The hyperdbg command interpreter and driver connector. More...

Go to the source code of this file.

Classes
struct	_COMMAND_DETAIL
	Details of each command. More...

Macros
#define	DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE 0x1
	Different attributes of commands.
#define	DEBUGGER_COMMAND_ATTRIBUTE_EVENT 0x2 \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION 0x4
#define	DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER 0x8
#define	DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN 0x10
#define	DEBUGGER_COMMAND_ATTRIBUTE_HWDBG 0x20
#define	DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION
	Absolute local commands.
#define	DEBUGGER_COMMAND_CLEAR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
	Command's attributes.
#define	DEBUGGER_COMMAND_HELP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_CONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_LISTEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_G_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_GG_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_ATTACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN
#define	DEBUGGER_COMMAND_DETACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN
#define	DEBUGGER_COMMAND_SWITCH_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_CONTINUE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN
#define	DEBUGGER_COMMAND_PAUSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN
#define	DEBUGGER_COMMAND_START_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN
#define	DEBUGGER_COMMAND_RESTART_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN
#define	DEBUGGER_COMMAND_KILL_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_PROCESS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_THREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_SLEEP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_EVENTS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_DEBUG_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_STATUS_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_LOAD_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_EXIT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_FLUSH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PRINT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_EVAL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL
#define	DEBUGGER_COMMAND_TEST_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_CPU_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_WRMSR_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_RDMSR_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_VA2PA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PA2VA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_FORMATS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_PTE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_APIC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_IOAPIC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_CORE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_MONITOR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_VMCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_CPUID_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_XSETBV_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_TSC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_PMC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_DR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_IOIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_IOOUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_SYSRET_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_MODE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_TRACE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT
#define	DEBUGGER_COMMAND_HIDE_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_MEASURE_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_LM_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_P_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_T_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_I_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_E_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_S_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_R_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_BP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_BE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_BD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_BC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_BL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_SYM_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_X_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_K_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_DT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_STRUCT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PE_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_REV_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_TRACK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_DUMP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_GU_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE \| DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER
#define	DEBUGGER_COMMAND_HWDBG_HW_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_HWDBG
#define	DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_HWDBG
#define	DEBUGGER_COMMAND_A_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PCITREE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PCICAM_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_IDT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_SMI_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_LBR_ATTRIBUTES NULL
#define	DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define	DEBUGGER_COMMAND_PT_ATTRIBUTES NULL

Typedefs
typedef std::tuple< CommandParsingTokenType, std::string, std::string >	CommandToken
	Command's parsing type.
typedef VOID(*	CommandFuncTypeParser) (vector< CommandToken > CommandTokens, string Command)
	Command's function type.
typedef VOID(*	CommandHelpFuncType) ()
	Command's help function type.
typedef struct _COMMAND_DETAIL	COMMAND_DETAIL
	Details of each command.
typedef struct _COMMAND_DETAIL *	PCOMMAND_DETAIL
typedef std::map< std::string, COMMAND_DETAIL >	CommandType
	Type saving commands and mapping to command string.

Enumerations
enum	CommandParsingTokenType { Num , String , StringLiteral , BracketString }
	Command's parsing type (enum). More...

