (!SplitCommand.at(3).compare("module"))
        {
            Type = EVENT_FORWARDING_MODULE;
        }
        else
        {
            ShowMessages("incorrect type near '%s'\n\n",
                         SplitCommand.at(3).c_str());
            CommandOutputHelp();
            return;
        }
 
        //
        // Check to make sure that the name doesn't exceed the maximum character
        //
        if (SplitCommand.at(2).size() >=
            MAXIMUM_CHARACTERS_FOR_EVENT_FORWARDING_NAME)
        {
            ShowMessages("name of the output cannot exceed form %d characters\n\n",
                         MAXIMUM_CHARACTERS_FOR_EVENT_FORWARDING_NAME);
            CommandOutputHelp();
            return;
        }
 
        //
        // Search to see if there is another output source with the
        // same name which we don't want to create two or more output
        // sources with the same name
        //
        if (g_OutputSourcesInitialized)
        {
            TempList = &g_OutputSources;
 
            while (&g_OutputSources != TempList->Flink)
            {
                TempList = TempList->Flink;
 
                PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails =
                    CONTAINING_RECORD(TempList, DEBUGGER_EVENT_FORWARDING, OutputSourcesList);
 
                if (strcmp(CurrentOutputSourceDetails->Name,
                           SplitCommandCaseSensitive.at(2).c_str()) == 0)
                {
                    //
                    // Indicate that we found this item
                    //
                    OutputSourceFound = TRUE;
 
                    //
                    // No need to search through the list anymore
                    //
                    break;
                }
            }
 
            //
            // Check whether the entered name already exists
            //
            if (OutputSourceFound)
            {
                ShowMessages("err, the name you entered, already exists, please choose "
                             "another name\n");
                return;
            }
        }
 
        //
        // try to open the source and get the handle
        //
        DetailsOfSource = Command.substr(Command.find(SplitCommandCaseSensitive.at(3)) +
                                             SplitCommandCaseSensitive.at(3).size() + 1,
                                         Command.size());
 
        SourceHandle = ForwardingCreateOutputSource(Type, DetailsOfSource, &Socket, &Module);
 
        //
        // Check if it's a valid handle or not
        //
        if (SourceHandle == INVALID_HANDLE_VALUE)
        {
            ShowMessages(
                "err, invalid address or cannot open or find the address\n");
            return;
        }
 
        //
        // allocate the buffer for storing the event forwarding details
        //
        EventForwardingObject =
            (PDEBUGGER_EVENT_FORWARDING)malloc(sizeof(DEBUGGER_EVENT_FORWARDING));
 
        if (EventForwardingObject == NULL)
        {
            ShowMessages("err, in allocating memory for event forwarding\n");
            return;
        }
 
        RtlZeroMemory(EventForwardingObject, sizeof(DEBUGGER_EVENT_FORWARDING));
 
        //
        // Set the state
        //
        EventForwardingObject->State = EVENT_FORWARDING_STATE_NOT_OPENED;
 
        //
        // Set the type
        //
        EventForwardingObject->Type = Type;
 
        //
        // Get a new tag
        //
        EventForwardingObject->OutputUniqueTag = ForwardingGetNewOutputSourceTag();
 
        //
        // Set the handle or in the case of TCP, set the socket
        // or if it's a module the set the module handle
        //
        if (Type == EVENT_FORWARDING_TCP)
        {
            EventForwardingObject->Socket = Socket;
        }
        else if (Type == EVENT_FORWARDING_MODULE)
        {
            EventForwardingObject->Module = Module;
 
            //
            // Handle is the function address
            //
            EventForwardingObject->Handle = SourceHandle;
        }
        else
        {
            EventForwardingObject->Handle = SourceHandle;
        }
 
        //
        // Move the name of the output source to the buffer
        //
        strcpy_s(EventForwardingObject->Name, SplitCommandCaseSensitive.at(2).c_str());
 
        //
        // Check if list is initialized or not
        //
        if (!g_OutputSourcesInitialized)
        {
            g_OutputSourcesInitialized = TRUE;
            InitializeListHead(&g_OutputSources);
        }
 
        //
        // Add the source to the trace list
        //
        InsertHeadList(&g_OutputSources,
                       &(EventForwardingObject->OutputSourcesList));
    }
    else if (!SplitCommand.at(1).compare("open"))
    {
        //
        // It's an open
        //
        if (!g_OutputSourcesInitialized)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
 
        //
        // Now we should find the corresponding object in the memory and
        // pass it to the global open functions
        //
        TempList = &g_OutputSources;
 
        while (&g_OutputSources != TempList->Flink)
        {
            TempList = TempList->Flink;
 
            PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails = CONTAINING_RECORD(
                TempList,
                DEBUGGER_EVENT_FORWARDING,
                OutputSourcesList);
 
            if (strcmp(CurrentOutputSourceDetails->Name,
                       SplitCommandCaseSensitive.at(2).c_str()) == 0)
            {
                //
                // Indicate that we found this item
                //
                OutputSourceFound = TRUE;
 
                //
                // Open the output
                //
                Status = ForwardingOpenOutputSource(CurrentOutputSourceDetails);
 
                if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_ALREADY_CLOSED)
                {
                    ShowMessages("err, the name you entered was already closed\n");
                    return;
                }
                else if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_ALREADY_OPENED)
                {
                    ShowMessages("err, the name you entered was already opened\n");
                    return;
                }
                else if (Status !=
                         DEBUGGER_OUTPUT_SOURCE_STATUS_SUCCESSFULLY_OPENED)
                {
                    ShowMessages("err, unable to open the output source\n");
                    return;
                }
 
                //
                // No need to search through the list anymore
                //
                break;
            }
        }
 
        if (!OutputSourceFound)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
    }
    else if (!SplitCommand.at(1).compare("close"))
    {
        //
        // It's a close
        //
        if (!g_OutputSourcesInitialized)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
 
        //
        // Now we should find the corresponding object in the memory and
        // pass it to the global close functions
        //
        TempList = &g_OutputSources;
 
        while (&g_OutputSources != TempList->Flink)
        {
            TempList = TempList->Flink;
 
            PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails = CONTAINING_RECORD(
                TempList,
                DEBUGGER_EVENT_FORWARDING,
                OutputSourcesList);
 
            if (strcmp(CurrentOutputSourceDetails->Name,
                       SplitCommandCaseSensitive.at(2).c_str()) == 0)
            {
                //
                // Indicate that we found this item
                //
                OutputSourceFound = TRUE;
 
                //
                // Close the output if it's not already closed
                //
                Status = ForwardingCloseOutputSource(CurrentOutputSourceDetails);
 
                if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_ALREADY_CLOSED)
                {
                    ShowMessages("err, the name you entered was already closed\n");
                    return;
                }
                else if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_UNKNOWN_ERROR)
                {
                    ShowMessages("err, unable to close the source\n");
                    return;
                }
                else if (Status !=
                         DEBUGGER_OUTPUT_SOURCE_STATUS_SUCCESSFULLY_CLOSED)
                {
                    ShowMessages("err, unable to close the source\n");
                    return;
                }
 
                //
                // No need to search through the list anymore
                //
                break;
            }
        }
 
        if (!OutputSourceFound)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
    }
    else
    {
        //
        // Invalid argument
        //
        ShowMessages("incorrect option at '%s'\n\n", SplitCommand.at(1).c_str());
        CommandOutputHelp();
        return;
    }
}

◆ CommandP()

VOID CommandP	(	vector< string >	SplitCommand,
		string	Command )

handler of p command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32                           StepCount;
    DEBUGGER_REMOTE_STEPPING_REQUEST RequestFormat;
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 1 && SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'p'\n\n");
        CommandPHelp();
        return;
    }
 
    //
    // Set type of request
    //
    RequestFormat = DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER;
 
    //
    // Check if the command has a counter parameter
    //
    if (SplitCommand.size() == 2)
    {
        if (!ConvertStringToUInt32(SplitCommand.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandPHelp();
            return;
        }
    }
    else
    {
        StepCount = 1;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Check if the thread is paused or not
        //
        if (g_ActiveProcessDebuggingState.IsActive && !g_ActiveProcessDebuggingState.IsPaused)
        {
            ShowMessages("the target process is running, use the "
                         "'pause' command or press CTRL+C to pause the process\n");
            return;
        }
 
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (size_t i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            if (g_IsSerialConnectedToRemoteDebuggee)
            {
                //
                // It's stepping over serial connection in kernel debugger
                //
                KdSendStepPacketToDebuggee(RequestFormat);
            }
            else
            {
                //
                // It's stepping over user debugger
                //
                UdSendStepPacketToDebuggee(g_ActiveProcessDebuggingState.ProcessDebuggingToken,
                                           g_ActiveProcessDebuggingState.ThreadId,
                                           RequestFormat);
            }
 
            if (!SplitCommand.at(0).compare("pr"))
            {
                //
                // Show registers
                //
                HyperDbgRegisterShowAll();
 
                if (i != StepCount - 1)
                {
                    ShowMessages("\n");
                }
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, stepping (p) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandPa2va()

VOID CommandPa2va	(	vector< string >	SplitCommand,
		string	Command )

!pa2va command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL                              Status;
    ULONG                             ReturnedLength;
    UINT64                            TargetPa;
    UINT32                            Pid            = 0;
    DEBUGGER_VA2PA_AND_PA2VA_COMMANDS AddressDetails = {0};
    vector<string>                    SplitCommandCaseSensitive {Split(Command, ' ')};
 
    if (SplitCommand.size() == 1 || SplitCommand.size() >= 5 ||
        SplitCommand.size() == 3)
    {
        ShowMessages("incorrect use of the '!pa2va'\n\n");
        CommandPa2vaHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (SplitCommand.size() == 2)
    {
        //
        // It's just a address for current process
        //
        if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(1), &TargetPa))
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n",
                         SplitCommandCaseSensitive.at(1).c_str());
            return;
        }
    }
    else
    {
        //
        // It might be address + pid
        //
        if (!SplitCommand.at(1).compare("pid"))
        {
            if (!ConvertStringToUInt32(SplitCommand.at(2), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(3), &TargetPa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(3).c_str());
                return;
            }
        }
        else if (!SplitCommand.at(2).compare("pid"))
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(1), &TargetPa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(1).c_str());
 
                return;
            }
            if (!ConvertStringToUInt32(SplitCommand.at(3), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
        }
        else
        {
            ShowMessages("incorrect use of the '!pa2va'\n\n");
            CommandPa2vaHelp();
            return;
        }
    }
 
    //
    // Prepare the buffer
    // We use same buffer for input and output
    //
    AddressDetails.PhysicalAddress    = TargetPa;
    AddressDetails.ProcessId          = Pid; // it's null if in debugger mode
    AddressDetails.IsVirtual2Physical = FALSE;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Check to prevent using process id in !pa2va command
        //
        if (Pid != 0)
        {
            ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
            return;
        }
 
        //
        // Send the request over serial kernel debugger
        //
 
        KdSendVa2paAndPa2vaPacketToDebuggee(&AddressDetails);
    }
    else
    {
        AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        if (Pid == 0)
        {
            Pid                      = GetCurrentProcessId();
            AddressDetails.ProcessId = Pid;
        }
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                           // Handle to device
            IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS,  // IO Control Code (IOCTL)
            &AddressDetails,                          // Input Buffer to driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Input buffer length
            &AddressDetails,                          // Output Buffer from driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Length of output
                                                      // buffer in bytes.
            &ReturnedLength,                          // Bytes placed in buffer.
            NULL                                      // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (AddressDetails.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            //
            // Show the results
            //
            ShowMessages("%llx\n", AddressDetails.VirtualAddress);
        }
        else
        {
            //
            // An err occurred, no results
            //
            ShowErrorMessage(AddressDetails.KernelStatus);
        }
    }
}

◆ CommandPagein()

VOID CommandPagein	(	vector< string >	SplitCommand,
		string	Command )

.pagein command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32               Pid               = 0;
    UINT64               Length            = 0;
    UINT64               TargetAddressFrom = NULL;
    UINT64               TargetAddressTo   = NULL;
    BOOLEAN              IsNextProcessId   = FALSE;
    BOOLEAN              IsFirstCommand    = TRUE;
    BOOLEAN              IsNextLength      = FALSE;
    vector<string>       SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32               IndexInCommandCaseSensitive = 0;
    PAGE_FAULT_EXCEPTION PageFaultErrorCode          = {0};
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (SplitCommand.size() == 1)
    {
        //
        // Means that user entered one command without any parameter
        //
        ShowMessages("incorrect use of the '.pagein' command\n\n");
        CommandPageinHelp();
        return;
    }
 
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (IsFirstCommand)
        {
            IsFirstCommand = FALSE;
            continue;
        }
        if (IsNextProcessId == TRUE)
        {
            if (!ConvertStringToUInt32(Section, &Pid))
            {
                ShowMessages("err, you should enter a valid process id\n\n");
                return;
            }
            IsNextProcessId = FALSE;
            continue;
        }
 
        if (IsNextLength == TRUE)
        {
            if (!SymbolConvertNameOrExprToAddress(Section, &Length))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
            IsNextLength = FALSE;
            continue;
        }
 
        if (!Section.compare("l"))
        {
            IsNextLength = TRUE;
            continue;
        }
 
        // if (!Section.compare("pid"))
        // {
        //     IsNextProcessId = TRUE;
        //     continue;
        // }
 
        //
        // Probably it's address or mode string
        //
 
        if (CommandPageinCheckAndInterpretModeString(Section, &PageFaultErrorCode))
        {
            continue;
        }
        else if (TargetAddressFrom == 0)
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                                                  &TargetAddressFrom))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                return;
            }
        }
        else
        {
            //
            // User inserts two address
            //
            ShowMessages("err, incorrect use of the '.pagein' command\n\n");
            CommandPageinHelp();
 
            return;
        }
    }
 
    if (!TargetAddressFrom)
    {
        //
        // User inserts two address
        //
        ShowMessages("err, please enter a valid address\n\n");
 
        return;
    }
 
    if (IsNextLength || IsNextProcessId)
    {
        ShowMessages("incorrect use of the '.pagein' command\n\n");
        CommandPageinHelp();
        return;
    }
 
    //
    // If the user didn't specified a range, then only one page will be
    // paged-in; so we use the same AddressFrom and AddressTo
    //
    if (Length == 0)
    {
        TargetAddressTo = TargetAddressFrom;
    }
    else
    {
        TargetAddressTo = TargetAddressFrom + Length;
    }
 
    //
    // Send the request
    //
    // ShowMessages(".pagin address from: %llx -> to %llx, page-fault code: 0x%x, pid: %x, length: 0x%llx",
    //              TargetAddressFrom,
    //              TargetAddressTo,
    //              PageFaultErrorCode.AsUInt,
    //              Pid,
    //              Length);
 
    //
    // Request the page-in
    //
    CommandPageinRequest(TargetAddressFrom,
                         TargetAddressTo,
                         PageFaultErrorCode,
                         Pid);
}

◆ CommandPause()

VOID CommandPause	(	vector< string >	SplitCommand,
		string	Command )

pause command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the 'pause'\n\n");
        CommandPauseHelp();
        return;
    }
 
    CommandPauseRequest();
}

◆ CommandPe()

VOID CommandPe	(	vector< string >	SplitCommand,
		string	Command )

.pe command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOLEAN Is32Bit = FALSE;
    wstring Filepath;
    BOOLEAN ShowDumpOfSection = FALSE;
 
    if (SplitCommand.size() <= 2)
    {
        ShowMessages("err, incorrect use of the '.pe' command\n\n");
        CommandPeHelp();
        return;
    }
 
    //
    // Check for first option
    //
    if (!SplitCommand.at(1).compare("section"))
    {
        if (SplitCommand.size() == 3)
        {
            ShowMessages("please specify a valid PE file\n\n");
            CommandPeHelp();
            return;
        }
        ShowDumpOfSection = TRUE;
    }
    else if (!SplitCommand.at(1).compare("header"))
    {
        ShowDumpOfSection = FALSE;
    }
    else
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n\n",
                     SplitCommand.at(1).c_str());
        CommandPeHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove .pe from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    if (!ShowDumpOfSection)
    {
        //
        // Remove header + space
        //
        Command.erase(0, 6 + 1);
    }
    else
    {
        //
        // Remove section + space
        //
        Command.erase(0, 7 + 1);
 
        //
        // Remove the string param for section + space
        //
        Command.erase(0, SplitCommand.at(2).size() + 1);
    }
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Convert path to wstring
    //
    StringToWString(Filepath, Command);
 
    //
    // Detect whether PE is 32-bit or 64-bit
    //
    if (!PeIsPE32BitOr64Bit(Filepath.c_str(), &Is32Bit))
    {
        //
        // File was invalid, the error message is shown in the above function
        //
        return;
    }
 
    //
    // Parse PE file
    //
    if (!ShowDumpOfSection)
    {
        PeShowSectionInformationAndDump(Filepath.c_str(), NULL, Is32Bit);
    }
    else
    {
        PeShowSectionInformationAndDump(Filepath.c_str(), SplitCommand.at(2).c_str(), Is32Bit);
    }
}

◆ CommandPmc()

VOID CommandPmc	(	vector< string >	SplitCommand,
		string	Command )

!pmc command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            PMC_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (SplitCommand.size() > 1)
    {
        ShowMessages("incorrect use of the '!pmc'\n");
        CommandPmcHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandPreactivate()

VOID CommandPreactivate	(	vector< string >	SplitCommand,
		string	Command )

preactivate command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL                         Status;
    ULONG                        ReturnedLength;
    DEBUGGER_PREACTIVATE_COMMAND PreactivateRequest = {0};
 
    if (SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'Preactivate'\n\n");
        CommandPreactivateHelp();
        return;
    }
 
    //
    // Set the type of preactivation
    //
    if (!SplitCommand.at(1).compare("mode") || !SplitCommand.at(1).compare("!mode"))
    {
        PreactivateRequest.Type = DEBUGGER_PREACTIVATE_COMMAND_TYPE_MODE;
    }
    else
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     SplitCommand.at(1).c_str());
        return;
    }
 
    AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    //
    // Send IOCTL
    //
    Status = DeviceIoControl(
        g_DeviceHandle,                      // Handle to device
        IOCTL_PREACTIVATE_FUNCTIONALITY,     // IO Control Code (IOCTL)
        &PreactivateRequest,                 // Input Buffer to driver.
        SIZEOF_DEBUGGER_PREACTIVATE_COMMAND, // Input buffer length
        &PreactivateRequest,                 // Output Buffer from driver.
        SIZEOF_DEBUGGER_PREACTIVATE_COMMAND, // Length of output
                                             // buffer in bytes.
        &ReturnedLength,                     // Bytes placed in buffer.
        NULL                                 // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return;
    }
 
    if (PreactivateRequest.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("the requested service is activated successfully!\n");
    }
    else
    {
        //
        // An err occurred, no results
        //
        ShowErrorMessage(PreactivateRequest.KernelStatus);
    }
}

◆ CommandPrealloc()