Functions
VOID	CommandSettingsLoadDefaultValuesFromConfigFile ()
	Loads default settings values from config file.
VOID	CommandSettingsSetValueFromConfigFile (std::string OptionName, std::string OptionValue)
	Sets the setting values from config file.
BOOLEAN	CommandSettingsGetValueFromConfigFile (std::string OptionName, std::string &OptionValue)
	Gets the setting values from config file.
VOID	CpuReadVendorString (CHAR *Result)
	Reads the CPU vendor string.
INT	ReadCpuDetails ()
	Print out supported instruction set extensions.
VOID	ShowMessages (const CHAR *Fmt,...)
	Show messages.
string	SeparateTo64BitValue (UINT64 Value)
VOID	ShowMemoryCommandDB (UCHAR *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in bytes (DB).
VOID	ShowMemoryCommandDD (UCHAR *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in dword format (DD).
VOID	ShowMemoryCommandDC (UCHAR *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in dword format (DC).
VOID	ShowMemoryCommandDQ (UCHAR *OutputBuffer, UINT32 Size, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, UINT64 Length)
	Show memory in qword format (DQ).
VOID	CommandPteShowResults (UINT64 TargetVa, PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PteRead)
	show results of !pte command
DEBUGGER_CONDITIONAL_JUMP_STATUS	HyperDbgIsConditionalJumpTaken (UCHAR *BufferToDisassemble, UINT64 BuffLength, RFLAGS Rflags, BOOLEAN Isx86_64)
	Check whether the jump is taken or not taken (in debugger).
INT	HyperDbgDisassembler64 (UCHAR *BufferToDisassemble, UINT64 BaseAddress, UINT64 Size, UINT32 MaximumInstrDecoded, BOOLEAN ShowBranchIsTakenOrNot, PRFLAGS Rflags)
	Disassemble x64 assemblies.
INT	HyperDbgDisassembler32 (UCHAR *BufferToDisassemble, UINT64 BaseAddress, UINT64 Size, UINT32 MaximumInstrDecoded, BOOLEAN ShowBranchIsTakenOrNot, PRFLAGS Rflags)
	Disassemble 32 bit assemblies.
UINT32	HyperDbgLengthDisassemblerEngine (UCHAR *BufferToDisassemble, UINT64 BuffLength, BOOLEAN Isx86_64)
	Length Disassembler engine based on Zydis.
BOOLEAN	HyperDbgCheckWhetherTheCurrentInstructionIsCall (UCHAR *BufferToDisassemble, UINT64 BuffLength, BOOLEAN Isx86_64, PUINT32 CallLength)
	Check whether the current instruction is a 'call' or not.
BOOLEAN	HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet (UCHAR *BufferToDisassemble, UINT64 CurrentRip, UINT32 BuffLength, BOOLEAN Isx86_64, PBOOLEAN IsRet)
	Check whether the current instruction is a 'call' or 'ret' or not.
BOOLEAN	HyperDbgCheckWhetherTheCurrentInstructionIsRet (UCHAR *BufferToDisassemble, UINT64 BuffLength, BOOLEAN Isx86_64)
	Check whether the current instruction is a 'ret' or not.
UINT32	HyperDbgGetImmediateValueOnEaxForSyscallNumber (UCHAR *BufferToDisassemble, UINT64 BuffLength, BOOLEAN Isx86_64)
	Get immediate value on EAX register.
VOID	HyperDbgShowMemoryOrDisassemble (DEBUGGER_SHOW_MEMORY_STYLE Style, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, DEBUGGER_READ_READING_TYPE ReadingType, UINT32 Pid, UINT32 Size, PDEBUGGER_DT_COMMAND_OPTIONS DtDetails)
	Show memory or disassembler.
BOOLEAN	HyperDbgReadMemory (UINT64 TargetAddress, DEBUGGER_READ_MEMORY_TYPE MemoryType, DEBUGGER_READ_READING_TYPE ReadingType, UINT32 Pid, UINT32 Size, BOOLEAN GetAddressMode, DEBUGGER_READ_MEMORY_ADDRESS_MODE AddressMode, BYTE TargetBufferToStore, UINT32 *ReturnLength)
	Read memory and disassembler.
VOID	InitializeCommandsDictionary ()
	Initialize commands and attributes.
VOID	InitializeDebugger ()
	Initialize the debugger and adjust commands for the first run.
BOOLEAN	CheckMultilineCommand (CHAR *CurrentCommand, BOOLEAN Reset)
	check for multi-line commands
BOOLEAN	ContinuePreviousCommand ()
	Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.
VOID	CommandDumpSaveIntoFile (PVOID Buffer, UINT32 Length)
	Saves the received buffers into the files.
VOID	CommandTest (vector< CommandToken > CommandTokens, string Command)
	test command handler
VOID	CommandCls (vector< CommandToken > CommandTokens, string Command)
	.cls command handler
VOID	CommandReadMemoryAndDisassembler (vector< CommandToken > CommandTokens, string Command)
	u* d* !u* !d* commands handler
VOID	CommandConnect (vector< CommandToken > CommandTokens, string Command)
	.connect command handler
VOID	CommandLoad (vector< CommandToken > CommandTokens, string Command)
	load command handler
VOID	CommandUnload (vector< CommandToken > CommandTokens, string Command)
	unload command handler
VOID	CommandScript (vector< CommandToken > CommandTokens, string Command)
	.script command handler
VOID	CommandCpu (vector< CommandToken > CommandTokens, string Command)