VOID CommandPrealloc	(	vector< string >	SplitCommand,
		string	Command )

prealloc command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL                      Status;
    ULONG                     ReturnedLength;
    UINT64                    Count;
    DEBUGGER_PREALLOC_COMMAND PreallocRequest = {0};
 
    if (SplitCommand.size() != 3)
    {
        ShowMessages("incorrect use of the 'prealloc'\n\n");
        CommandPreallocHelp();
        return;
    }
 
    //
    // Set the type of pre-allocation
    //
    if (!SplitCommand.at(1).compare("thread-interception"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION;
    }
    else if (!SplitCommand.at(1).compare("monitor") || !SplitCommand.at(1).compare("!monitor"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR;
    }
    else if (!SplitCommand.at(1).compare("epthook") || !SplitCommand.at(1).compare("!epthook"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK;
    }
    else if (!SplitCommand.at(1).compare("epthook2") || !SplitCommand.at(1).compare("!epthook2"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK2;
    }
    else if (!SplitCommand.at(1).compare("regular-event"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_EVENT;
    }
    else if (!SplitCommand.at(1).compare("big-event"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_EVENT;
    }
    else if (!SplitCommand.at(1).compare("regular-safe-buffer"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_SAFE_BUFFER;
    }
    else if (!SplitCommand.at(1).compare("big-safe-buffer"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_SAFE_BUFFER;
    }
    else
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     SplitCommand.at(1).c_str());
        return;
    }
 
    //
    // Get the count of needed pre-allocated buffers
    //
    if (!SymbolConvertNameOrExprToAddress(SplitCommand.at(2), &Count))
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     SplitCommand.at(2).c_str());
        return;
    }
 
    //
    // Set the counter
    //
    PreallocRequest.Count = (UINT32)Count;
 
    AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    //
    // Send IOCTL
    //
    Status = DeviceIoControl(
        g_DeviceHandle,                    // Handle to device
        IOCTL_RESERVE_PRE_ALLOCATED_POOLS, // IO Control Code (IOCTL)
        &PreallocRequest,                  // Input Buffer to driver.
        SIZEOF_DEBUGGER_PREALLOC_COMMAND,  // Input buffer length
        &PreallocRequest,                  // Output Buffer from driver.
        SIZEOF_DEBUGGER_PREALLOC_COMMAND,  // Length of output
                                           // buffer in bytes.
        &ReturnedLength,                   // Bytes placed in buffer.
        NULL                               // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return;
    }
 
    if (PreallocRequest.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("the requested pools are allocated and reserved\n");
    }
    else
    {
        //
        // An err occurred, no results
        //
        ShowErrorMessage(PreallocRequest.KernelStatus);
    }
}

◆ CommandPrint()

VOID CommandPrint	(	vector< string >	SplitCommand,
		string	Command )

handler of print command

Parameters

SplitCommand
Command

Returns: VOID

{
    PVOID  CodeBuffer;
    UINT64 BufferAddress;
    UINT32 BufferLength;
    UINT32 Pointer;
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("incorrect use of the 'print'\n\n");
        CommandPrintHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove print from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Prepend and append 'print(' and ')'
    //
    Command.insert(0, "print(");
    Command.append(");");
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Send over serial
        //
 
        //
        // Run script engine handler
        //
        CodeBuffer = ScriptEngineParseWrapper((char *)Command.c_str(), TRUE);
 
        if (CodeBuffer == NULL)
        {
            //
            // return to show that this item contains an script
            //
            return;
        }
 
        //
        // Print symbols (test)
        //
        // PrintSymbolBufferWrapper(CodeBuffer);
 
        //
        // Set the buffer and length
        //
        BufferAddress = ScriptEngineWrapperGetHead(CodeBuffer);
        BufferLength  = ScriptEngineWrapperGetSize(CodeBuffer);
        Pointer       = ScriptEngineWrapperGetPointer(CodeBuffer);
 
        //
        // Send it to the remote debuggee
        //
        KdSendScriptPacketToDebuggee(BufferAddress, BufferLength, Pointer, FALSE);
 
        //
        // Remove the buffer of script engine interpreted code
        //
        ScriptEngineWrapperRemoveSymbolBuffer(CodeBuffer);
 
        ShowMessages("\n");
    }
    else
    {
        //
        // error
        //
        ShowMessages("err, you're not connected to any debuggee\n");
    }
}

◆ CommandProcess()

VOID CommandProcess	(	vector< string >	SplitCommand,
		string	Command )

.process command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32                               TargetProcessId            = 0;
    UINT64                               TargetProcess              = 0;
    UINT64                               AddressOfActiveProcessHead = 0; // nt!PsActiveProcessHead
    UINT32                               OffsetOfImageFileName      = 0; // nt!_EPROCESS.ImageFileName
    UINT32                               OffsetOfUniqueProcessId    = 0; // nt!_EPROCESS.UniqueProcessId
    UINT32                               OffsetOfActiveProcessLinks = 0; // nt!_EPROCESS.ActiveProcessLinks
    BOOLEAN                              ResultOfGettingOffsets     = FALSE;
    BOOLEAN                              IsSetByClkIntr             = FALSE;
    DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededItems     = {0};
 
    if (SplitCommand.size() >= 4)
    {
        ShowMessages("incorrect use of the '.process'\n\n");
        CommandProcessHelp();
        return;
    }
 
    if (SplitCommand.size() == 1)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Get the process details in VMI mode
            //
            ObjectShowProcessesOrThreadDetails(TRUE);
        }
        else
        {
            //
            // Send the packet to get current process
            //
            KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS,
                                                NULL,
                                                NULL,
                                                FALSE,
                                                NULL);
        }
    }
    else if (SplitCommand.size() == 2)
    {
        if (!SplitCommand.at(1).compare("list"))
        {
            //
            // Query for nt!_EPROCESS.ImageFileName, nt!_EPROCESS.UniqueProcessId,
            // nt!_EPROCESS.UniqueProcessId offset from the top of nt!_EPROCESS,
            // and nt!PsActiveProcessHead address and check if we find them or not,
            // otherwise, it means that the PDB for ntoskrnl.exe is not available
            //
            if (ScriptEngineGetFieldOffsetWrapper((CHAR *)"nt!_EPROCESS", (CHAR *)"ActiveProcessLinks", &OffsetOfActiveProcessLinks) &&
                ScriptEngineGetFieldOffsetWrapper((CHAR *)"nt!_EPROCESS", (CHAR *)"ImageFileName", &OffsetOfImageFileName) &&
                ScriptEngineGetFieldOffsetWrapper((CHAR *)"nt!_EPROCESS", (CHAR *)"UniqueProcessId", &OffsetOfUniqueProcessId) &&
                SymbolConvertNameOrExprToAddress("nt!PsActiveProcessHead", &AddressOfActiveProcessHead))
            {
                //
                // For test offsets and addresses
                //
 
                /*
                ShowMessages("Address of ActiveProcessHead : %llx\n", AddressOfActiveProcessHead);
                ShowMessages("Offset Of ActiveProcessLinks : 0x%x\n", OffsetOfActiveProcessLinks);
                ShowMessages("Offset Of ImageFileName : 0x%x\n", OffsetOfImageFileName);
                ShowMessages("Offset Of UniqueProcessId : 0x%x\n", OffsetOfUniqueProcessId);
                */
 
                ProcessListNeededItems.PsActiveProcessHead      = AddressOfActiveProcessHead;
                ProcessListNeededItems.ActiveProcessLinksOffset = OffsetOfActiveProcessLinks;
                ProcessListNeededItems.ImageFileNameOffset      = OffsetOfImageFileName;
                ProcessListNeededItems.UniquePidOffset          = OffsetOfUniqueProcessId;
 
                if (!g_IsSerialConnectedToRemoteDebuggee)
                {
                    //
                    // Get list of processes in VMI mode
                    //
                    ObjectShowProcessesOrThreadList(TRUE,
                                                    &ProcessListNeededItems,
                                                    NULL,
                                                    NULL);
                }
                else
                {
                    //
                    // Send the packet to show list of process
                    //
                    KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST,
                                                        NULL,
                                                        NULL,
                                                        FALSE,
                                                        &ProcessListNeededItems);
                }
            }
            else
            {
                ShowMessages("err, the need offset to iterate over processes not found, "
                             "make sure to load ntoskrnl.exe's PDB file. use '.help .sym' for "
                             "more information\n");
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                SplitCommand.at(1).c_str());
            CommandProcessHelp();
            return;
        }
    }
    else if (SplitCommand.size() == 3)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            ShowMessages("err, you're not connected to any debuggee in Debugger Mode, "
                         "you can use the '.attach', or the '.detach' commands if you're "
                         "operating in VMI Mode\n");
            return;
        }
 
        if (!SplitCommand.at(1).compare("pid"))
        {
            if (!ConvertStringToUInt32(SplitCommand.at(2), &TargetProcessId))
            {
                ShowMessages(
                    "please specify a correct hex value for the process id that you "
                    "want to operate on it\n\n");
                CommandProcessHelp();
                return;
            }
        }
        else if (!SplitCommand.at(1).compare("process"))
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommand.at(2), &TargetProcess))
            {
                ShowMessages(
                    "please specify a correct hex value for the process (nt!_EPROCESS) that you "
                    "want to operate on it\n\n");
                CommandProcessHelp();
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                SplitCommand.at(2).c_str());
            CommandProcessHelp();
            return;
        }
 
        //
        // Check for switching method
        //
        if (!SplitCommand.at(0).compare(".process2"))
        {
            IsSetByClkIntr = FALSE;
        }
        else
        {
            IsSetByClkIntr = TRUE;
        }
 
        //
        // Send the packet to change process
        //
        KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH,
                                            TargetProcessId,
                                            TargetProcess,
                                            IsSetByClkIntr,
                                            NULL);
    }
    else
    {
        ShowMessages("invalid parameter\n\n");
        CommandProcessHelp();
        return;
    }
}

◆ CommandPte()

VOID CommandPte	(	vector< string >	SplitCommand,
		string	Command )

!pte command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL                                     Status;
    ULONG                                    ReturnedLength;
    UINT64                                   TargetVa;
    UINT32                                   Pid            = 0;
    DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS AddressDetails = {0};
    vector<string>                           SplitCommandCaseSensitive {Split(Command, ' ')};
 
    if (SplitCommand.size() == 1 || SplitCommand.size() >= 5 ||
        SplitCommand.size() == 3)
    {
        ShowMessages("incorrect use of the '!pte'\n\n");
        CommandPteHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (SplitCommand.size() == 2)
    {
        //
        // It's just an address for current process
        //
        if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(1), &TargetVa))
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n",
                         SplitCommandCaseSensitive.at(1).c_str());
            return;
        }
    }
    else
    {
        //
        // It might be address + pid
        //
        if (!SplitCommand.at(1).compare("pid"))
        {
            if (!ConvertStringToUInt32(SplitCommand.at(2), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
 
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(3), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(3).c_str());
                return;
            }
        }
        else if (!SplitCommand.at(2).compare("pid"))
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(1), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             SplitCommandCaseSensitive.at(1).c_str());
                return;
            }
 
            if (!ConvertStringToUInt32(SplitCommand.at(3), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
        }
        else
        {
            ShowMessages("incorrect use of the '!pte'\n\n");
            CommandPteHelp();
            return;
        }
    }
 
    //
    // Prepare the buffer
    // We use same buffer for input and output
    //
    AddressDetails.VirtualAddress = TargetVa;
    AddressDetails.ProcessId      = Pid; // null in debugger mode
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Check to prevent using process id in !pte command
        //
        if (Pid != 0)
        {
            ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
            return;
        }
 
        //
        // Send the request over serial kernel debugger
        //
 
        KdSendPtePacketToDebuggee(&AddressDetails);
    }
    else
    {
        AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        if (Pid == 0)
        {
            Pid                      = GetCurrentProcessId();
            AddressDetails.ProcessId = Pid;
        }
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                                  // Handle to device
            IOCTL_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS,  // IO Control Code (IOCTL)
            &AddressDetails,                                 // Input Buffer to driver.
            SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, // Input buffer length
            &AddressDetails,                                 // Output Buffer from driver.
            SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, // Length of output
                                                             // buffer in bytes.
            &ReturnedLength,                                 // Bytes placed in buffer.
            NULL                                             // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (AddressDetails.KernelStatus != DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            ShowErrorMessage(AddressDetails.KernelStatus);
            return;
        }
 
        //
        // Show the results
        //
        CommandPteShowResults(TargetVa, &AddressDetails);
    }
}

◆ CommandPteShowResults()

VOID CommandPteShowResults	(	UINT64	TargetVa,
		PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS	PteRead )

show results of !pte command

Parameters

TargetVa
PteRead

Returns: VOID

{
    /*
    VA fffff8003abc9370
    PXE at FFFF83C1E0F07F80    PPE at FFFF83C1E0FF0000    PDE at
    FFFF83C1FE000EA8    PTE at FFFF83FC001D5E48 contains 0000000004108063
    contains 0000000004109063  contains 00000000026008E3  contains
    0000000000000000 pfn 4108      ---DA--KWEV  pfn 4109      ---DA--KWEV  pfn
    2600      --LDA--KWEV  LARGE PAGE pfn 27c9
  */
    ShowMessages("VA %llx\n", TargetVa);
    ShowMessages("PML4E (PXE) at %016llx\tcontains %016llx\nPDPTE (PPE) at "
                 "%016llx\tcontains "
                 "%016llx\nPDE at %016llx\tcontains %016llx\n",
                 PteRead->Pml4eVirtualAddress,
                 PteRead->Pml4eValue,
                 PteRead->PdpteVirtualAddress,
                 PteRead->PdpteValue,
                 PteRead->PdeVirtualAddress,
                 PteRead->PdeValue);
 
    //
    // Check if it's a large PDE
    //
    if (PteRead->PdeVirtualAddress == PteRead->PteVirtualAddress)
    {
        ShowMessages("PDE is a large page, so it doesn't have a PTE\n");
    }
    else
    {
        ShowMessages("PTE at %016llx\tcontains %016llx\n",
                     PteRead->PteVirtualAddress,
                     PteRead->PteValue);
    }
}

◆ CommandR()

VOID CommandR	(	vector< string >	SplitCommand,
		string	Command )

◆ CommandRdmsr()

VOID CommandRdmsr	(	vector< string >	SplitCommand,
		string	Command )

rdmsr command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL                           Status;
    SIZE_T                         NumCPU;
    DEBUGGER_READ_AND_WRITE_ON_MSR MsrReadRequest;
    ULONG                          ReturnedLength;
    UINT64                         Msr;
    BOOL                           IsNextCoreId   = FALSE;
    BOOL                           SetMsr         = FALSE;
    UINT32                         CoreNumer      = DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES;
    BOOLEAN                        IsFirstCommand = TRUE;
 
    if (SplitCommand.size() >= 5)
    {
        ShowMessages("incorrect use of the 'rdmsr'\n\n");
        CommandRdmsrHelp();
        return;
    }
 
    for (auto Section : SplitCommand)
    {
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextCoreId)
        {
            if (!ConvertStringToUInt32(Section, &CoreNumer))
            {
                ShowMessages("please specify a correct hex value for core id\n\n");
                CommandRdmsrHelp();
                return;
            }
            IsNextCoreId = FALSE;
            continue;
        }
 
        if (!Section.compare("core"))
        {
            IsNextCoreId = TRUE;
            continue;
        }
 
        if (SetMsr || !ConvertStringToUInt64(Section, &Msr))
        {
            ShowMessages("please specify a correct hex value to be read\n\n");
            CommandRdmsrHelp();
            return;
        }
        SetMsr = TRUE;
    }
 
    //
    // Check if msr is set or not
    //
    if (!SetMsr)
    {
        ShowMessages("please specify a correct hex value to be read\n\n");
        CommandRdmsrHelp();
        return;
    }
    if (IsNextCoreId)
    {
        ShowMessages("please specify a correct hex value for core\n\n");
        CommandRdmsrHelp();
        return;
    }
 
    AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    MsrReadRequest.ActionType = DEBUGGER_MSR_READ;
    MsrReadRequest.Msr        = Msr;
    MsrReadRequest.CoreNumber = CoreNumer;
 
    //
    // Find logical cores count
    //
    SIZE_T NumCores = GetWindowsNumaNumberOfCores();
    NumCPU          = NumCores > 0 ? NumCores : GetWindowsCompatibleNumberOfCores();
 
    //
    // allocate buffer for transferring messages
    //
    UINT64 * OutputBuffer = (UINT64 *)malloc(sizeof(UINT64) * NumCPU);
 
    ZeroMemory(OutputBuffer, sizeof(UINT64) * NumCPU);
 
    Status = DeviceIoControl(
        g_DeviceHandle,                        // Handle to device
        IOCTL_DEBUGGER_READ_OR_WRITE_MSR,      // IO Control Code (IOCTL)
        &MsrReadRequest,                       // Input Buffer to driver.
        SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR, // Input buffer length
        OutputBuffer,                          // Output Buffer from driver.
        (DWORD)(sizeof(UINT64) * NumCPU),      // Length of output buffer in bytes.
        &ReturnedLength,                       // Bytes placed in buffer.
        NULL                                   // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code (%x), either msr index or core id is invalid\n",
                     GetLastError());
        free(OutputBuffer);
        return;
    }
 
    //
    // btw, %x is enough, no need to %llx
    //
    if (CoreNumer == DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES)
    {
        //
        // Show all cores
        //
        for (SIZE_T i = 0; i < NumCPU; i++)
        {
            ShowMessages("core : 0x%x - msr[%llx] = %s\n", i, Msr, SeparateTo64BitValue((OutputBuffer[i])).c_str());
        }
    }
    else
    {
        //
        // Show for a single-core
        //
        ShowMessages("core : 0x%x - msr[%llx] = %s\n", CoreNumer, Msr, SeparateTo64BitValue((OutputBuffer[0])).c_str());
    }
 
    //
    // Free the buffer
    //
    free(OutputBuffer);
}

◆ CommandReadMemoryAndDisassembler()

VOID CommandReadMemoryAndDisassembler	(	vector< string >	SplitCommand,
		string	Command )

u* d* !u* !d* commands handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32         Pid             = 0;
    UINT32         Length          = 0;
    UINT64         TargetAddress   = 0;
    BOOLEAN        IsNextProcessId = FALSE;
    BOOLEAN        IsFirstCommand  = TRUE;
    BOOLEAN        IsNextLength    = FALSE;
    vector<string> SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32         IndexInCommandCaseSensitive = 0;
 
    string FirstCommand = SplitCommand.front();
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (SplitCommand.size() == 1)
    {
        //
        // Means that user entered one command without any parameter
        //
        ShowMessages("incorrect use of the '%s' command\n\n", FirstCommand.c_str());
        CommandReadMemoryAndDisassemblerHelp();
        return;
    }
 
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (IsFirstCommand)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextProcessId == TRUE)
        {
            if (!ConvertStringToUInt32(Section, &Pid))
            {
                ShowMessages("err, you should enter a valid process id\n\n");
                return;
            }
            IsNextProcessId = FALSE;
            continue;
        }
 
        if (IsNextLength == TRUE)
        {
            if (!ConvertStringToUInt32(Section, &Length))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
            IsNextLength = FALSE;
            continue;
        }
 
        if (!Section.compare("l"))
        {
            IsNextLength = TRUE;
            continue;
        }
 
        if (!Section.compare("pid"))
        {
            IsNextProcessId = TRUE;
            continue;
        }
 
        //
        // Probably it's address
        //
        if (TargetAddress == 0)
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1),
                                                  &TargetAddress))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                return;
            }
        }
        else
        {
            //
            // User inserts two address
            //
            ShowMessages("err, incorrect use of the '%s' command\n\n",
                         FirstCommand.c_str());
            CommandReadMemoryAndDisassemblerHelp();
 
            return;
        }
    }
 
    if (!TargetAddress)
    {
        //
        // User inserts two address
        //
        ShowMessages("err, please enter a valid address\n\n");
 
        return;
    }
 
    if (Length == 0)
    {
        //
        // Default length (user doesn't specified)
        //
        if (!FirstCommand.compare("u") ||
            !FirstCommand.compare("!u") ||
            !FirstCommand.compare("u64") ||
            !FirstCommand.compare("!u64"))
        {
            Length = 0x40;
        }
        else
        {
            Length = 0x80;
        }
    }
 
    if (IsNextLength || IsNextProcessId)
    {
        ShowMessages("incorrect use of the '%s' command\n\n", FirstCommand.c_str());
        CommandReadMemoryAndDisassemblerHelp();
        return;
    }
 
    //
    // Check to prevent using process id in d* and u* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && Pid != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    if (Pid == 0)
    {
        //
        // Default process we read from current process
        //
        Pid = GetCurrentProcessId();
    }
 
    if (!FirstCommand.compare("db"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DB,
                                         TargetAddress,
                                         DEBUGGER_READ_VIRTUAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
    else if (!FirstCommand.compare("dc"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DC,
                                         TargetAddress,
                                         DEBUGGER_READ_VIRTUAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
    else if (!FirstCommand.compare("dd"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DD,
                                         TargetAddress,
                                         DEBUGGER_READ_VIRTUAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
    else if (!FirstCommand.compare("dq"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DQ,
                                         TargetAddress,
                                         DEBUGGER_READ_VIRTUAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
    else if (!FirstCommand.compare("!db"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DB,
                                         TargetAddress,
                                         DEBUGGER_READ_PHYSICAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
    else if (!FirstCommand.compare("!dc"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DC,
                                         TargetAddress,
                                         DEBUGGER_READ_PHYSICAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
    else if (!FirstCommand.compare("!dd"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DD,
                                         TargetAddress,
                                         DEBUGGER_READ_PHYSICAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
    else if (!FirstCommand.compare("!dq"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DQ,
                                         TargetAddress,
                                         DEBUGGER_READ_PHYSICAL_ADDRESS,
                                         READ_FROM_KERNEL,
                                         Pid,
                                         Length,
                                         NULL);
    }
 
    //
    // Disassembler (!u or u or u2 !u2)
    //
    else if (!FirstCommand.compare("u") || !FirstCommand.compare("u64"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE64,
            TargetAddress,
            DEBUGGER_READ_VIRTUAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
    else if (!FirstCommand.compare("!u") || !FirstCommand.compare("!u64"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE64,
            TargetAddress,
            DEBUGGER_READ_PHYSICAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
    else if (!FirstCommand.compare("u2") || !FirstCommand.compare("u32"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE32,
            TargetAddress,
            DEBUGGER_READ_VIRTUAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
    else if (!FirstCommand.compare("!u2") || !FirstCommand.compare("!u32"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE32,
            TargetAddress,
            DEBUGGER_READ_PHYSICAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
}

◆ CommandRestart()

VOID CommandRestart	(	vector< string >	SplitCommand,
		string	Command )

.restart command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the '.restart'\n\n");
        CommandRestartHelp();
        return;
    }
 
    //
    // Check if the .start command is previously called or not
    //
    if (g_StartCommandPath.empty())
    {
        ShowMessages("nothing to restart, did you use the '.start' command before?\n");
        return;
    }
 
    //
    // Check to kill the current active process (if exists)
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // kill the process, we will restart the process even if we didn't
        // successfully killed the active process
        //
        UdKillProcess(g_ActiveProcessDebuggingState.ProcessId);
    }
    else if (g_ProcessIdOfLatestStartingProcess != NULL)
    {
        UdKillProcess(g_ProcessIdOfLatestStartingProcess);
 
        //
        // No longer the last process exists
        //
        g_ProcessIdOfLatestStartingProcess = NULL;
    }
 
    //
    // Perform run of the target file
    //
    if (g_StartCommandPathAndArguments.empty())
    {
        UdAttachToProcess(NULL,
                          g_StartCommandPath.c_str(),
                          NULL,
                          FALSE);
    }
    else
    {
        UdAttachToProcess(NULL,
                          g_StartCommandPath.c_str(),
                          (WCHAR *)g_StartCommandPathAndArguments.c_str(),
                          FALSE);
    }
}

◆ CommandRev()

VOID CommandRev	(	vector< string >	SplitCommand,
		string	Command )

!rev command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    /*
    vector<string> PathAndArgs;
    string         Arguments = "";
 
    //
    // Disable user-mode debugger in this version
    //
#if ActivateUserModeDebugger == FALSE
 
    if (!g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("the user-mode debugger in VMI Mode is still in the beta version and not stable. "
                     "we decided to exclude it from this release and release it in future versions. "
                     "if you want to test the user-mode debugger in VMI Mode, you should build "
                     "HyperDbg with special instructions. But starting processes is fully supported "
                     "in the Debugger Mode.\n"
                     "(it's not recommended to use it in VMI Mode yet!)\n");
        return;
    }
 
#endif // !ActivateUserModeDebugger
 
    if (SplitCommand.size() <= 2)
    {
        ShowMessages("incorrect use of the '.start'\n\n");
        CommandStartHelp();
        return;
    }
 
 
    if (!SplitCommand.at(1).compare("path"))
    {
        //
        // *** It's a run of target PE file ***
        //
 
        //
        // Trim the command
        //
        Trim(Command);
 
        //
        // Remove !rev from it
        //
        Command.erase(0, SplitCommand.at(0).size());
 
        //
        // Remove path + space
        //
        Command.erase(0, 4 + 1);
 
        //
        // Trim it again
        //
        Trim(Command);
 
        //
        // Split Path and args
        //
        SplitPathAndArgs(PathAndArgs, Command);
 
        //
        // Convert path to wstring
        //
        StringToWString(g_StartCommandPath, PathAndArgs.at(0));
 
        if (PathAndArgs.size() != 1)
        {
            //
            // There are arguments to this command
            //
 
            for (auto item : PathAndArgs)
            {
                //
                // Append the arguments
                //
                // ShowMessages("Arg : %s\n", item.c_str());
                Arguments += item + " ";
            }
 
            //
            // Remove the latest space
            //
            Arguments.pop_back();
 
            //
            // Convert arguments to wstring
            //
            StringToWString(g_StartCommandPathAndArguments, Arguments);
        }
    }
    else
    {
        ShowMessages("err, couldn't resolve error at '%s'\n\n",
                     SplitCommand.at(1).c_str());
        CommandStartHelp();
        return;
    }
 
    //
    // Perform run of the target file
    //
    if (Arguments.empty())
    {
        UdAttachToProcess(NULL,
                          g_StartCommandPath.c_str(),
                          NULL,
                          TRUE);
    }
    else
    {
        UdAttachToProcess(NULL,
                          g_StartCommandPath.c_str(),
                          (WCHAR *)g_StartCommandPathAndArguments.c_str(),
                          TRUE);
    }
 
    return;
 
    */
 
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST RevRequest         = {0};
    BOOLEAN                                      SetPid             = FALSE;
    UINT32                                       TargetPid          = NULL;
    BOOLEAN                                      IgnoreFirstCommand = TRUE;
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE    Mode               = REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN;
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE    Type               = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN;
 
    //
    // Interpret command specific details
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!rev") && IgnoreFirstCommand)
        {
            IgnoreFirstCommand = FALSE;
            continue;
        }
        else if (!Section.compare("pid") && !SetPid)
        {
            SetPid = TRUE;
        }
        else if (SetPid)
        {
            if (!ConvertStringToUInt32(Section, &TargetPid))
            {
                //
                // couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             Section.c_str());
                CommandRevHelp();
                return;
            }
            SetPid = FALSE;
        }
        else if (!Section.compare("pattern"))
        {
            Type = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN;
        }
        else if (!Section.compare("reconstruct"))
        {
            Type = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT;
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         Section.c_str());
            CommandRevHelp();
            return;
        }
    }
 
    if (SetPid)
    {
        ShowMessages("err, please enter a valid process id in hex format, "
                     "or if you want to use it in decimal format, add '0n' "
                     "prefix to the number\n");
        return;
    }
 
    RevRequest.ProcessId = TargetPid;
 
    // ================================================================================
 
    //
    // Send the request to the hypervisor (kernel)
    //
    RevRequestService(&RevRequest);
}

◆ CommandScript()

VOID CommandScript	(	vector< string >	SplitCommand,
		string	Command )

.script command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    vector<string> PathAndArgs;
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("please specify a file\n");
        CommandScriptHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove .script from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Split Path and args
    //
    SplitPathAndArgs(PathAndArgs, Command);
 
    /*
 
    for (auto item : PathAndArgs)
    {
        //
        // The first argument is the path
        //
        ShowMessages("Arg : %s\n", item.c_str());
    }
 
    */
 
    //
    // Parse the file and the possible arguments
    //
    HyperDbgScriptReadFileAndExecuteCommand(PathAndArgs);
}

◆ CommandSearchMemory()

VOID CommandSearchMemory	(	vector< string >	SplitCommand,
		string	Command )

!s* s* commands handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64                 Address;
    vector<UINT64>         ValuesToEdit;
    BOOL                   SetAddress          = FALSE;
    BOOL                   SetValue            = FALSE;
    BOOL                   SetProcId           = FALSE;
    BOOL                   NextIsProcId        = FALSE;
    BOOL                   SetLength           = FALSE;
    BOOL                   NextIsLength        = FALSE;
    DEBUGGER_SEARCH_MEMORY SearchMemoryRequest = {0};
    UINT64                 Value               = 0;
    UINT64                 Length              = 0;
    UINT32                 ProcId              = 0;
    UINT32                 CountOfValues       = 0;
    UINT32                 FinalSize           = 0;
    UINT64 *               FinalBuffer         = NULL;
    vector<string>         SplitCommandCaseSensitive {Split(Command, ' ')};
    UINT32                 IndexInCommandCaseSensitive = 0;
    BOOLEAN                IsFirstCommand              = TRUE;
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ProcId = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (SplitCommand.size() <= 4)
    {
        ShowMessages("incorrect use of the 's*'\n\n");
        CommandSearchMemoryHelp();
        return;
    }
 
    for (auto Section : SplitCommand)
    {
        IndexInCommandCaseSensitive++;
 
        if (IsFirstCommand == TRUE)
        {
            if (!Section.compare("!sb"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_PHYSICAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_BYTE;
            }
            else if (!Section.compare("!sd"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_PHYSICAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_DWORD;
            }
            else if (!Section.compare("!sq"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_PHYSICAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_QWORD;
            }
            else if (!Section.compare("sb"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_VIRTUAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_BYTE;
            }
            else if (!Section.compare("sd"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_VIRTUAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_DWORD;
            }
            else if (!Section.compare("sq"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_VIRTUAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_QWORD;
            }
            else
            {
                //
                // What's this? :(
                //
                ShowMessages("unknown error happened !\n\n");
                CommandSearchMemoryHelp();
                return;
            }
 
            IsFirstCommand = FALSE;
 
            continue;
        }
 
        if (NextIsProcId)
        {
            //
            // It's a process id
            //
            NextIsProcId = FALSE;
 
            if (!ConvertStringToUInt32(Section, &ProcId))
            {
                ShowMessages("please specify a correct hex process id\n\n");
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the proc id is set, next we should read value
                //
                continue;
            }
        }
 
        if (NextIsLength)
        {
            //
            // It's a length
            //
            NextIsLength = FALSE;
 
            if (!ConvertStringToUInt64(Section, &Length))
            {
                ShowMessages("please specify a correct hex length\n\n");
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the proc id is set, next we should read value
                //
                SetLength = TRUE;
                continue;
            }
        }
 
        //
        // Check if it's a process id or not
        //
        if (!SetProcId && !Section.compare("pid"))
        {
            NextIsProcId = TRUE;
            continue;
        }
 
        //
        // Check if it's a length or not
        //
        if (!SetLength && !Section.compare("l"))
        {
            NextIsLength = TRUE;
            continue;
        }
 
        if (!SetAddress)
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1), &Address))
            {
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             SplitCommandCaseSensitive.at(IndexInCommandCaseSensitive - 1).c_str());
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the address is set, next we should read value
                //
                SetAddress = TRUE;
                continue;
            }
        }
 
        if (SetAddress)
        {
            //
            // Remove the hex notations
            //
            if (Section.rfind("0x", 0) == 0 || Section.rfind("0X", 0) == 0 ||
                Section.rfind("\\x", 0) == 0 || Section.rfind("\\X", 0) == 0)
            {
                Section = Section.erase(0, 2);
            }
            else if (Section.rfind('x', 0) == 0 || Section.rfind('X', 0) == 0)
            {
                Section = Section.erase(0, 1);
            }
            Section.erase(remove(Section.begin(), Section.end(), '`'), Section.end());
 
            //
            // Check if the value is valid based on byte counts
            //
            if (SearchMemoryRequest.ByteSize == SEARCH_BYTE && Section.size() >= 3)
            {
                ShowMessages("please specify a byte (hex) value for 'sb' or '!sb'\n\n");
                return;
            }
            if (SearchMemoryRequest.ByteSize == SEARCH_DWORD && Section.size() >= 9)
            {
                ShowMessages(
                    "please specify a dword (hex) value for 'sd' or '!sd'\n\n");
                return;
            }
            if (SearchMemoryRequest.ByteSize == SEARCH_QWORD &&
                Section.size() >= 17)
            {
                ShowMessages(
                    "please specify a qword (hex) value for 'sq' or '!sq'\n\n");
                return;
            }
 
            //
            // Qword is checked by the following function, no need to double
            // check it above.
            //
            if (!ConvertStringToUInt64(Section, &Value))
            {
                ShowMessages("please specify a correct hex value to search in the "
                             "memory content\n\n");
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Add it to the list
                //
                ValuesToEdit.push_back(Value);
 
                //
                // Keep track of values to modify
                //
                CountOfValues++;
 
                if (!SetValue)
                {
                    //
                    // At least on walue is there
                    //
                    SetValue = TRUE;
                }
                continue;
            }
        }
    }
 
    //
    // Check to prevent using process id in s* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && ProcId != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    if (ProcId == 0)
    {
        ProcId = GetCurrentProcessId();
    }
 
    //
    // Fill the structure
    //
    SearchMemoryRequest.ProcessId       = ProcId;
    SearchMemoryRequest.Address         = Address;
    SearchMemoryRequest.CountOf64Chunks = CountOfValues;
 
    //
    // Check if address and value are set or not
    //
    if (!SetAddress)
    {
        ShowMessages("please specify a correct hex address\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (!SetValue)
    {
        ShowMessages(
            "please specify a correct hex value as the content to search\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (!SetLength)
    {
        ShowMessages("please specify a correct hex value as the length\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (NextIsProcId)
    {
        ShowMessages("please specify a correct hex value as the process id\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (NextIsLength)
    {
        ShowMessages("please specify a correct hex length\n\n");
        CommandSearchMemoryHelp();
        return;
    }
 
    //
    // Now it's time to put everything together in one structure
    //
    FinalSize = (CountOfValues * sizeof(UINT64)) + SIZEOF_DEBUGGER_SEARCH_MEMORY;
 
    //
    // Set the size
    //
    SearchMemoryRequest.FinalStructureSize = FinalSize;
 
    //
    // Set the length
    //
    SearchMemoryRequest.Length = Length;
 
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
    }
 
    //
    // Allocate structure + buffer
    //
    FinalBuffer = (UINT64 *)malloc(FinalSize);
 
    if (!FinalBuffer)
    {
        ShowMessages("unable to allocate memory\n\n");
        return;
    }
 
    //
    // Zero the buffer
    //
    ZeroMemory(FinalBuffer, FinalSize);
 
    //
    // Copy the structure on top of the allocated buffer
    //
    memcpy(FinalBuffer, &SearchMemoryRequest, SIZEOF_DEBUGGER_SEARCH_MEMORY);
 
    //
    // Put the values in 64 bit structures
    //
    std::copy(ValuesToEdit.begin(), ValuesToEdit.end(), (UINT64 *)((UINT64)FinalBuffer + SIZEOF_DEBUGGER_SEARCH_MEMORY));
 
    //
    // Check if it's a connection in debugger mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // The buffer should be sent to the debugger
        //
        KdSendSearchRequestPacketToDebuggee(FinalBuffer, FinalSize);
    }
    else
    {
        //
        // it's a local connection, send the buffer directly
        //
        CommandSearchSendRequest(FinalBuffer, FinalSize);
    }
 
    //
    // Free the buffers
    //
    free(FinalBuffer);
}

◆ CommandSettings()

VOID CommandSettings	(	vector< string >	SplitCommand,
		string	Command )

settings command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() <= 1)
    {
        ShowMessages("incorrect use of the 'settings'\n\n");
        CommandSettingsHelp();
        return;
    }
 
    //
    // Interpret the field name
    //
    if (!SplitCommand.at(1).compare("autounpause"))
    {
        //
        // Handle it locally
        //
        CommandSettingsAutoUpause(SplitCommand);
    }
    else if (!SplitCommand.at(1).compare("syntax"))
    {
        //
        // If it's a remote debugger then we send it to the remote debugger
        //
        if (g_IsConnectedToRemoteDebuggee)
        {
            RemoteConnectionSendCommand(Command.c_str(), (UINT32)Command.length() + 1);
        }
        else
        {
            //
            // If it's a connection over serial or a local debugging then
            // we handle it locally
            //
            CommandSettingsSyntax(SplitCommand);
        }
    }
    else if (!SplitCommand.at(1).compare("autoflush"))
    {
        //
        // If it's a remote debugger then we send it to the remote debugger
        //
        if (g_IsConnectedToRemoteDebuggee)
        {
            RemoteConnectionSendCommand(Command.c_str(), (UINT32)Command.length() + 1);
        }
        else
        {
            //
            // If it's a connection over serial or a local debugging then
            // we handle it locally
            //
            CommandSettingsAutoFlush(SplitCommand);
        }
    }
    else if (!SplitCommand.at(1).compare("addressconversion"))
    {
        //
        // If it's a remote debugger then we send it to the remote debugger
        //
        if (g_IsConnectedToRemoteDebuggee)
        {
            RemoteConnectionSendCommand(Command.c_str(), (UINT32)Command.length() + 1);
        }
        else
        {
            //
            // If it's a connection over serial or a local debugging then
            // we handle it locally
            //
            CommandSettingsAddressConversion(SplitCommand);
        }
    }
    else
    {
        //
        // optionm not found
        //
        ShowMessages("incorrect use of the 'settings', please use 'help settings' "
                     "for more details\n");
        return;
    }
}

◆ CommandSettingsGetValueFromConfigFile()

BOOLEAN CommandSettingsGetValueFromConfigFile	(	std::string	OptionName,
		std::string &	OptionValue )

Gets the setting values from config file.