	cpu command handler
VOID	CommandExit (vector< CommandToken > CommandTokens, string Command)
	exit command handler
VOID	CommandDisconnect (vector< CommandToken > CommandTokens, string Command)
	.disconnect command handler
VOID	CommandFormats (vector< CommandToken > CommandTokens, string Command)
	handler of .formats command
VOID	CommandRdmsr (vector< CommandToken > CommandTokens, string Command)
	rdmsr command handler
VOID	CommandWrmsr (vector< CommandToken > CommandTokens, string Command)
	wrmsr command handler
VOID	CommandPte (vector< CommandToken > CommandTokens, string Command)
	!pte command handler
VOID	CommandMonitor (vector< CommandToken > CommandTokens, string Command)
	!monitor command handler
VOID	CommandSyscallAndSysret (vector< CommandToken > CommandTokens, string Command)
	!syscall, !syscall2 and !sysret, !sysret2 commands handler
VOID	CommandEptHook (vector< CommandToken > CommandTokens, string Command)
	!epthook command handler
VOID	CommandEptHook2 (vector< CommandToken > CommandTokens, string Command)
	!epthook2 command handler
VOID	CommandCpuid (vector< CommandToken > CommandTokens, string Command)
	!cpuid command handler
VOID	CommandMsrread (vector< CommandToken > CommandTokens, string Command)
	!msrread command handler
VOID	CommandMsrwrite (vector< CommandToken > CommandTokens, string Command)
	!msrwrite command handler
VOID	CommandTsc (vector< CommandToken > CommandTokens, string Command)
	handler of !tsc command
VOID	CommandPmc (vector< CommandToken > CommandTokens, string Command)
	!pmc command handler
VOID	CommandException (vector< CommandToken > CommandTokens, string Command)
	!exception command handler
VOID	CommandCrwrite (vector< CommandToken > CommandTokens, string Command)
	!crwrite command handler
VOID	CommandDr (vector< CommandToken > CommandTokens, string Command)
	!dr command handler
VOID	CommandInterrupt (vector< CommandToken > CommandTokens, string Command)
	!interrupt command handler
VOID	CommandIoin (vector< CommandToken > CommandTokens, string Command)
	!ioin command handler
VOID	CommandIoout (vector< CommandToken > CommandTokens, string Command)
	!ioout command handler
VOID	CommandVmcall (vector< CommandToken > CommandTokens, string Command)
	!vmcall command handler
VOID	CommandMode (vector< CommandToken > CommandTokens, string Command)
	!mode command handler
VOID	CommandTrace (vector< CommandToken > CommandTokens, string Command)
	!trace command handler
VOID	CommandHide (vector< CommandToken > CommandTokens, string Command)
	!hide command handler
VOID	CommandUnhide (vector< CommandToken > CommandTokens, string Command)
	!unhide command handler
VOID	CommandLogopen (vector< CommandToken > CommandTokens, string Command)
	.logopen command handler
VOID	CommandLogclose (vector< CommandToken > CommandTokens, string Command)
	.logclose command handler
VOID	CommandVa2pa (vector< CommandToken > CommandTokens, string Command)
	!va2pa command handler
VOID	CommandPa2va (vector< CommandToken > CommandTokens, string Command)
	!pa2va command handler
VOID	CommandEvents (vector< CommandToken > CommandTokens, string Command)
	events command handler
VOID	CommandG (vector< CommandToken > CommandTokens, string Command)
	handler of g command
VOID	CommandContinue (vector< CommandToken > CommandTokens, string Command)
	handler of continue command
VOID	CommandGg (vector< CommandToken > CommandTokens, string Command)
	gg command handler
VOID	CommandLm (vector< CommandToken > CommandTokens, string Command)
	handle lm command
VOID	CommandSleep (vector< CommandToken > CommandTokens, string Command)
	sleep command help
VOID	CommandEditMemory (vector< CommandToken > CommandTokens, string Command)
	!e* and e* commands handler
VOID	CommandSearchMemory (vector< CommandToken > CommandTokens, string Command)
	!s* s* commands handler
VOID	CommandMeasure (vector< CommandToken > CommandTokens, string Command)
	!measure command handler
VOID	CommandSettings (vector< CommandToken > CommandTokens, string Command)
	settings command handler
VOID	CommandFlush (vector< CommandToken > CommandTokens, string Command)
	flush command handler
VOID	CommandPause (vector< CommandToken > CommandTokens, string Command)
	pause command handler
VOID	CommandListen (vector< CommandToken > CommandTokens, string Command)
	listen command handler
VOID	CommandStatus (vector< CommandToken > CommandTokens, string Command)
	.status and status command handler
VOID	CommandAttach (vector< CommandToken > CommandTokens, string Command)
	.attach command handler