Parameters

OptionName
OptionValue

Returns: BOOLEAN Shows if the settings is available or not

{
    inipp::Ini<char> Ini;
    WCHAR            ConfigPath[MAX_PATH] = {0};
    std::string      OptionValueFromFile;
 
    //
    // Get config file path
    //
    GetConfigFilePath(ConfigPath);
 
    if (!IsFileExistW(ConfigPath))
    {
        return FALSE;
    }
 
    //
    // Open the file
    //
    ifstream Is(ConfigPath);
 
    //
    // Read config file
    //
    Ini.parse(Is);
 
    //
    // Show config file
    //
    // Ini.generate(std::cout);
 
    inipp::get_value(Ini.sections["DEFAULT"], OptionName, OptionValueFromFile);
 
    Is.close();
 
    if (!OptionValueFromFile.empty())
    {
        OptionValue = OptionValueFromFile;
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

◆ CommandSettingsLoadDefaultValuesFromConfigFile()

VOID CommandSettingsLoadDefaultValuesFromConfigFile ( )

Loads default settings values from config file.

Returns: VOID

{
    string OptionValue;
 
    //
    // *** Set default configurations ***
    //
 
    //
    // Set the assembly syntax
    //
    if (CommandSettingsGetValueFromConfigFile("AsmSyntax", OptionValue))
    {
        //
        // The user tries to set a value as the syntax
        //
        if (!OptionValue.compare("intel"))
        {
            g_DisassemblerSyntax = 1;
        }
        else if (!OptionValue.compare("att") ||
                 !OptionValue.compare("at&t"))
        {
            g_DisassemblerSyntax = 2;
        }
        else if (!OptionValue.compare("masm"))
        {
            g_DisassemblerSyntax = 3;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect assembly syntax settings\n");
        }
    }
 
    //
    // Set the auto unpause
    //
    if (CommandSettingsGetValueFromConfigFile("AutoUnpause", OptionValue))
    {
        if (!OptionValue.compare("on"))
        {
            g_AutoUnpause = TRUE;
        }
        else if (!OptionValue.compare("off"))
        {
            g_AutoUnpause = FALSE;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect auto unpause settings\n");
        }
    }
 
    //
    // Set the auto flush
    //
    if (CommandSettingsGetValueFromConfigFile("AutoFlush", OptionValue))
    {
        if (!OptionValue.compare("on"))
        {
            g_AutoFlush = TRUE;
        }
        else if (!OptionValue.compare("off"))
        {
            g_AutoFlush = FALSE;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect auto flush settings\n");
        }
    }
 
    //
    // Set the address conversion
    //
    if (CommandSettingsGetValueFromConfigFile("AddrConv", OptionValue))
    {
        if (!OptionValue.compare("on"))
        {
            g_AddressConversion = TRUE;
        }
        else if (!OptionValue.compare("off"))
        {
            g_AddressConversion = FALSE;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect address conversion settings\n");
        }
    }
}

◆ CommandSettingsSetValueFromConfigFile()

VOID CommandSettingsSetValueFromConfigFile	(	std::string	OptionName,
		std::string	OptionValue )

Sets the setting values from config file.

Parameters

OptionName
OptionValue

Returns: VOID

{
    inipp::Ini<char> Ini;
    WCHAR            ConfigPath[MAX_PATH] = {0};
 
    //
    // Get config file path
    //
    GetConfigFilePath(ConfigPath);
 
    ifstream Is(ConfigPath);
 
    //
    // Read config file
    //
    Ini.parse(Is);
 
    Is.close();
 
    //
    // Save the config
    //
    Ini.sections["DEFAULT"][OptionName] = OptionValue.c_str();
    Ini.interpolate();
 
    //
    // Test, show the config
    //
    // Ini.generate(std::cout);
 
    //
    // Save the config
    //
    ofstream Os(ConfigPath);
 
    Ini.generate(Os);
 
    Os.close();
}

◆ CommandSleep()

VOID CommandSleep	(	vector< string >	SplitCommand,
		string	Command )

sleep command help

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32 MillisecondsTime = 0;
 
    if (SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 'sleep'\n\n");
        CommandSleepHelp();
        return;
    }
 
    if (!ConvertStringToUInt32(SplitCommand.at(1), &MillisecondsTime))
    {
        ShowMessages(
            "please specify a correct hex value for time (milliseconds)\n\n");
        CommandSleepHelp();
        return;
    }
    Sleep(MillisecondsTime);
}

◆ CommandStart()

VOID CommandStart	(	vector< string >	SplitCommand,
		string	Command )

.start command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    vector<string> PathAndArgs;
    string         Arguments = "";
 
    //
    // Disable user-mode debugger in this version
    //
#if ActivateUserModeDebugger == FALSE
 
    if (!g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("the user-mode debugger in VMI Mode is still in the beta version and not stable. "
                     "we decided to exclude it from this release and release it in future versions. "
                     "if you want to test the user-mode debugger in VMI Mode, you should build "
                     "HyperDbg with special instructions. But starting processes is fully supported "
                     "in the Debugger Mode.\n"
                     "(it's not recommended to use it in VMI Mode yet!)\n");
        return;
    }
 
#endif // !ActivateUserModeDebugger
 
    if (SplitCommand.size() <= 2)
    {
        ShowMessages("incorrect use of the '.start'\n\n");
        CommandStartHelp();
        return;
    }
 
    if (!SplitCommand.at(1).compare("path"))
    {
        //
        // *** It's a run of target PE file ***
        //
 
        //
        // Trim the command
        //
        Trim(Command);
 
        //
        // Remove '.start' or 'start' from it
        //
        Command.erase(0, SplitCommand.at(0).size());
 
        //
        // Remove path + space
        //
        Command.erase(0, 4 + 1);
 
        //
        // Trim it again
        //
        Trim(Command);
 
        //
        // Split Path and args
        //
        SplitPathAndArgs(PathAndArgs, Command);
 
        //
        // Convert path to wstring
        //
        StringToWString(g_StartCommandPath, PathAndArgs.at(0));
 
        if (PathAndArgs.size() != 1)
        {
            //
            // There are arguments to this command
            //
 
            for (auto item : PathAndArgs)
            {
                //
                // Append the arguments
                //
                // ShowMessages("Arg : %s\n", item.c_str());
                Arguments += item + " ";
            }
 
            //
            // Remove the latest space
            //
            Arguments.pop_back();
 
            //
            // Convert arguments to wstring
            //
            StringToWString(g_StartCommandPathAndArguments, Arguments);
        }
    }
    else
    {
        ShowMessages("err, couldn't resolve error at '%s'\n\n",
                     SplitCommand.at(1).c_str());
        CommandStartHelp();
        return;
    }
 
    //
    // Perform run of the target file
    //
    if (Arguments.empty())
    {
        UdAttachToProcess(NULL,
                          g_StartCommandPath.c_str(),
                          NULL,
                          FALSE);
    }
    else
    {
        UdAttachToProcess(NULL,
                          g_StartCommandPath.c_str(),
                          (WCHAR *)g_StartCommandPathAndArguments.c_str(),
                          FALSE);
    }
}

◆ CommandStatus()

VOID CommandStatus	(	vector< string >	SplitCommand,
		string	Command )

.status and status command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 1)
    {
        ShowMessages("incorrect use of the '.status'\n\n");
        CommandStatusHelp();
    }
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Connected to a remote debugger (serial port)
        //
        ShowMessages("remote debugging - debugger ('debugger mode')\n");
    }
    else if (g_IsSerialConnectedToRemoteDebugger)
    {
        //
        // Connected to a remote debuggee (serial port)
        //
        ShowMessages("remote debugging - debuggee ('debugger mode')\n");
    }
    else if (g_IsConnectedToRemoteDebuggee)
    {
        //
        // Connected to a remote debuggee
        //
        ShowMessages("remote debugging ('vmi mode'), ip : %s:%s \n",
                     g_ServerIp.c_str(),
                     g_ServerPort.c_str());
    }
    else if (g_IsConnectedToHyperDbgLocally)
    {
        //
        // Connected to a local system
        //
        ShowMessages("local debugging ('vmi mode')\n");
    }
    else if (g_IsConnectedToRemoteDebugger)
    {
        //
        // It's computer connect to a remote machine (this
        // message shouldn't be showed)
        //
        ShowMessages("a remote debugger connected to this system in ('vmi "
                     "mode'), ip : %s:%s \n",
                     g_ServerIp.c_str(),
                     g_ServerPort.c_str());
    }
    else
    {
        //
        // we never should see this message
        //
        ShowMessages("err, you're not connected to any instance of HyperDbg\n");
    }
}

◆ CommandSwitch()

VOID CommandSwitch	(	vector< string >	SplitCommand,
		string	Command )

.switch command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32 PidOrTid = NULL;
 
    if (SplitCommand.size() > 3 || SplitCommand.size() == 2)
    {
        ShowMessages("incorrect use of the '.switch'\n\n");
        CommandSwitchHelp();
        return;
    }
 
    //
    // .attach and .detach commands are only supported in VMI Mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, the '.switch' command is only usable in VMI Mode, "
                     "you can use the '.process', or the '.thread' "
                     "in Debugger Mode\n");
        return;
    }
 
    //
    // Perform switching or listing the threads
    //
    if (SplitCommand.size() == 1)
    {
        UdShowListActiveDebuggingProcessesAndThreads();
    }
    else if (!SplitCommand.at(1).compare("pid"))
    {
        if (!ConvertStringToUInt32(SplitCommand.at(2), &PidOrTid))
        {
            ShowMessages("please specify a correct hex value for process id\n\n");
            return;
        }
 
        //
        // Switch by pid
        //
        if (UdSetActiveDebuggingThreadByPidOrTid(PidOrTid, FALSE))
        {
            ShowMessages("switched to process id: %x\n", PidOrTid);
        }
    }
    else if (!SplitCommand.at(1).compare("tid"))
    {
        if (!ConvertStringToUInt32(SplitCommand.at(2), &PidOrTid))
        {
            ShowMessages("please specify a correct hex value for thread id\n\n");
            return;
        }
 
        //
        // Switch by tid
        //
        if (UdSetActiveDebuggingThreadByPidOrTid(PidOrTid, TRUE))
        {
            ShowMessages("switched to thread id: %x\n", PidOrTid);
        }
    }
    else
    {
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     SplitCommand.at(1).c_str());
        return;
    }
}

◆ CommandSym()

VOID CommandSym	(	vector< string >	SplitCommand,
		string	Command )

.sym command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64 BaseAddress   = NULL;
    UINT32 UserProcessId = NULL;
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("incorrect use of the '.sym'\n\n");
        CommandSymHelp();
        return;
    }
 
    if (!SplitCommand.at(1).compare("table"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // Show symbol table
        //
        SymbolBuildAndShowSymbolTable();
    }
    else if (!SplitCommand.at(1).compare("load") || !SplitCommand.at(1).compare("download"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // Load and download available symbols
        //
        if (!SplitCommand.at(1).compare("load"))
        {
            SymbolLoadOrDownloadSymbols(FALSE, FALSE);
        }
        else if (!SplitCommand.at(1).compare("download"))
        {
            SymbolLoadOrDownloadSymbols(TRUE, FALSE);
        }
    }
    else if (!SplitCommand.at(1).compare("reload"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2 && SplitCommand.size() != 4)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // Check for process id
        //
        if (SplitCommand.size() == 4)
        {
            if (!SplitCommand.at(2).compare("pid"))
            {
                if (!ConvertStringToUInt32(SplitCommand.at(3), &UserProcessId))
                {
                    //
                    // couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 SplitCommand.at(3).c_str());
                    CommandSymHelp();
                    return;
                }
            }
            else
            {
                ShowMessages("incorrect use of the '.sym'\n\n");
                CommandSymHelp();
                return;
            }
        }
 
        //
        // Refresh and reload symbols
        //
        if (g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Update symbol table from remote debuggee in debugger-mode
            //
            SymbolReloadSymbolTableInDebuggerMode(UserProcessId);
        }
        else
        {
            //
            // Check if user explicitly specified the process id
            //
            if (UserProcessId == NULL)
            {
                //
                // User didn't explicitly specified the process id, so
                // if it's a user-debugger process, we use the modules
                // of the target user-debuggee's process, otherwise,
                // the current process (HyperDbg's process) is specified
                //
                if (g_ActiveProcessDebuggingState.IsActive)
                {
                    UserProcessId = g_ActiveProcessDebuggingState.ProcessId;
                }
                else
                {
                    UserProcessId = GetCurrentProcessId();
                }
            }
 
            //
            // Build locally and reload it
            //
            if (SymbolLocalReload(UserProcessId))
            {
                ShowMessages("symbol table updated successfully\n");
            }
        }
    }
    else if (!SplitCommand.at(1).compare("unload"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // unload without any parameters, means that unload
        // all the symbols
        //
        ScriptEngineUnloadAllSymbolsWrapper();
 
        //
        // Size is 3 there is module name (not working ! I don't know why)
        //
        // ScriptEngineUnloadModuleSymbolWrapper((char *)SplitCommand.at(2).c_str());
    }
    else if (!SplitCommand.at(1).compare("add"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() < 6)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        if (!SplitCommand.at(2).compare("base"))
        {
            string Delimiter = "";
            string PathToPdb = "";
            if (!ConvertStringToUInt64(SplitCommand.at(3), &BaseAddress))
            {
                ShowMessages("please add a valid hex address to be used as the base address\n\n");
                CommandSymHelp();
                return;
            }
 
            //
            // Base address is now valid, check if next parameter is path
            //
            if (SplitCommand.at(4).compare("path"))
            {
                ShowMessages("incorrect use of the '.sym'\n\n");
                CommandSymHelp();
                return;
            }
 
            //
            // The rest of command is pdb path
            //
            Delimiter = "path ";
            PathToPdb = Command.substr(Command.find(Delimiter) + 5, Command.size());
 
            //
            // Check if pdb file exists or not
            //
            if (!IsFileExistA(PathToPdb.c_str()))
            {
                ShowMessages("pdb file not found\n");
                return;
            }
 
            ShowMessages("loading module symbol at '%s'\n", PathToPdb.c_str());
 
            //
            // Load the pdb file (the validation of pdb file is checked into pdb
            // parsing functions)
            //
            ScriptEngineLoadFileSymbolWrapper(BaseAddress, PathToPdb.c_str(), NULL);
        }
        else
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
    }
    else
    {
        ShowMessages("unknown parameter at '%s'\n\n", SplitCommand.at(1).c_str());
        CommandSymHelp();
        return;
    }
}

◆ CommandSympath()

VOID CommandSympath	(	vector< string >	SplitCommand,
		string	Command )

.sympath command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    string SymbolServer = "";
    string Token;
 
    if (SplitCommand.size() == 1)
    {
        //
        // Show the current symbol path
        //
        if (!CommandSettingsGetValueFromConfigFile("SymbolServer", SymbolServer))
        {
            ShowMessages("symbol server is not configured, please use '.help .sympath'\n");
        }
        else
        {
            ShowMessages("current symbol server is : %s\n", SymbolServer.c_str());
        }
    }
    else
    {
        //
        // Save the symbol path
        //
 
        //
        // Trim the command
        //
        Trim(Command);
 
        //
        // Remove .sympath from it
        //
        Command.erase(0, SplitCommand.at(0).size());
 
        //
        // Trim it again
        //
        Trim(Command);
 
        //
        // *** validate the symbols ***
        //
 
        //
        // Check if the string contains '*'
        //
        char Delimiter = '*';
        if (Command.find(Delimiter) != std::string::npos)
        {
            //
            // Found
            //
            Token = Command.substr(0, Command.find(Delimiter));
            // using transform() function and ::tolower in STL
            transform(Token.begin(), Token.end(), Token.begin(), ::tolower);
 
            //
            // Check if it starts with srv
            //
            if (!Token.compare("srv"))
            {
                //
                // Save the config
                //
                CommandSettingsSetValueFromConfigFile("SymbolServer", Command);
 
                //
                // Show the message
                //
                ShowMessages("symbol server/path is configured successfully\n");
                ShowMessages("use '.sym load', '.sym reload', or '.sym download' to load pdb files\n");
            }
            else
            {
                ShowMessages("symbol path is invalid\n\n");
                CommandSympathHelp();
                return;
            }
        }
        else
        {
            ShowMessages("symbol path is invalid\n\n");
            CommandSympathHelp();
            return;
        }
    }
}

◆ CommandSyscallAndSysret()

VOID CommandSyscallAndSysret	(	vector< string >	SplitCommand,
		string	Command )

!syscall, !syscall2 and !sysret, !sysret2 commands handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_SYSCALL_ALL_SYSRET_OR_SYSCALLS;
    BOOLEAN                            GetSyscallNumber            = FALSE;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
    string                             Cmd;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    Cmd = SplitCommand.at(0);
    if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
    {
        if (!InterpretGeneralEventAndActionsFields(
                &SplitCommand,
                &SplitCommandCaseSensitive,
                SYSCALL_HOOK_EFER_SYSCALL,
                &Event,
                &EventLength,
                &ActionBreakToDebugger,
                &ActionBreakToDebuggerLength,
                &ActionCustomCode,
                &ActionCustomCodeLength,
                &ActionScript,
                &ActionScriptLength,
                &EventParsingErrorCause))
        {
            return;
        }
    }
    else
    {
        if (!InterpretGeneralEventAndActionsFields(
                &SplitCommand,
                &SplitCommandCaseSensitive,
                SYSCALL_HOOK_EFER_SYSRET,
                &Event,
                &EventLength,
                &ActionBreakToDebugger,
                &ActionBreakToDebuggerLength,
                &ActionCustomCode,
                &ActionCustomCodeLength,
                &ActionScript,
                &ActionScriptLength,
                &EventParsingErrorCause))
        {
            return;
        }
    }
 
    //
    // Interpret command specific details (if any)
    //
 
    //
    // Currently we do not support any extra argument for !sysret command
    // it is because we don't know how to find syscall number in sysret
    // and we don't wanna deal with dynamic mapping of rcx (user stack)
    // in vmx-root
    //
    if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
    {
        for (auto Section : SplitCommand)
        {
            if (!Section.compare("!syscall") ||
                !Section.compare("!syscall2") ||
                !Section.compare("!sysret") ||
                !Section.compare("!sysret2"))
            {
                continue;
            }
 
            else if (!GetSyscallNumber)
            {
                //
                // It's probably a syscall address
                //
                if (!ConvertStringToUInt64(Section, &SpecialTarget))
                {
                    //
                    // Unknown parameter
                    //
                    ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
 
                    if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
                    {
                        CommandSyscallHelp();
                    }
                    else
                    {
                        CommandSysretHelp();
                    }
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                else
                {
                    GetSyscallNumber = TRUE;
                }
            }
            else
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n", Section.c_str());
 
                if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
                {
                    CommandSyscallHelp();
                }
                else
                {
                    CommandSysretHelp();
                }
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
        }
 
        //
        // Set the target syscall
        //
        Event->Options.OptionalParam1 = SpecialTarget;
    }
 
    //
    // Set whether it's !syscall or !syscall2 or !sysret or !sysret2
    //
    if (!Cmd.compare("!syscall2") || !Cmd.compare("!sysret2"))
    {
        //
        // It's a !syscall2 or !sysret2
        //
        Event->Options.OptionalParam2 = DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD;
    }
    else
    {
        //
        // It's a !syscall or !sysret
        //
        Event->Options.OptionalParam2 = DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandT()

VOID CommandT	(	vector< string >	SplitCommand,
		string	Command )

handler of t command

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32                           StepCount;
    DEBUGGER_REMOTE_STEPPING_REQUEST RequestFormat;
 
    //
    // Validate the commands
    //
    if (SplitCommand.size() != 1 && SplitCommand.size() != 2)
    {
        ShowMessages("incorrect use of the 't'\n\n");
        CommandTHelp();
        return;
    }
 
    //
    // Set type of step
    //
    RequestFormat = DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_IN;
 
    //
    // Check if the command has a counter parameter
    //
    if (SplitCommand.size() == 2)
    {
        if (!ConvertStringToUInt32(SplitCommand.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandTHelp();
            return;
        }
    }
    else
    {
        StepCount = 1;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Check if the thread is paused or not
        //
        if (g_ActiveProcessDebuggingState.IsActive && !g_ActiveProcessDebuggingState.IsPaused)
        {
            ShowMessages("the target process is running, use the "
                         "'pause' command or press CTRL+C to pause the process\n");
            return;
        }
 
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (size_t i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            if (g_IsSerialConnectedToRemoteDebuggee)
            {
                //
                // It's stepping over serial connection in kernel debugger
                //
                KdSendStepPacketToDebuggee(RequestFormat);
            }
            else
            {
                //
                // It's stepping over user debugger
                //
                UdSendStepPacketToDebuggee(g_ActiveProcessDebuggingState.ProcessDebuggingToken,
                                           g_ActiveProcessDebuggingState.ThreadId,
                                           RequestFormat);
            }
 
            if (!SplitCommand.at(0).compare("tr"))
            {
                //
                // Show registers
                //
                HyperDbgRegisterShowAll();
 
                if (i != StepCount - 1)
                {
                    ShowMessages("\n");
                }
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, stepping (t) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandTest()

VOID CommandTest	(	vector< string >	SplitCommand,
		string	Command )

test command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT64 Context = NULL;
 
    if (SplitCommand.size() == 1)
    {
        //
        // For testing functionalities
        //
        CommandTestPerformTest();
    }
    else if (SplitCommand.size() == 2 && !SplitCommand.at(1).compare("query"))
    {
        //
        // Query the state of debuggee in debugger mode
        //
        CommandTestQueryState();
    }
    else if (SplitCommand.size() == 2 && !SplitCommand.at(1).compare("trap-status"))
    {
        //
        // Query the state of trap flag in debugger mode
        //
        CommandTestQueryTrapState();
    }
    else if (SplitCommand.size() == 2 && !SplitCommand.at(1).compare("pool"))
    {
        //
        // Query the state of pre-allocated pools in debugger mode
        //
        CommandTestQueryPreAllocPoolsState();
    }
    else if (SplitCommand.size() == 2 && !SplitCommand.at(1).compare("sync-task"))
    {
        //
        // Send target task to the halted cores in debugger mode (synchronous)
        //
        CommandTestSetTargetTaskToHaltedCores(TRUE);
    }
    else if (SplitCommand.size() == 2 && !SplitCommand.at(1).compare("async-task"))
    {
        //
        // Send target task to the halted cores in debugger mode (asynchronous)
        //
        CommandTestSetTargetTaskToHaltedCores(FALSE);
    }
    else if (SplitCommand.size() == 3 && !SplitCommand.at(1).compare("target-core-task"))
    {
        if (!ConvertStringToUInt64(SplitCommand.at(2), &Context))
        {
            ShowMessages("err, you should enter a valid hex number as the core id\n\n");
            return;
        }
 
        //
        // Send target task to the specific halted core in debugger mode
        //
        CommandTestSetTargetTaskToTargetCore((UINT32)Context);
    }
    else if (SplitCommand.size() == 3 && !SplitCommand.at(1).compare("breakpoint"))
    {
        //
        // Change breakpoint state
        //
        if (!SplitCommand.at(2).compare("on"))
        {
            CommandTestSetBreakpointState(TRUE);
        }
        else if (!SplitCommand.at(2).compare("off"))
        {
            CommandTestSetBreakpointState(FALSE);
        }
        else
        {
            ShowMessages("err, couldn't resolve error at '%s'\n\n", SplitCommand.at(2).c_str());
            return;
        }
    }
    else if (SplitCommand.size() == 3 && !SplitCommand.at(1).compare("trap"))
    {
        //
        // Change debug break state
        //
        if (!SplitCommand.at(2).compare("on"))
        {
            CommandTestSetDebugBreakState(TRUE);
        }
        else if (!SplitCommand.at(2).compare("off"))
        {
            CommandTestSetDebugBreakState(FALSE);
        }
        else
        {
            ShowMessages("err, couldn't resolve error at '%s'\n\n", SplitCommand.at(2).c_str());
            return;
        }
    }
    else
    {
        ShowMessages("incorrect use of the 'test'\n\n");
        CommandTestHelp();
        return;
    }
}

◆ CommandThread()

VOID CommandThread	(	vector< string >	SplitCommand,
		string	Command )

.thread command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    UINT32  TargetThreadId = 0;
    UINT64  TargetThread   = 0;
    UINT64  TargetProcess  = 0;
    BOOLEAN CheckByClkIntr = FALSE;
 
    if (SplitCommand.size() >= 5)
    {
        ShowMessages("incorrect use of the '.thread'\n\n");
        CommandThreadHelp();
        return;
    }
 
    if (SplitCommand.size() == 1)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            ObjectShowProcessesOrThreadDetails(FALSE);
        }
        else
        {
            //
            // Send the packet to get current thread
            //
            KdSendSwitchThreadPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS,
                                               NULL,
                                               NULL,
                                               FALSE,
                                               NULL);
        }
    }
    else if (SplitCommand.size() == 2)
    {
        if (!SplitCommand.at(1).compare("list"))
        {
            //
            // Sending null as the nt!_EPROCESS indicates that the target process is
            // the current process (Current nt!_EPROCESS)
            //
            if (!CommandThreadListThreads(NULL))
            {
                ShowMessages("err, the need offset to iterate over threads not found, "
                             "make sure to load ntoskrnl.exe's PDB file. use '.help .sym' for "
                             "more information\n");
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                SplitCommand.at(1).c_str());
            CommandThreadHelp();
            return;
        }
    }
    else if (SplitCommand.size() == 3)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            ShowMessages("err, you're not connected to any debuggee in Debugger Mode, "
                         "you can use the '.attach', or the '.detach' commands if you're "
                         "operating in VMI Mode\n");
            return;
        }
 
        if (!SplitCommand.at(1).compare("tid"))
        {
            if (!ConvertStringToUInt32(SplitCommand.at(2), &TargetThreadId))
            {
                ShowMessages(
                    "please specify a correct hex value for the thread id that you "
                    "want to operate on it\n\n");
                CommandThreadHelp();
                return;
            }
        }
        else if (!SplitCommand.at(1).compare("thread"))
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommand.at(2), &TargetThread))
            {
                ShowMessages(
                    "please specify a correct hex value for the thread (nt!_ETHREAD) that you "
                    "want to operate on it\n\n");
                CommandThreadHelp();
                return;
            }
        }
        else if (!SplitCommand.at(1).compare("list") && !SplitCommand.at(2).compare("process"))
        {
            ShowMessages(
                "please specify a hex value for the process\n\n");
            CommandThreadHelp();
            return;
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                SplitCommand.at(2).c_str());
            CommandThreadHelp();
            return;
        }
 
        if (!SplitCommand.at(0).compare(".thread2"))
        {
            //
            // Check by changes to gs:[188]
            //
            CheckByClkIntr = FALSE;
        }
        else
        {
            //
            // Check on clock interrupt changes
            //
            CheckByClkIntr = TRUE;
        }
 
        //
        // Send the packet to change the thread
        //
        KdSendSwitchThreadPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH,
                                           TargetThreadId,
                                           TargetThread,
                                           CheckByClkIntr,
                                           NULL);
    }
    else if (SplitCommand.size() == 4)
    {
        if (!SplitCommand.at(1).compare("list"))
        {
            if (!SplitCommand.at(2).compare("process"))
            {
                if (!SymbolConvertNameOrExprToAddress(SplitCommand.at(3), &TargetProcess))
                {
                    ShowMessages(
                        "please specify a correct hex value for the process (nt!_EPROCESS) that you "
                        "want to see its threads\n\n");
                    CommandThreadHelp();
                    return;
                }
 
                //
                // List the target process's threads
                //
                if (!CommandThreadListThreads(TargetProcess))
                {
                    ShowMessages("err, the need offset to iterate over threads not found, "
                                 "make sure to load ntoskrnl.exe's PDB file. use '.help .sym' for "
                                 "more information\n");
                    return;
                }
            }
            else
            {
                ShowMessages(
                    "err, unknown parameter at '%s'\n\n",
                    SplitCommand.at(2).c_str());
                CommandThreadHelp();
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                SplitCommand.at(1).c_str());
            CommandThreadHelp();
            return;
        }
    }
    else
    {
        ShowMessages("invalid parameter\n\n");
        CommandThreadHelp();
        return;
    }
}

◆ CommandTrace()

VOID CommandTrace	(	vector< string >	SplitCommand,
		string	Command )

!trace command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
    BOOLEAN                            SetTraceType = FALSE;
    DEBUGGER_EVENT_TRACE_TYPE          TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_INVALID;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            TRAP_EXECUTION_INSTRUCTION_TRACE,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (SplitCommand.size() > 2)
    {
        ShowMessages("incorrect use of the '!trace'\n");
        CommandTraceHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : SplitCommand)
    {
        if (!Section.compare("!trace"))
        {
            continue;
        }
        else if ((!Section.compare("step-in") || !Section.compare("stepin") || !Section.compare("step")) && !SetTraceType)
        {
            TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_STEP_IN;
            SetTraceType = TRUE;
        }
        else if ((!Section.compare("step-out") || !Section.compare("stepout")) && !SetTraceType)
        {
            TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_STEP_OUT;
            SetTraceType = TRUE;
        }
        else if ((!Section.compare("step-instrument") || !Section.compare("instrument-step") ||
                  !Section.compare("instrumentstep") ||
                  !Section.compare("instrument-step-in")) &&
                 !SetTraceType)
        {
            TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_INSTRUMENTATION_STEP_IN;
            SetTraceType = TRUE;
        }
        else
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         Section.c_str());
 
            CommandTraceHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        }
    }
 
    //
    // Check if user specified the execution mode or not
    //
    if (!SetTraceType)
    {
        ShowMessages("please specify the trace type\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the first parameter to the required trace type
    //
    Event->Options.OptionalParam1 = (UINT64)SetTraceType;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandTrack()

VOID CommandTrack	(	vector< string >	SplitCommand,
		string	Command )

handler of !track command

Parameters

SplitCommand
Command

Returns: VOID

95{

96

◆ CommandTsc()

VOID CommandTsc	(	vector< string >	SplitCommand,
		string	Command )

handler of !tsc command

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            TSC_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (SplitCommand.size() > 1)
    {
        ShowMessages("incorrect use of the '!tsc'\n");
        CommandTscHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandUnhide()

VOID CommandUnhide	(	vector< string >	SplitCommand,
		string	Command )

!unhide command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOLEAN                                     Status;
    ULONG                                       ReturnedLength;
    DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE UnhideRequest = {0};
 
    if (SplitCommand.size() >= 2)
    {
        ShowMessages("incorrect use of the '!unhide'\n\n");
        CommandUnhideHelp();
        return;
    }
 
    //
    // Check if debugger is loaded or not
    //
    AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    //
    // We don't wanna hide the debugger and make transparent vm-exits
    //
    UnhideRequest.IsHide = FALSE;
 
    //
    // Send the request to the kernel
    //
    Status = DeviceIoControl(
        g_DeviceHandle,                                             // Handle to device
        IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER, // IO Control
                                                                    // code
        &UnhideRequest,                                             // Input Buffer to driver.
        SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE,         // Input buffer length
        &UnhideRequest,                                             // Output Buffer from driver.
        SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE,         // Length of output
                                                                    // buffer in bytes.
        &ReturnedLength,                                            // Bytes placed in buffer.
        NULL                                                        // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return;
    }
 
    if (UnhideRequest.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("transparent debugging successfully disabled :)\n");
    }
    else if (UnhideRequest.KernelStatus ==
             DEBUGGER_ERROR_DEBUGGER_ALREADY_UHIDE)
    {
        ShowMessages("debugger is not in transparent-mode\n");
    }
    else
    {
        ShowMessages("unknown error occurred :(\n");
    }
}

◆ CommandUnload()

VOID CommandUnload	(	vector< string >	SplitCommand,
		string	Command )

unload command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() != 2 && SplitCommand.size() != 3)
    {
        ShowMessages("incorrect use of the 'unload'\n\n");
        CommandUnloadHelp();
        return;
    }
 
    //
    // Check for the module
    //
    if ((SplitCommand.size() == 2 && !SplitCommand.at(1).compare("vmm")) || (SplitCommand.size() == 3 && !SplitCommand.at(2).compare("vmm") && !SplitCommand.at(1).compare("remove")))
    {
        if (!g_IsConnectedToHyperDbgLocally)
        {
            ShowMessages("you're not connected to any instance of HyperDbg, did you "
                         "use '.connect'? \n");
            return;
        }
 
        //
        // Check to avoid using this command in debugger-mode
        //
        if (g_IsSerialConnectedToRemoteDebuggee || g_IsSerialConnectedToRemoteDebugger)
        {
            ShowMessages("you're connected to a an instance of HyperDbg, please use "
                         "'.debug close' command\n");
            return;
        }
 
        if (g_IsDebuggerModulesLoaded)
        {
            HyperDbgUnloadVmm();
        }
        else
        {
            ShowMessages("there is nothing to unload\n");
        }
 
        //
        // Check to remove the driver
        //
        if (!SplitCommand.at(1).compare("remove"))
        {
            //
            // Stop the driver
            //
            if (HyperDbgStopVmmDriver())
            {
                ShowMessages("err, failed to stop driver\n");
                return;
            }
 
            //
            // Uninstall the driver
            //
            if (HyperDbgUninstallVmmDriver())
            {
                ShowMessages("err, failed to uninstall the driver\n");
                return;
            }
 
            ShowMessages("the driver is removed\n");
        }
    }
    else
    {
        //
        // Module not found
        //
        ShowMessages("err, module not found\n");
    }
}

◆ CommandVa2pa()

VOID CommandVa2pa	(	vector< string >	SplitCommand,
		string	Command )

!va2pa command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL                              Status;
    ULONG                             ReturnedLength;
    UINT64                            TargetVa;
    UINT32                            Pid            = 0;
    DEBUGGER_VA2PA_AND_PA2VA_COMMANDS AddressDetails = {0};
    vector<string>                    SplitCommandCaseSensitive {Split(Command, ' ')};
 
    if (SplitCommand.size() == 1 || SplitCommand.size() >= 5 ||
        SplitCommand.size() == 3)
    {
        ShowMessages("incorrect use of the '!va2pa'\n\n");
        CommandVa2paHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (SplitCommand.size() == 2)
    {
        //
        // It's just an address for current process
        //
        if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(1), &TargetVa))
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n",
                         SplitCommandCaseSensitive.at(1).c_str());
            return;
        }
    }
    else
    {
        //
        // It might be address + pid
        //
        if (!SplitCommand.at(1).compare("pid"))
        {
            if (!ConvertStringToUInt32(SplitCommand.at(2), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
 
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(3), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(3).c_str());
                return;
            }
        }
        else if (!SplitCommand.at(2).compare("pid"))
        {
            if (!SymbolConvertNameOrExprToAddress(SplitCommandCaseSensitive.at(1), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             SplitCommandCaseSensitive.at(1).c_str());
                return;
            }
 
            if (!ConvertStringToUInt32(SplitCommand.at(3), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
        }
        else
        {
            ShowMessages("incorrect use of the '!va2pa'\n\n");
            CommandVa2paHelp();
            return;
        }
    }
 
    //
    // Prepare the buffer
    // We use same buffer for input and output
    //
    AddressDetails.VirtualAddress     = TargetVa;
    AddressDetails.ProcessId          = Pid; // null in debugger mode
    AddressDetails.IsVirtual2Physical = TRUE;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Check to prevent using process id in !va2pa command
        //
        if (Pid != 0)
        {
            ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
            return;
        }
 
        //
        // Send the request over serial kernel debugger
        //
 
        KdSendVa2paAndPa2vaPacketToDebuggee(&AddressDetails);
    }
    else
    {
        AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        if (Pid == 0)
        {
            Pid                      = GetCurrentProcessId();
            AddressDetails.ProcessId = Pid;
        }
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                           // Handle to device
            IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS,  // IO Control Code (IOCTL)
            &AddressDetails,                          // Input Buffer to driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Input buffer length
            &AddressDetails,                          // Output Buffer from driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Length of output
                                                      // buffer in bytes.
            &ReturnedLength,                          // Bytes placed in buffer.
            NULL                                      // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (AddressDetails.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            //
            // Show the results
            //
            ShowMessages("%llx\n", AddressDetails.PhysicalAddress);
        }
        else
        {
            //
            // An err occurred, no results
            //
            ShowErrorMessage(AddressDetails.KernelStatus);
        }
    }
}

◆ CommandVmcall()

VOID CommandVmcall	(	vector< string >	SplitCommand,
		string	Command )

!vmcall command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    vector<string>                     SplitCommandCaseSensitive {Split(Command, ' ')};
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &SplitCommand,
            &SplitCommandCaseSensitive,
            VMCALL_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (SplitCommand.size() > 1)
    {
        ShowMessages("incorrect use of the '!vmcall'\n");
        CommandVmcallHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandWrmsr()