VOID	CommandDetach (vector< CommandToken > CommandTokens, string Command)
	.detach command handler
VOID	CommandStart (vector< CommandToken > CommandTokens, string Command)
	.start command handler
VOID	CommandRestart (vector< CommandToken > CommandTokens, string Command)
	.restart command handler
VOID	CommandSwitch (vector< CommandToken > CommandTokens, string Command)
	.switch command handler
VOID	CommandKill (vector< CommandToken > CommandTokens, string Command)
	.kill command handler
VOID	CommandT (vector< CommandToken > CommandTokens, string Command)
	handler of t command
VOID	CommandI (vector< CommandToken > CommandTokens, string Command)
	handler of i command
VOID	CommandPrint (vector< CommandToken > CommandTokens, string Command)
	handler of print command
VOID	CommandOutput (vector< CommandToken > CommandTokens, string Command)
	output command handler
VOID	CommandDebug (vector< CommandToken > CommandTokens, string Command)
	.debug command handler
VOID	CommandP (vector< CommandToken > CommandTokens, string Command)
	handler of p command
VOID	CommandCore (vector< CommandToken > CommandTokens, string Command)
	~ command handler
VOID	CommandProcess (vector< CommandToken > CommandTokens, string Command)
	.process command handler
VOID	CommandThread (vector< CommandToken > CommandTokens, string Command)
	.thread command handler
VOID	CommandEval (vector< CommandToken > CommandTokens, string Command)
	handler of ? command
VOID	CommandR (vector< CommandToken > CommandTokens, string Command)
	handler of r command
VOID	CommandBp (vector< CommandToken > CommandTokens, string Command)
	bp command handler
VOID	CommandBl (vector< CommandToken > CommandTokens, string Command)
	handler of the bl command
VOID	CommandBe (vector< CommandToken > CommandTokens, string Command)
	handler of be command
VOID	CommandBd (vector< CommandToken > CommandTokens, string Command)
	handler of bd command
VOID	CommandBc (vector< CommandToken > CommandTokens, string Command)
	handler of bc command
VOID	CommandSympath (vector< CommandToken > CommandTokens, string Command)
	.sympath command handler
VOID	CommandSym (vector< CommandToken > CommandTokens, string Command)
	.sym command handler
VOID	CommandX (vector< CommandToken > CommandTokens, string Command)
	x command handler
VOID	CommandPrealloc (vector< CommandToken > CommandTokens, string Command)
	prealloc command handler
VOID	CommandPreactivate (vector< CommandToken > CommandTokens, string Command)
	preactivate command handler
VOID	CommandDtAndStruct (vector< CommandToken > CommandTokens, string Command)
	dt and struct command handler
VOID	CommandK (vector< CommandToken > CommandTokens, string Command)
	k command handler
VOID	CommandPe (vector< CommandToken > CommandTokens, string Command)
	.pe command handler
VOID	CommandRev (vector< CommandToken > CommandTokens, string Command)
	!rev command handler
VOID	CommandApic (vector< CommandToken > CommandTokens, string Command)
	!apic command handler
VOID	CommandIoapic (vector< CommandToken > CommandTokens, string Command)
	!ioapic command handler
VOID	CommandTrack (vector< CommandToken > CommandTokens, string Command)
	handler of !track command
VOID	CommandPagein (vector< CommandToken > CommandTokens, string Command)
	.pagein command handler
VOID	CommandDump (vector< CommandToken > CommandTokens, string Command)
	.dump command handler
VOID	CommandGu (vector< CommandToken > CommandTokens, string Command)
	handler of gu command
VOID	CommandAssemble (vector< CommandToken > CommandTokens, string Command)
	a and !a commands handler
VOID	CommandPcitree (vector< CommandToken > CommandTokens, string Command)
	!pcitree command handler
VOID	CommandPcicam (vector< CommandToken > CommandTokens, string Command)
	!pcicam command handler
VOID	CommandIdt (vector< CommandToken > CommandTokens, string Command)
	!idt command handler
VOID	CommandSmi (vector< CommandToken > CommandTokens, string Command)
	!smi command handler
VOID	CommandLbr (vector< CommandToken > CommandTokens, string Command)
	!lbr command handler
VOID	CommandLbrdump (vector< CommandToken > CommandTokens, string Command)
	!lbrdump command handler
VOID	CommandPt (vector< CommandToken > CommandTokens, string Command)
	!pt command handler
VOID	CommandHwClk (vector< CommandToken > CommandTokens, string Command)
	!hw_clk command handler
VOID	CommandHw (vector< CommandToken > CommandTokens, string Command)
	!hw command handler
VOID	CommandXsetbv (vector< CommandToken > CommandTokens, string Command)
	!xsetbv command handler
VOID	CommandXsetbvHelp ()
	help of the !xsetbv command