VOID CommandWrmsr	(	vector< string >	SplitCommand,
		string	Command )

wrmsr command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    BOOL                           Status;
    UINT64                         Msr;
    DEBUGGER_READ_AND_WRITE_ON_MSR MsrWriteRequest = {0};
    BOOL                           IsNextCoreId    = FALSE;
    BOOL                           SetMsr          = FALSE;
    BOOL                           SetValue        = FALSE;
    UINT64                         Value           = 0;
    UINT32                         CoreNumer       = DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES;
    BOOLEAN                        IsFirstCommand  = TRUE;
 
    if (SplitCommand.size() >= 6)
    {
        ShowMessages("incorrect use of the 'wrmsr'\n\n");
        CommandWrmsrHelp();
        return;
    }
 
    for (auto Section : SplitCommand)
    {
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextCoreId)
        {
            if (!ConvertStringToUInt32(Section, &CoreNumer))
            {
                ShowMessages("please specify a correct hex value for core id\n\n");
                CommandWrmsrHelp();
                return;
            }
 
            IsNextCoreId = FALSE;
            continue;
        }
 
        if (!Section.compare("core"))
        {
            IsNextCoreId = TRUE;
            continue;
        }
 
        if (!SetMsr)
        {
            if (!ConvertStringToUInt64(Section, &Msr))
            {
                ShowMessages("please specify a correct hex value to be read\n\n");
                CommandWrmsrHelp();
                return;
            }
            else
            {
                //
                // Means that the MSR is set, next we should read value
                //
                SetMsr = TRUE;
                continue;
            }
        }
 
        if (SetMsr)
        {
            if (!SymbolConvertNameOrExprToAddress(Section, &Value))
            {
                ShowMessages(
                    "please specify a correct hex value or an expression to put on the msr\n\n");
                CommandWrmsrHelp();
                return;
            }
            else
            {
                SetValue = TRUE;
                continue;
            }
        }
    }
 
    //
    // Check if msr is set or not
    //
    if (!SetMsr)
    {
        ShowMessages("please specify a correct hex value to write\n\n");
        CommandWrmsrHelp();
        return;
    }
 
    if (!SetValue)
    {
        ShowMessages("please specify a correct hex value to put on msr\n\n");
        CommandWrmsrHelp();
        return;
    }
 
    if (IsNextCoreId)
    {
        ShowMessages("please specify a correct hex value for core\n\n");
        CommandWrmsrHelp();
        return;
    }
 
    AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    MsrWriteRequest.ActionType = DEBUGGER_MSR_WRITE;
    MsrWriteRequest.Msr        = Msr;
    MsrWriteRequest.CoreNumber = CoreNumer;
    MsrWriteRequest.Value      = Value;
 
    Status = DeviceIoControl(
        g_DeviceHandle,                        // Handle to device
        IOCTL_DEBUGGER_READ_OR_WRITE_MSR,      // IO Control Code (IOCTL)
        &MsrWriteRequest,                      // Input Buffer to driver.
        SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR, // Input buffer length
        NULL,                                  // Output Buffer from driver.
        NULL,                                  // Length of output buffer in bytes.
        NULL,                                  // Bytes placed in buffer.
        NULL                                   // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code (%x), either msr index or core id is invalid\n",
                     GetLastError());
        return;
    }
 
    ShowMessages("\n");
}

◆ CommandX()

VOID CommandX	(	vector< string >	SplitCommand,
		string	Command )

x command handler

Parameters

SplitCommand
Command

Returns: VOID

{
    if (SplitCommand.size() == 1)
    {
        ShowMessages("incorrect use of the 'x'\n\n");
        CommandXHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove x from it
    //
    Command.erase(0, SplitCommand.at(0).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Search for mask
    //
    ScriptEngineSearchSymbolForMaskWrapper(Command.c_str());
}

◆ ContinuePreviousCommand()

BOOLEAN ContinuePreviousCommand ( )

Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.

Returns: TRUE means the command should be continued, FALSE means command should be ignored

{
    BOOLEAN Result = g_ShouldPreviousCommandBeContinued;
 
    //
    // We should keep it false for the next command
    //
    g_ShouldPreviousCommandBeContinued = FALSE;
 
    if (Result)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

◆ CpuReadVendorString()

VOID CpuReadVendorString ( CHAR * Result )

Reads the CPU vendor string.

Returns: char *

{
    std::string VendorString = InstructionSet::Vendor();
    strcpy(Result, VendorString.c_str());
}

◆ HyperDbgCheckWhetherTheCurrentInstructionIsCall()

BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsCall	(	unsigned char *	BufferToDisassemble,
		UINT64	BuffLength,
		BOOLEAN	Isx86_64,
		PUINT32	CallLength )

Check whether the current instruction is a 'call' or not.

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64
CallLength	Length of call (if return value is TRUE)

Returns: BOOLEAN

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip    = 0;
    int                     instr_decoded = 0;
    ZydisDecodedInstruction instruction;
    char                    buffer[256];
    UINT32                  MaximumInstrDecoded = 1;
 
    //
    // Default length
    //
    *CallLength = 0;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
 
        ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_CALL)
        {
            //
            // It's a call
            //
 
            //
            // Log call
            //
            // ShowMessages("call length : 0x%x\n", instruction.length);
 
            //
            // Set the length
            //
            *CallLength = instruction.length;
 
            return TRUE;
        }
        else
        {
            //
            // It's not call
            //
            return FALSE;
        }
    }
 
    //
    // Should not reach here
    //
    return FALSE;
}

◆ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet()

BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet	(	unsigned char *	BufferToDisassemble,
		UINT64	CurrentRip,
		UINT32	BuffLength,
		BOOLEAN	Isx86_64,
		PBOOLEAN	IsRet )

Check whether the current instruction is a 'call' or 'ret' or not.

Parameters

BufferToDisassemble	Current Bytes of assembly
CurrentRip	Address of current RIP
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64
IsRet	Whether it's a 'ret' or not

Returns: BOOLEAN

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    int                     instr_decoded = 0;
    ZydisDecodedInstruction instruction;
    char                    buffer[256];
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (!Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsoluteForTrackingInstructions;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_CALL)
        {
            //
            // It's a 'call' instruction
            //
 
            //
            // Log call
            //
            // ShowMessages("call length : 0x%x\n", instruction.length);
 
            //
            // We have to pass a `runtime_address` different to
            // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
            //
 
            ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
            *IsRet = FALSE;
 
            return TRUE;
        }
        else if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_RET)
        {
            //
            // It's a 'ret' instruction
            //
 
            //
            // Log ret
            //
            // ShowMessages("ret length : 0x%x\n", instruction.length);
 
            //
            // Call the tracker callback
            //
            CommandTrackHandleReceivedRetInstructions(CurrentRip);
 
            *IsRet = TRUE;
 
            return TRUE;
        }
        else
        {
            //
            // It's not call
            //
            return FALSE;
        }
    }
 
    //
    // Should not reach here
    //
    return FALSE;
}

◆ HyperDbgCheckWhetherTheCurrentInstructionIsRet()

BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsRet	(	unsigned char *	BufferToDisassemble,
		UINT64	BuffLength,
		BOOLEAN	Isx86_64 )

Check whether the current instruction is a 'ret' or not.

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64
RetLength	Length of ret (if return value is TRUE)

Returns: BOOLEAN

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip    = 0;
    int                     instr_decoded = 0;
    ZydisDecodedInstruction instruction;
    char                    buffer[256];
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
 
        ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_RET)
        {
            //
            // It's a ret
            //
 
            //
            // Log ret
            //
            // ShowMessages("ret length : 0x%x\n", instruction.length);
 
            return TRUE;
        }
        else
        {
            //
            // It's not ret
            //
            return FALSE;
        }
    }
 
    //
    // Should not reach here
    //
    return FALSE;
}

◆ HyperDbgDisassembler32()

int HyperDbgDisassembler32	(	unsigned char *	BufferToDisassemble,
		UINT64	BaseAddress,
		UINT64	Size,
		UINT32	MaximumInstrDecoded,
		BOOLEAN	ShowBranchIsTakenOrNot,
		PRFLAGS	Rflags )

Disassemble 32 bit assemblies.

Parameters

BufferToDisassemble	buffer to disassemble
BaseAddress	the base address of assembly
Size	size of buffer
MaximumInstrDecoded	maximum instructions to decode, 0 means all possible
ShowBranchIsTakenOrNot	on conditional jumps shows whether jumps is taken or not
Rflags	in the case ShowBranchIsTakenOrNot is true, we use this variable to show the result of jump

Returns: int

{
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        fputs("Invalid Zydis version\n", ZYAN_STDERR);
        return EXIT_FAILURE;
    }
 
    ZydisDecoder decoder;
    ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
 
    //
    // Disassembling buffer
    //
    DisassembleBuffer(&decoder, (UINT32)BaseAddress, &BufferToDisassemble[0], Size, MaximumInstrDecoded, FALSE, ShowBranchIsTakenOrNot, Rflags);
 
    return 0;
}

◆ HyperDbgDisassembler64()

int HyperDbgDisassembler64	(	unsigned char *	BufferToDisassemble,
		UINT64	BaseAddress,
		UINT64	Size,
		UINT32	MaximumInstrDecoded,
		BOOLEAN	ShowBranchIsTakenOrNot,
		PRFLAGS	Rflags )

Disassemble x64 assemblies.

Parameters

BufferToDisassemble	buffer to disassemble
BaseAddress	the base address of assembly
Size	size of buffer
MaximumInstrDecoded	maximum instructions to decode, 0 means all possible
ShowBranchIsTakenOrNot	on conditional jumps shows whether jumps is taken or not
Rflags	in the case ShowBranchIsTakenOrNot is true, we use this variable to show the result of jump

Returns: int

{
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        fputs("Invalid Zydis version\n", ZYAN_STDERR);
        return EXIT_FAILURE;
    }
 
    ZydisDecoder decoder;
    ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
 
    //
    // Disassembling buffer
    //
    DisassembleBuffer(&decoder, BaseAddress, &BufferToDisassemble[0], Size, MaximumInstrDecoded, TRUE, ShowBranchIsTakenOrNot, Rflags);
 
    return 0;
}

◆ HyperDbgIsConditionalJumpTaken()

DEBUGGER_CONDITIONAL_JUMP_STATUS HyperDbgIsConditionalJumpTaken	(	unsigned char *	BufferToDisassemble,
		UINT64	BuffLength,
		RFLAGS	Rflags,
		BOOLEAN	Isx86_64 )

Check whether the jump is taken or not taken (in debugger)

the implementation of this function derived from the table in this site : http://www.unixwiz.net/techtips/x86-jumps.html

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Rflags	The kernel's current RFLAG
Isx86_64	Whether it's an x86 or x64

Returns: DEBUGGER_NEXT_INSTRUCTION_FINDER_STATUS

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip    = 0;
    int                     instr_decoded = 0;
    ZydisDecodedInstruction instruction;
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid Zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute = (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
 
        // ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        switch (instruction.mnemonic)
        {
        case ZydisMnemonic::ZYDIS_MNEMONIC_JO:
 
            //
            // Jump if overflow (jo)
            //
            if (Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNO:
 
            //
            // Jump if not overflow (jno)
            //
            if (!Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JS:
 
            //
            // Jump if sign
            //
            if (Rflags.SignFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNS:
 
            //
            // Jump if not sign
            //
            if (!Rflags.SignFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JZ:
 
            //
            // Jump if equal (je),
            // Jump if zero (jz)
            //
            if (Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNZ:
 
            //
            // Jump if not equal (jne),
            // Jump if not zero (jnz)
            //
            if (!Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JB:
 
            //
            // Jump if below (jb),
            // Jump if not above or equal (jnae),
            // Jump if carry (jc)
            //
 
            //
            // This jump is unsigned
            //
 
            if (Rflags.CarryFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNB:
 
            //
            // Jump if not below (jnb),
            // Jump if above or equal (jae),
            // Jump if not carry (jnc)
            //
 
            //
            // This jump is unsigned
            //
 
            if (!Rflags.CarryFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JBE:
 
            //
            // Jump if below or equal (jbe),
            // Jump if not above (jna)
            //
 
            //
            // This jump is unsigned
            //
 
            if (Rflags.CarryFlag || Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNBE:
 
            //
            // Jump if above (ja),
            // Jump if not below or equal (jnbe)
            //
 
            //
            // This jump is unsigned
            //
 
            if (!Rflags.CarryFlag && !Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JL:
 
            //
            // Jump if less (jl),
            // Jump if not greater or equal (jnge)
            //
 
            //
            // This jump is signed
            //
 
            if (Rflags.SignFlag != Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNL:
 
            //
            // Jump if greater or equal (jge),
            // Jump if not less (jnl)
            //
 
            //
            // This jump is signed
            //
 
            if (Rflags.SignFlag == Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JLE:
 
            //
            // Jump if less or equal (jle),
            // Jump if not greater (jng)
            //
 
            //
            // This jump is signed
            //
 
            if (Rflags.ZeroFlag || Rflags.SignFlag != Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNLE:
 
            //
            // Jump if greater (jg),
            // Jump if not less or equal (jnle)
            //
 
            //
            // This jump is signed
            //
 
            if (!Rflags.ZeroFlag && Rflags.SignFlag == Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JP:
 
            //
            // Jump if parity (jp),
            // Jump if parity even (jpe)
            //
 
            if (Rflags.ParityFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNP:
 
            //
            // Jump if not parity (jnp),
            // Jump if parity odd (jpo)
            //
 
            if (!Rflags.ParityFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JCXZ:
        case ZydisMnemonic::ZYDIS_MNEMONIC_JECXZ:
 
            //
            // Jump if %CX register is 0 (jcxz),
            // Jump if% ECX register is 0 (jecxz)
            //
 
            //
            // Actually this instruction are rarely used
            // but if we want to support these instructions then we
            // should read ecx and cx each time in the debuggee,
            // so it's better to just ignore it as a non-conditional
            // jump
            //
            return DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP;
 
        default:
 
            //
            // It's not a jump
            //
            return DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP;
            break;
        }
 
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    //
    // Should not reach here
    //
    return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
}

◆ HyperDbgLengthDisassemblerEngine()

UINT32 HyperDbgLengthDisassemblerEngine	(	unsigned char *	BufferToDisassemble,
		UINT64	BuffLength,
		BOOLEAN	Isx86_64 )

Length Disassembler engine based on Zydis.

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64
Length	of call (if return value is TRUE)

Returns: UINT32

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip    = 0;
    int                     instr_decoded = 0;
    ZydisDecodedInstruction instruction;
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid Zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
        // ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        //
        // Return len of buffer
        //
        return instruction.length;
    }
 
    //
    // Error in disassembling buffer
    //
    return 0;
}

◆ HyperDbgReadMemory()

BOOLEAN HyperDbgReadMemory	(	UINT64	TargetAddress,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		DEBUGGER_READ_READING_TYPE	ReadingType,
		UINT32	Pid,
		UINT32	Size,
		BOOLEAN	GetAddressMode,
		DEBUGGER_READ_MEMORY_ADDRESS_MODE *	AddressMode,
		BYTE *	TargetBufferToStore,
		UINT32 *	ReturnLength )

Read memory and disassembler.

Parameters

TargetAddress	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
ReadingType	read from kernel or vmx-root
Pid	The target process id
Size	size of memory to read
GetAddressMode	check for address mode
AddressMode	Address mode (32 or 64)
TargetBufferToStore	The buffer to store the read memory
ReturnLength	The length of the read memory

Returns: BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    BOOL                 Status;
    ULONG                ReturnedLength;
    DEBUGGER_READ_MEMORY ReadMem = {0};
    UINT32               SizeOfTargetBuffer;
 
    //
    // Check if driver is loaded if it's in VMI mode
    //
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
    }
 
    //
    // Fill the read memory structure
    //
    ReadMem.Address        = TargetAddress;
    ReadMem.Pid            = Pid;
    ReadMem.Size           = Size;
    ReadMem.MemoryType     = MemoryType;
    ReadMem.ReadingType    = ReadingType;
    ReadMem.GetAddressMode = GetAddressMode;
 
    //
    // allocate buffer for transferring messages
    //
    SizeOfTargetBuffer                    = sizeof(DEBUGGER_READ_MEMORY) + (Size * sizeof(CHAR));
    DEBUGGER_READ_MEMORY * MemReadRequest = (DEBUGGER_READ_MEMORY *)malloc(SizeOfTargetBuffer);
 
    //
    // Check if the buffer is allocated successfully
    //
    if (MemReadRequest == NULL)
    {
        return FALSE;
    }
 
    ZeroMemory(MemReadRequest, SizeOfTargetBuffer);
 
    //
    // Copy the buffer to send
    //
    memcpy(MemReadRequest, &ReadMem, sizeof(DEBUGGER_READ_MEMORY));
 
    //
    // Check if this is used for Debugger Mode or VMI mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // It's on Debugger mode
        //
        if (!KdSendReadMemoryPacketToDebuggee(MemReadRequest, SizeOfTargetBuffer))
        {
            std::free(MemReadRequest);
            return FALSE;
        }
    }
    else
    {
        //
        // It's on VMI mode
        //
 
        Status = DeviceIoControl(g_DeviceHandle,              // Handle to device
                                 IOCTL_DEBUGGER_READ_MEMORY,  // IO Control Code (IOCTL)
                                 MemReadRequest,              // Input Buffer to driver.
                                 SIZEOF_DEBUGGER_READ_MEMORY, // Input buffer length
                                 MemReadRequest,              // Output Buffer from driver.
                                 SizeOfTargetBuffer,          // Length of output buffer in bytes.
                                 &ReturnedLength,             // Bytes placed in buffer.
                                 NULL                         // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            std::free(MemReadRequest);
            return FALSE;
        }
    }
 
    //
    // Check if reading memory was successful or not
    //
    if (MemReadRequest->KernelStatus != DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowErrorMessage(MemReadRequest->KernelStatus);
        std::free(MemReadRequest);
        return FALSE;
    }
    else
    {
        if (g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Change the ReturnedLength as it contains the headers
            //
            *ReturnLength = MemReadRequest->ReturnLength;
        }
        else
        {
            //
            // Change the ReturnedLength as it contains the headers
            //
            ReturnedLength -= SIZEOF_DEBUGGER_READ_MEMORY;
            *ReturnLength = ReturnedLength;
        }
 
        //
        // Set address mode (if requested)
        //
        if (GetAddressMode)
        {
            *AddressMode = MemReadRequest->AddressMode;
        }
 
        //
        // Copy the buffer
        //
        memcpy(TargetBufferToStore,
               ((unsigned char *)MemReadRequest) + sizeof(DEBUGGER_READ_MEMORY),
               *ReturnLength);
 
        //
        // free the buffer
        //
        std::free(MemReadRequest);
 
        return TRUE;
    }
}

◆ HyperDbgShowMemoryOrDisassemble()

VOID HyperDbgShowMemoryOrDisassemble	(	DEBUGGER_SHOW_MEMORY_STYLE	Style,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		DEBUGGER_READ_READING_TYPE	ReadingType,
		UINT32	Pid,
		UINT32	Size,
		PDEBUGGER_DT_COMMAND_OPTIONS	DtDetails )

Show memory or disassembler.

Parameters

Style	style of show memory (as byte, dwrod, qword)
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
ReadingType	read from kernel or vmx-root
Pid	The target process id
Size	size of memory to read
DtDetails	Options for dt structure show details

Returns: VOID

{
    UINT32                            ReturnedLength;
    UCHAR *                           Buffer;
    DEBUGGER_READ_MEMORY_ADDRESS_MODE AddressMode;
    BOOLEAN                           CheckForAddressMode = FALSE;
    BOOLEAN                           Status              = FALSE;
 
    //
    // Check if this is used for disassembler or not
    //
    if (Style == DEBUGGER_SHOW_COMMAND_DISASSEMBLE64 ||
        Style == DEBUGGER_SHOW_COMMAND_DISASSEMBLE32)
    {
        CheckForAddressMode = TRUE;
    }
    else
    {
        CheckForAddressMode = FALSE;
    }
 
    //
    // Allocate buffer for output
    //
    Buffer = (UCHAR *)malloc(Size);
 
    //
    // Perform reading memory
    //
    Status = HyperDbgReadMemory(Address,
                                MemoryType,
                                ReadingType,
                                Pid,
                                Size,
                                CheckForAddressMode,
                                &AddressMode,
                                (BYTE *)Buffer,
                                &ReturnedLength);
 
    //
    // Check if reading memory was successful or not
    //
    if (!Status)
    {
        //
        // Check for extra message for the dump command
        //
        if (Style == DEBUGGER_SHOW_COMMAND_DUMP)
        {
            ShowMessages("HyperDbg attempted to access an invalid target address: 0x%llx\n"
                         "if you are confident that the address is valid, it may be paged out "
                         "or not yet available in the current CR3 page table\n"
                         "you can use the '.pagein' command to load this page table into memory and "
                         "trigger a page fault (#PF), please refer to the documentation for further details\n\n",
                         Address);
        }
 
        //
        // free the buffer
        //
        std::free(Buffer);
        return;
    }
 
    switch (Style)
    {
    case DEBUGGER_SHOW_COMMAND_DT:
 
        //
        // Show the 'dt' command view
        //
        if (Size == ReturnedLength)
        {
            ScriptEngineShowDataBasedOnSymbolTypesWrapper(DtDetails->TypeName,
                                                          Address,
                                                          FALSE,
                                                          Buffer,
                                                          DtDetails->AdditionalParameters);
        }
        else if (ReturnedLength == 0)
        {
            ShowMessages("err, invalid address");
        }
        else
        {
            ShowMessages("err, invalid address or memory is smaller than the structure size");
        }
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DB:
 
        ShowMemoryCommandDB(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DC:
 
        ShowMemoryCommandDC(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DD:
 
        ShowMemoryCommandDD(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DQ:
 
        ShowMemoryCommandDQ(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DUMP:
 
        CommandDumpSaveIntoFile(Buffer, Size);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DISASSEMBLE64:
 
        //
        // Check if assembly mismatch occurred with the target address
        //
        if (AddressMode == DEBUGGER_READ_ADDRESS_MODE_32_BIT && MemoryType == DEBUGGER_READ_VIRTUAL_ADDRESS)
        {
            ShowMessages("the target address seems to be located in a 32-bit program, if so, "
                         "please consider using the 'u32' instead to utilize the 32-bit disassembler\n");
        }
 
        //
        // Show diassembles
        //
        if (ReturnedLength != 0)
        {
            HyperDbgDisassembler64(
                Buffer,
                Address,
                ReturnedLength,
                0,
                FALSE,
                NULL);
        }
        else
        {
            ShowMessages("err, invalid address\n");
        }
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DISASSEMBLE32:
 
        //
        // Check if assembly mismatch occurred with the target address
        //
        if (AddressMode == DEBUGGER_READ_ADDRESS_MODE_64_BIT && MemoryType == DEBUGGER_READ_VIRTUAL_ADDRESS)
        {
            ShowMessages("the target address seems to be located in a 64-bit program, if so, "
                         "please consider using the 'u' instead to utilize the 64-bit disassembler\n");
        }
 
        //
        // Show diassembles
        //
        if (ReturnedLength != 0)
        {
            HyperDbgDisassembler32(
                Buffer,
                Address,
                ReturnedLength,
                0,
                FALSE,
                NULL);
        }
        else
        {
            ShowMessages("err, invalid address\n");
        }
 
        break;
    }
 
    //
    // free the buffer
    //
    std::free(Buffer);
}

◆ InitializeCommandsDictionary()

VOID InitializeCommandsDictionary ( )

Initialize commands and attributes.

Returns: VOID

{
    g_CommandsList[".help"] = {NULL, &CommandHelpHelp, DEBUGGER_COMMAND_HELP_ATTRIBUTES};
    g_CommandsList[".hh"]   = {NULL, &CommandHelpHelp, DEBUGGER_COMMAND_HELP_ATTRIBUTES};
    g_CommandsList["help"]  = {NULL, &CommandHelpHelp, DEBUGGER_COMMAND_HELP_ATTRIBUTES};
 
    g_CommandsList["clear"] = {&CommandClearScreen, &CommandClearScreenHelp, DEBUGGER_COMMAND_CLEAR_ATTRIBUTES};
    g_CommandsList[".cls"]  = {&CommandClearScreen, &CommandClearScreenHelp, DEBUGGER_COMMAND_CLEAR_ATTRIBUTES};
    g_CommandsList["cls"]   = {&CommandClearScreen, &CommandClearScreenHelp, DEBUGGER_COMMAND_CLEAR_ATTRIBUTES};
 
    g_CommandsList[".connect"] = {&CommandConnect, &CommandConnectHelp, DEBUGGER_COMMAND_CONNECT_ATTRIBUTES};
    g_CommandsList["connect"]  = {&CommandConnect, &CommandConnectHelp, DEBUGGER_COMMAND_CONNECT_ATTRIBUTES};
 
    g_CommandsList[".listen"] = {&CommandListen, &CommandListenHelp, DEBUGGER_COMMAND_LISTEN_ATTRIBUTES};
    g_CommandsList["listen"]  = {&CommandListen, &CommandListenHelp, DEBUGGER_COMMAND_LISTEN_ATTRIBUTES};
 
    g_CommandsList["g"]  = {&CommandG, &CommandGHelp, DEBUGGER_COMMAND_G_ATTRIBUTES};
    g_CommandsList["go"] = {&CommandG, &CommandGHelp, DEBUGGER_COMMAND_G_ATTRIBUTES};
 
    g_CommandsList[".attach"] = {&CommandAttach, &CommandAttachHelp, DEBUGGER_COMMAND_ATTACH_ATTRIBUTES};
    g_CommandsList["attach"]  = {&CommandAttach, &CommandAttachHelp, DEBUGGER_COMMAND_ATTACH_ATTRIBUTES};
 
    g_CommandsList[".detach"] = {&CommandDetach, &CommandDetachHelp, DEBUGGER_COMMAND_DETACH_ATTRIBUTES};
    g_CommandsList["detach"]  = {&CommandDetach, &CommandDetachHelp, DEBUGGER_COMMAND_DETACH_ATTRIBUTES};
 
    g_CommandsList[".start"] = {&CommandStart, &CommandStartHelp, DEBUGGER_COMMAND_START_ATTRIBUTES};
    g_CommandsList["start"]  = {&CommandStart, &CommandStartHelp, DEBUGGER_COMMAND_START_ATTRIBUTES};
 
    g_CommandsList[".restart"] = {&CommandRestart, &CommandRestartHelp, DEBUGGER_COMMAND_RESTART_ATTRIBUTES};
    g_CommandsList["restart"]  = {&CommandRestart, &CommandRestartHelp, DEBUGGER_COMMAND_RESTART_ATTRIBUTES};
 
    g_CommandsList[".switch"] = {&CommandSwitch, &CommandSwitchHelp, DEBUGGER_COMMAND_SWITCH_ATTRIBUTES};
    g_CommandsList["switch"]  = {&CommandSwitch, &CommandSwitchHelp, DEBUGGER_COMMAND_SWITCH_ATTRIBUTES};
 
    g_CommandsList[".kill"] = {&CommandKill, &CommandKillHelp, DEBUGGER_COMMAND_KILL_ATTRIBUTES};
    g_CommandsList["kill"]  = {&CommandKill, &CommandKillHelp, DEBUGGER_COMMAND_KILL_ATTRIBUTES};
 
    g_CommandsList[".process"]  = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
    g_CommandsList[".process2"] = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
    g_CommandsList["process"]   = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
    g_CommandsList["process2"]  = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
 
    g_CommandsList[".thread"]  = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
    g_CommandsList[".thread2"] = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
    g_CommandsList["thread"]   = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
    g_CommandsList["thread2"]  = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
 
    g_CommandsList["sleep"] = {&CommandSleep, &CommandSleepHelp, DEBUGGER_COMMAND_SLEEP_ATTRIBUTES};
 
    g_CommandsList["event"]  = {&CommandEvents, &CommandEventsHelp, DEBUGGER_COMMAND_EVENTS_ATTRIBUTES};
    g_CommandsList["events"] = {&CommandEvents, &CommandEventsHelp, DEBUGGER_COMMAND_EVENTS_ATTRIBUTES};
 
    g_CommandsList["setting"]   = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
    g_CommandsList["settings"]  = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
    g_CommandsList[".setting"]  = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
    g_CommandsList[".settings"] = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
 
    g_CommandsList[".disconnect"] = {&CommandDisconnect, &CommandDisconnectHelp, DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES};
    g_CommandsList["disconnect"]  = {&CommandDisconnect, &CommandDisconnectHelp, DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES};
 
    g_CommandsList[".debug"] = {&CommandDebug, &CommandDebugHelp, DEBUGGER_COMMAND_DEBUG_ATTRIBUTES};
    g_CommandsList["debug"]  = {&CommandDebug, &CommandDebugHelp, DEBUGGER_COMMAND_DEBUG_ATTRIBUTES};
 
    g_CommandsList[".status"] = {&CommandStatus, &CommandStatusHelp, DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES};
    g_CommandsList["status"]  = {&CommandStatus, &CommandStatusHelp, DEBUGGER_COMMAND_STATUS_ATTRIBUTES};
 
    g_CommandsList["load"] = {&CommandLoad, &CommandLoadHelp, DEBUGGER_COMMAND_LOAD_ATTRIBUTES};
 
    g_CommandsList["exit"]  = {&CommandExit, &CommandExitHelp, DEBUGGER_COMMAND_EXIT_ATTRIBUTES};
    g_CommandsList[".exit"] = {&CommandExit, &CommandExitHelp, DEBUGGER_COMMAND_EXIT_ATTRIBUTES};
 
    g_CommandsList["flush"] = {&CommandFlush, &CommandFlushHelp, DEBUGGER_COMMAND_FLUSH_ATTRIBUTES};
 
    g_CommandsList["pause"] = {&CommandPause, &CommandPauseHelp, DEBUGGER_COMMAND_PAUSE_ATTRIBUTES};
 
    g_CommandsList["unload"] = {&CommandUnload, &CommandUnloadHelp, DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES};
 
    g_CommandsList[".script"] = {&CommandScript, &CommandScriptHelp, DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES};
    g_CommandsList["script"]  = {&CommandScript, &CommandScriptHelp, DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES};
 
    g_CommandsList["output"] = {&CommandOutput, &CommandOutputHelp, DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES};
 
    g_CommandsList["print"] = {&CommandPrint, &CommandPrintHelp, DEBUGGER_COMMAND_PRINT_ATTRIBUTES};
 
    g_CommandsList["?"]        = {&CommandEval, &CommandEvalHelp, DEBUGGER_COMMAND_EVAL_ATTRIBUTES};
    g_CommandsList["eval"]     = {&CommandEval, &CommandEvalHelp, DEBUGGER_COMMAND_EVAL_ATTRIBUTES};
    g_CommandsList["evaluate"] = {&CommandEval, &CommandEvalHelp, DEBUGGER_COMMAND_EVAL_ATTRIBUTES};
 
    g_CommandsList[".logopen"] = {&CommandLogopen, &CommandLogopenHelp, DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES};
 
    g_CommandsList[".logclose"] = {&CommandLogclose, &CommandLogcloseHelp, DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES};
 
    g_CommandsList[".pagein"] = {&CommandPagein, &CommandPageinHelp, DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES};
    g_CommandsList["pagein"]  = {&CommandPagein, &CommandPageinHelp, DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES};
 
    g_CommandsList["test"] = {&CommandTest, &CommandTestHelp, DEBUGGER_COMMAND_TEST_ATTRIBUTES};
 
    g_CommandsList["cpu"] = {&CommandCpu, &CommandCpuHelp, DEBUGGER_COMMAND_CPU_ATTRIBUTES};
 
    g_CommandsList["wrmsr"] = {&CommandWrmsr, &CommandWrmsrHelp, DEBUGGER_COMMAND_WRMSR_ATTRIBUTES};
 
    g_CommandsList["rdmsr"] = {&CommandRdmsr, &CommandRdmsrHelp, DEBUGGER_COMMAND_RDMSR_ATTRIBUTES};
 
    g_CommandsList["!va2pa"] = {&CommandVa2pa, &CommandVa2paHelp, DEBUGGER_COMMAND_VA2PA_ATTRIBUTES};
 
    g_CommandsList["!pa2va"] = {&CommandPa2va, &CommandPa2vaHelp, DEBUGGER_COMMAND_PA2VA_ATTRIBUTES};
 
    g_CommandsList[".formats"] = {&CommandFormats, &CommandFormatsHelp, DEBUGGER_COMMAND_FORMATS_ATTRIBUTES};
    g_CommandsList[".format"]  = {&CommandFormats, &CommandFormatsHelp, DEBUGGER_COMMAND_FORMATS_ATTRIBUTES};
 
    g_CommandsList["!pte"] = {&CommandPte, &CommandPteHelp, DEBUGGER_COMMAND_PTE_ATTRIBUTES};
 
    g_CommandsList["~"]    = {&CommandCore, &CommandCoreHelp, DEBUGGER_COMMAND_CORE_ATTRIBUTES};
    g_CommandsList["core"] = {&CommandCore, &CommandCoreHelp, DEBUGGER_COMMAND_CORE_ATTRIBUTES};
 
    g_CommandsList["!monitor"] = {&CommandMonitor, &CommandMonitorHelp, DEBUGGER_COMMAND_MONITOR_ATTRIBUTES};
 
    g_CommandsList["!vmcall"] = {&CommandVmcall, &CommandVmcallHelp, DEBUGGER_COMMAND_VMCALL_ATTRIBUTES};
 
    g_CommandsList["!epthook"] = {&CommandEptHook, &CommandEptHookHelp, DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES};
    g_CommandsList["bh"]       = {&CommandEptHook, &CommandEptHookHelp, DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES};
 
    g_CommandsList["bp"] = {&CommandBp, &CommandBpHelp, DEBUGGER_COMMAND_BP_ATTRIBUTES};
 
    g_CommandsList["bl"] = {&CommandBl, &CommandBlHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["be"] = {&CommandBe, &CommandBeHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["bd"] = {&CommandBd, &CommandBdHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["bc"] = {&CommandBc, &CommandBcHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["!epthook2"] = {&CommandEptHook2, &CommandEptHook2Help, DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES};
 
    g_CommandsList["!cpuid"] = {&CommandCpuid, &CommandCpuidHelp, DEBUGGER_COMMAND_CPUID_ATTRIBUTES};
 
    g_CommandsList["!msrread"] = {&CommandMsrread, &CommandMsrreadHelp, DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES};
    g_CommandsList["!msread"]  = {&CommandMsrread, &CommandMsrreadHelp, DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES};
 
    g_CommandsList["!msrwrite"] = {&CommandMsrwrite, &CommandMsrwriteHelp, DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES};
 
    g_CommandsList["!tsc"] = {&CommandTsc, &CommandTscHelp, DEBUGGER_COMMAND_TSC_ATTRIBUTES};
 
    g_CommandsList["!pmc"] = {&CommandPmc, &CommandPmcHelp, DEBUGGER_COMMAND_PMC_ATTRIBUTES};
 
    g_CommandsList["!crwrite"] = {&CommandCrwrite, &CommandCrwriteHelp, DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES};
 
    g_CommandsList["!dr"] = {&CommandDr, &CommandDrHelp, DEBUGGER_COMMAND_DR_ATTRIBUTES};
 
    g_CommandsList["!ioin"] = {&CommandIoin, &CommandIoinHelp, DEBUGGER_COMMAND_IOIN_ATTRIBUTES};
 
    g_CommandsList["!ioout"] = {&CommandIoout, &CommandIooutHelp, DEBUGGER_COMMAND_IOOUT_ATTRIBUTES};
    g_CommandsList["!iout"]  = {&CommandIoout, &CommandIooutHelp, DEBUGGER_COMMAND_IOOUT_ATTRIBUTES};
 
    g_CommandsList["!exception"] = {&CommandException, &CommandExceptionHelp, DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES};
 
    g_CommandsList["!interrupt"] = {&CommandInterrupt, &CommandInterruptHelp, DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES};
 
    g_CommandsList["!syscall"]  = {&CommandSyscallAndSysret, &CommandSyscallHelp, DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES};
    g_CommandsList["!syscall2"] = {&CommandSyscallAndSysret, &CommandSyscallHelp, DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES};
 
    g_CommandsList["!sysret"]  = {&CommandSyscallAndSysret, &CommandSysretHelp, DEBUGGER_COMMAND_SYSRET_ATTRIBUTES};
    g_CommandsList["!sysret2"] = {&CommandSyscallAndSysret, &CommandSysretHelp, DEBUGGER_COMMAND_SYSRET_ATTRIBUTES};
 
    g_CommandsList["!mode"] = {&CommandMode, &CommandModeHelp, DEBUGGER_COMMAND_MODE_ATTRIBUTES};
 
    g_CommandsList["!trace"] = {&CommandTrace, &CommandTraceHelp, DEBUGGER_COMMAND_TRACE_ATTRIBUTES};
 
    g_CommandsList["!hide"] = {&CommandHide, &CommandHideHelp, DEBUGGER_COMMAND_HIDE_ATTRIBUTES};
 
    g_CommandsList["!unhide"] = {&CommandUnhide, &CommandUnhideHelp, DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES};
 
    g_CommandsList["!measure"] = {&CommandMeasure, &CommandMeasureHelp, DEBUGGER_COMMAND_MEASURE_ATTRIBUTES};
 
    g_CommandsList["lm"] = {&CommandLm, &CommandLmHelp, DEBUGGER_COMMAND_LM_ATTRIBUTES};
 
    g_CommandsList["p"]  = {&CommandP, &CommandPHelp, DEBUGGER_COMMAND_P_ATTRIBUTES};
    g_CommandsList["pr"] = {&CommandP, &CommandPHelp, DEBUGGER_COMMAND_P_ATTRIBUTES};
 
    g_CommandsList["t"]  = {&CommandT, &CommandTHelp, DEBUGGER_COMMAND_T_ATTRIBUTES};
    g_CommandsList["tr"] = {&CommandT, &CommandTHelp, DEBUGGER_COMMAND_T_ATTRIBUTES};
 
    g_CommandsList["i"]  = {&CommandI, &CommandIHelp, DEBUGGER_COMMAND_I_ATTRIBUTES};
    g_CommandsList["ir"] = {&CommandI, &CommandIHelp, DEBUGGER_COMMAND_I_ATTRIBUTES};
 
    g_CommandsList["gu"] = {&CommandGu, &CommandGuHelp, DEBUGGER_COMMAND_GU_ATTRIBUTES};
 
    g_CommandsList["db"]   = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["dc"]   = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["dd"]   = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["dq"]   = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!db"]  = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!dc"]  = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!dd"]  = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!dq"]  = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u"]   = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u"]    = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u64"] = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u64"]  = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u2"]  = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u2"]   = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u32"] = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u32"]  = {&CommandReadMemoryAndDisassembler,
                              &CommandReadMemoryAndDisassemblerHelp,
                              DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
 
    g_CommandsList["eb"]  = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["ed"]  = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["eq"]  = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["!eb"] = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["!ed"] = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["!eq"] = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
 
    g_CommandsList["sb"]  = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["sd"]  = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["sq"]  = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["!sb"] = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["!sd"] = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["!sq"] = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
 
    g_CommandsList["r"] = {&CommandR, &CommandRHelp, DEBUGGER_COMMAND_R_ATTRIBUTES};
 
    g_CommandsList[".sympath"] = {&CommandSympath, &CommandSympathHelp, DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES};
    g_CommandsList["sympath"]  = {&CommandSympath, &CommandSympathHelp, DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES};
 
    g_CommandsList[".sym"] = {&CommandSym, &CommandSymHelp, DEBUGGER_COMMAND_SYM_ATTRIBUTES};
    g_CommandsList["sym"]  = {&CommandSym, &CommandSymHelp, DEBUGGER_COMMAND_SYM_ATTRIBUTES};
 
    g_CommandsList["x"] = {&CommandX, &CommandXHelp, DEBUGGER_COMMAND_X_ATTRIBUTES};
 
    g_CommandsList["prealloc"]      = {&CommandPrealloc, &CommandPreallocHelp, DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES};
    g_CommandsList["preallocate"]   = {&CommandPrealloc, &CommandPreallocHelp, DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES};
    g_CommandsList["preallocation"] = {&CommandPrealloc, &CommandPreallocHelp, DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES};
 
    g_CommandsList["preactivate"]   = {&CommandPreactivate, &CommandPreactivateHelp, DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES};
    g_CommandsList["preactive"]     = {&CommandPreactivate, &CommandPreactivateHelp, DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES};
    g_CommandsList["preactivation"] = {&CommandPreactivate, &CommandPreactivateHelp, DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES};
 
    g_CommandsList["k"]  = {&CommandK, &CommandKHelp, DEBUGGER_COMMAND_K_ATTRIBUTES};
    g_CommandsList["kd"] = {&CommandK, &CommandKHelp, DEBUGGER_COMMAND_K_ATTRIBUTES};
    g_CommandsList["kq"] = {&CommandK, &CommandKHelp, DEBUGGER_COMMAND_K_ATTRIBUTES};
 
    g_CommandsList["dt"]  = {&CommandDtAndStruct, &CommandDtHelp, DEBUGGER_COMMAND_DT_ATTRIBUTES};
    g_CommandsList["!dt"] = {&CommandDtAndStruct, &CommandDtHelp, DEBUGGER_COMMAND_DT_ATTRIBUTES};
 
    g_CommandsList["struct"]    = {&CommandDtAndStruct, &CommandStructHelp, DEBUGGER_COMMAND_STRUCT_ATTRIBUTES};
    g_CommandsList["structure"] = {&CommandDtAndStruct, &CommandStructHelp, DEBUGGER_COMMAND_STRUCT_ATTRIBUTES};
 
    g_CommandsList[".pe"] = {&CommandPe, &CommandPeHelp, DEBUGGER_COMMAND_PE_ATTRIBUTES};
 
    g_CommandsList["!rev"] = {&CommandRev, &CommandRevHelp, DEBUGGER_COMMAND_REV_ATTRIBUTES};
    g_CommandsList["rev"]  = {&CommandRev, &CommandRevHelp, DEBUGGER_COMMAND_REV_ATTRIBUTES};
 
    g_CommandsList["!track"] = {&CommandTrack, &CommandTrackHelp, DEBUGGER_COMMAND_TRACK_ATTRIBUTES};
    g_CommandsList["track"]  = {&CommandTrack, &CommandTrackHelp, DEBUGGER_COMMAND_TRACK_ATTRIBUTES};
 
    g_CommandsList[".dump"] = {&CommandDump, &CommandDumpHelp, DEBUGGER_COMMAND_DUMP_ATTRIBUTES};
    g_CommandsList["dump"]  = {&CommandDump, &CommandDumpHelp, DEBUGGER_COMMAND_DUMP_ATTRIBUTES};
    g_CommandsList["!dump"] = {&CommandDump, &CommandDumpHelp, DEBUGGER_COMMAND_DUMP_ATTRIBUTES};
 
    //
    // hwdbg commands
    //
    g_CommandsList["!hw_clk"]      = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
    g_CommandsList["!hw_clock"]    = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
    g_CommandsList["!hwdbg_clock"] = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
    g_CommandsList["!hwdbg_clock"] = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
 
    g_CommandsList["a"]         = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["asm"]       = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["assemble"]  = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["assembly"]  = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!a"]        = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!asm"]      = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!assemble"] = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!assembly"] = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
}

◆ InitializeDebugger()

VOID InitializeDebugger ( )

Initialize the debugger and adjust commands for the first run.

Returns: VOID

{
    //
    // Initialize the mapping of functions
    //
    InitializeCommandsDictionary();
 
    //
    // Set the callback for symbol message handler
    //
    ScriptEngineSetTextMessageCallbackWrapper(ShowMessages);
 
    //
    // Register the CTRL+C and CTRL+BREAK Signals handler
    //
    if (!SetConsoleCtrlHandler(BreakController, TRUE))
    {
        ShowMessages("err, when registering CTRL+C and CTRL+BREAK Signals "
                     "handler\n");
        //
        // prefer to continue
        //
    }
 
    //
    // *** Check for feature indicators ***
    //
 
    //
    // Get x86 processor width for virtual address
    //
    g_VirtualAddressWidth = Getx86VirtualAddressWidth();
 
    //
    // Check if processor supports TSX (RTM)
    //
    g_RtmSupport = CheckCpuSupportRtm();
 
    //
    // Load default settings
    //
    CommandSettingsLoadDefaultValuesFromConfigFile();
}

◆ ReadCpuDetails()

int ReadCpuDetails ( )

Print out supported instruction set extensions.

Returns: int

{
    auto & outstream = std::cout;
 
    auto support_message = [&outstream](std::string isa_feature,
                                        bool        is_supported) {
        ShowMessages("%s %s\n", isa_feature.c_str(), (is_supported ? "supported" : "not supported"));
    };
 
    ShowMessages("\nvendor : %s\n", InstructionSet::Vendor().c_str());
    ShowMessages("brand : %s\n\n", InstructionSet::Brand().c_str());
 
    support_message("3DNOW", InstructionSet::_3DNOW());
    support_message("3DNOWEXT", InstructionSet::_3DNOWEXT());
    support_message("ABM", InstructionSet::ABM());
    support_message("ADX", InstructionSet::ADX());
    support_message("AES", InstructionSet::AES());
    support_message("AVX", InstructionSet::AVX());
    support_message("AVX2", InstructionSet::AVX2());
    support_message("AVX512CD", InstructionSet::AVX512CD());
    support_message("AVX512ER", InstructionSet::AVX512ER());
    support_message("AVX512F", InstructionSet::AVX512F());
    support_message("AVX512PF", InstructionSet::AVX512PF());
    support_message("BMI1", InstructionSet::BMI1());
    support_message("BMI2", InstructionSet::BMI2());
    support_message("CLFSH", InstructionSet::CLFSH());
    support_message("CMPXCHG16B", InstructionSet::CMPXCHG16B());
    support_message("CX8", InstructionSet::CX8());
    support_message("ERMS", InstructionSet::ERMS());
    support_message("F16C", InstructionSet::F16C());
    support_message("FMA", InstructionSet::FMA());
    support_message("FSGSBASE", InstructionSet::FSGSBASE());
    support_message("FXSR", InstructionSet::FXSR());
    support_message("HLE", InstructionSet::HLE());
    support_message("INVPCID", InstructionSet::INVPCID());
    support_message("LAHF", InstructionSet::LAHF());
    support_message("LZCNT", InstructionSet::LZCNT());
    support_message("MMX", InstructionSet::MMX());
    support_message("MMXEXT", InstructionSet::MMXEXT());
    support_message("MONITOR", InstructionSet::MONITOR());
    support_message("MOVBE", InstructionSet::MOVBE());
    support_message("MSR", InstructionSet::MSR());
    support_message("OSXSAVE", InstructionSet::OSXSAVE());
    support_message("PCLMULQDQ", InstructionSet::PCLMULQDQ());
    support_message("POPCNT", InstructionSet::POPCNT());
    support_message("PREFETCHWT1", InstructionSet::PREFETCHWT1());
    support_message("RDRAND", InstructionSet::RDRAND());
    support_message("RDSEED", InstructionSet::RDSEED());
    support_message("RDTSCP", InstructionSet::RDTSCP());
    support_message("RTM", InstructionSet::RTM());
    support_message("SEP", InstructionSet::SEP());
    support_message("SHA", InstructionSet::SHA());
    support_message("SSE", InstructionSet::SSE());
    support_message("SSE2", InstructionSet::SSE2());
    support_message("SSE3", InstructionSet::SSE3());
    support_message("SSE4.1", InstructionSet::SSE41());
    support_message("SSE4.2", InstructionSet::SSE42());
    support_message("SSE4a", InstructionSet::SSE4a());
    support_message("SSSE3", InstructionSet::SSSE3());
    support_message("SYSCALL", InstructionSet::SYSCALL());
    support_message("TBM", InstructionSet::TBM());
    support_message("XOP", InstructionSet::XOP());
    support_message("XSAVE", InstructionSet::XSAVE());
 
    return 0;
}

◆ SeparateTo64BitValue()

string SeparateTo64BitValue ( UINT64 Value )

add ` between 64 bit values and convert them to string

Parameters

Value

Returns: string

{
    ostringstream OstringStream;
    string        Temp;
 
    OstringStream << setw(16) << setfill('0') << hex << Value;
    Temp = OstringStream.str();
 
    Temp.insert(8, 1, '`');
    return Temp;
}

◆ ShowMemoryCommandDB()

void ShowMemoryCommandDB	(	unsigned char *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in bytes (DB)

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

{
    unsigned int Character;
 
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (size_t j = 0; j < 16; j++)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("?? ");
            }
            else
            {
                ShowMessages("%02X ", OutputBuffer[i + j]);
            }
        }
 
        //
        // Print the character
        //
        ShowMessages(" ");
        for (size_t j = 0; j < 16; j++)
        {
            Character = (OutputBuffer[i + j]);
            if (isprint(Character))
            {
                ShowMessages("%c", Character);
            }
            else
            {
                ShowMessages(".");
            }
        }
 
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMemoryCommandDC()

void ShowMemoryCommandDC	(	unsigned char *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in dword format (DC)

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

{
    unsigned int Character;
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (size_t j = 0; j < 16; j += 4)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("???????? ");
            }
            else
            {
                UINT32 OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j]);
                ShowMessages("%08X ", OutputBufferVar);
            }
        }
 
        //
        // Print the character
        //
 
        ShowMessages(" ");
        for (size_t j = 0; j < 16; j++)
        {
            Character = (OutputBuffer[i + j]);
            if (isprint(Character))
            {
                ShowMessages("%c", Character);
            }
            else
            {
                ShowMessages(".");
            }
        }
 
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMemoryCommandDD()

void ShowMemoryCommandDD	(	unsigned char *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in dword format (DD)

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

{
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (size_t j = 0; j < 16; j += 4)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("???????? ");
            }
            else
            {
                UINT32 OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j]);
                ShowMessages("%08X ", OutputBufferVar);
            }
        }
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMemoryCommandDQ()

void ShowMemoryCommandDQ	(	unsigned char *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in qword format (DQ)

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

{
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (size_t j = 0; j < 16; j += 8)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("???????? ");
            }
            else
            {
                UINT32 OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j + 4]);
                ShowMessages("%08X`", OutputBufferVar);
 
                OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j]);
                ShowMessages("%08X ", OutputBufferVar);
            }
        }
 
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMessages()

VOID ShowMessages	(	const char *	Fmt,
			... )

Show messages.

Parameters

Fmt	format string message
...	arguments

Returns: VOID

Parameters

Fmt	format string message

{
    va_list ArgList;
    va_list Args;
    char    TempMessage[COMMUNICATION_BUFFER_SIZE + TCP_END_OF_BUFFER_CHARS_COUNT] = {0};
 
    if (g_MessageHandler == NULL && !g_IsConnectedToRemoteDebugger && !g_IsSerialConnectedToRemoteDebugger)
    {
        va_start(Args, Fmt);
 
        vprintf(Fmt, Args);
 
        va_end(Args);
 
        if (!g_LogOpened)
        {
            return;
        }
    }
 
    va_start(ArgList, Fmt);
 
    int SprintfResult = vsprintf_s(TempMessage, Fmt, ArgList);
 
    va_end(ArgList);
 
    if (SprintfResult != -1)
    {
        if (g_IsConnectedToRemoteDebugger)
        {
            //
            // vsprintf_s and vswprintf_s return the number of characters written,
            // not including the terminating null character, or a negative value
            // if an output error occurs.
            //
            RemoteConnectionSendResultsToHost(TempMessage, SprintfResult);
        }
        else if (g_IsSerialConnectedToRemoteDebugger)
        {
            KdSendUsermodePrints(TempMessage, SprintfResult);
        }
 
        if (g_LogOpened)
        {
            //
            // .logopen command executed
            //
            LogopenSaveToFile(TempMessage);
        }
        if (g_MessageHandler != NULL)
        {
            //
            // There is another handler
            //
            if (g_MessageHandlerSharedBuffer == NULL)
            {
                ((SendMessageWithParamCallback)g_MessageHandler)(TempMessage);
            }
            else
            {
                memcpy(g_MessageHandlerSharedBuffer, TempMessage, strlen(TempMessage) + 1);
                ((SendMessageWWithSharedBufferCallback)g_MessageHandler)();
            }
        }
    }
}

Variable Documentation

◆ g_DeviceHandle

HANDLE g_DeviceHandle

extern

Holds the global handle of device which is used to send the request to the kernel by IOCTL, this handle is not used for IRP Pending of message tracing this handle is used in KD VMM.

Classes

Macros

Typedefs

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ DEBUGGER_COMMAND_A_ATTRIBUTES

◆ DEBUGGER_COMMAND_ATTACH_ATTRIBUTES

◆ DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_CASE_SENSITIVE

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

◆ DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_BC_ATTRIBUTES

◆ DEBUGGER_COMMAND_BD_ATTRIBUTES

◆ DEBUGGER_COMMAND_BE_ATTRIBUTES

◆ DEBUGGER_COMMAND_BL_ATTRIBUTES

◆ DEBUGGER_COMMAND_BP_ATTRIBUTES

◆ DEBUGGER_COMMAND_CLEAR_ATTRIBUTES

◆ DEBUGGER_COMMAND_CONNECT_ATTRIBUTES

◆ DEBUGGER_COMMAND_CORE_ATTRIBUTES

◆ DEBUGGER_COMMAND_CPU_ATTRIBUTES

◆ DEBUGGER_COMMAND_CPUID_ATTRIBUTES

◆ DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES

◆ DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES

◆ DEBUGGER_COMMAND_DEBUG_ATTRIBUTES

◆ DEBUGGER_COMMAND_DETACH_ATTRIBUTES

◆ DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES

◆ DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES

◆ DEBUGGER_COMMAND_DR_ATTRIBUTES

◆ DEBUGGER_COMMAND_DT_ATTRIBUTES

◆ DEBUGGER_COMMAND_DUMP_ATTRIBUTES

◆ DEBUGGER_COMMAND_E_ATTRIBUTES

◆ DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES

◆ DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES

◆ DEBUGGER_COMMAND_EVAL_ATTRIBUTES

◆ DEBUGGER_COMMAND_EVENTS_ATTRIBUTES

◆ DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES

◆ DEBUGGER_COMMAND_EXIT_ATTRIBUTES

◆ DEBUGGER_COMMAND_FLUSH_ATTRIBUTES

◆ DEBUGGER_COMMAND_FORMATS_ATTRIBUTES

◆ DEBUGGER_COMMAND_G_ATTRIBUTES

◆ DEBUGGER_COMMAND_GU_ATTRIBUTES

◆ DEBUGGER_COMMAND_HELP_ATTRIBUTES

◆ DEBUGGER_COMMAND_HIDE_ATTRIBUTES

◆ DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES

◆ DEBUGGER_COMMAND_I_ATTRIBUTES

◆ DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES

◆ DEBUGGER_COMMAND_IOIN_ATTRIBUTES

◆ DEBUGGER_COMMAND_IOOUT_ATTRIBUTES

◆ DEBUGGER_COMMAND_K_ATTRIBUTES

◆ DEBUGGER_COMMAND_KILL_ATTRIBUTES

◆ DEBUGGER_COMMAND_LISTEN_ATTRIBUTES

◆ DEBUGGER_COMMAND_LM_ATTRIBUTES

◆ DEBUGGER_COMMAND_LOAD_ATTRIBUTES

◆ DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES

◆ DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES

◆ DEBUGGER_COMMAND_MEASURE_ATTRIBUTES

◆ DEBUGGER_COMMAND_MODE_ATTRIBUTES

◆ DEBUGGER_COMMAND_MONITOR_ATTRIBUTES

◆ DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES

◆ DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES

◆ DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES

◆ DEBUGGER_COMMAND_P_ATTRIBUTES

◆ DEBUGGER_COMMAND_PA2VA_ATTRIBUTES

◆ DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES

◆ DEBUGGER_COMMAND_PAUSE_ATTRIBUTES

◆ DEBUGGER_COMMAND_PE_ATTRIBUTES

◆ DEBUGGER_COMMAND_PMC_ATTRIBUTES

◆ DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES

◆ DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES

◆ DEBUGGER_COMMAND_PRINT_ATTRIBUTES

◆ DEBUGGER_COMMAND_PROCESS_ATTRIBUTES

◆ DEBUGGER_COMMAND_PTE_ATTRIBUTES

◆ DEBUGGER_COMMAND_R_ATTRIBUTES

◆ DEBUGGER_COMMAND_RDMSR_ATTRIBUTES