Variables
HANDLE	g_DeviceHandle
	Holds the global handle of device which is used to send the request to the kernel by IOCTL, this handle is not used for IRP Pending of message tracing this handle is used in KD VMM.

Detailed Description

The hyperdbg command interpreter and driver connector.

Author: Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org); Alee Amini (alee@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version: 0.1

Date: 2020-04-11

Copyright: This project is released under the GNU Public License v3.

Macro Definition Documentation

◆ DEBUGGER_COMMAND_A_ATTRIBUTES

#define DEBUGGER_COMMAND_A_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

465#define DEBUGGER_COMMAND_A_ATTRIBUTES \

466 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_APIC_ATTRIBUTES

#define DEBUGGER_COMMAND_APIC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_ATTACH_ATTRIBUTES

#define DEBUGGER_COMMAND_ATTACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

#define DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

Absolute local commands.

224#define DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL \

225 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

◆ DEBUGGER_COMMAND_ATTRIBUTE_EVENT

#define DEBUGGER_COMMAND_ATTRIBUTE_EVENT 0x2 | DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

#define DEBUGGER_COMMAND_ATTRIBUTE_HWDBG 0x20

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

#define DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE 0x1

Different attributes of commands.

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

#define DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION 0x4

◆ DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

#define DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER 0x8

◆ DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

#define DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN 0x10

◆ DEBUGGER_COMMAND_BC_ATTRIBUTES

#define DEBUGGER_COMMAND_BC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

419#define DEBUGGER_COMMAND_BC_ATTRIBUTES \

420 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BD_ATTRIBUTES

#define DEBUGGER_COMMAND_BD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

416#define DEBUGGER_COMMAND_BD_ATTRIBUTES \

417 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BE_ATTRIBUTES

#define DEBUGGER_COMMAND_BE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

413#define DEBUGGER_COMMAND_BE_ATTRIBUTES \

414 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BL_ATTRIBUTES

#define DEBUGGER_COMMAND_BL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

422#define DEBUGGER_COMMAND_BL_ATTRIBUTES \

423 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_BP_ATTRIBUTES

#define DEBUGGER_COMMAND_BP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

410#define DEBUGGER_COMMAND_BP_ATTRIBUTES \

411 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_CLEAR_ATTRIBUTES

#define DEBUGGER_COMMAND_CLEAR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

Command's attributes.

231#define DEBUGGER_COMMAND_CLEAR_ATTRIBUTES \

232 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_CONNECT_ATTRIBUTES

#define DEBUGGER_COMMAND_CONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

237#define DEBUGGER_COMMAND_CONNECT_ATTRIBUTES \

238 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_CONTINUE_ATTRIBUTES

#define DEBUGGER_COMMAND_CONTINUE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_CORE_ATTRIBUTES

#define DEBUGGER_COMMAND_CORE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

338#define DEBUGGER_COMMAND_CORE_ATTRIBUTES \

339 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_CPU_ATTRIBUTES

#define DEBUGGER_COMMAND_CPU_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_CPUID_ATTRIBUTES

#define DEBUGGER_COMMAND_CPUID_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES

#define DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES

#define DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

398#define DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES \

399 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_DEBUG_ATTRIBUTES

#define DEBUGGER_COMMAND_DEBUG_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

281#define DEBUGGER_COMMAND_DEBUG_ATTRIBUTES \

282 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_DETACH_ATTRIBUTES

#define DEBUGGER_COMMAND_DETACH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES

#define DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

278#define DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES \

279 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES

#define DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

284#define DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES \

285 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_DR_ATTRIBUTES

#define DEBUGGER_COMMAND_DR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_DT_ATTRIBUTES

#define DEBUGGER_COMMAND_DT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

441#define DEBUGGER_COMMAND_DT_ATTRIBUTES \

442 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_DUMP_ATTRIBUTES

#define DEBUGGER_COMMAND_DUMP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

455#define DEBUGGER_COMMAND_DUMP_ATTRIBUTES \

456 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_E_ATTRIBUTES

#define DEBUGGER_COMMAND_E_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

401#define DEBUGGER_COMMAND_E_ATTRIBUTES \

402 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES

#define DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES

#define DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_EVAL_ATTRIBUTES

#define DEBUGGER_COMMAND_EVAL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

308#define DEBUGGER_COMMAND_EVAL_ATTRIBUTES \

309 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_EVENTS_ATTRIBUTES

#define DEBUGGER_COMMAND_EVENTS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

272#define DEBUGGER_COMMAND_EVENTS_ATTRIBUTES \

273 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES

#define DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_EXIT_ATTRIBUTES

#define DEBUGGER_COMMAND_EXIT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

291#define DEBUGGER_COMMAND_EXIT_ATTRIBUTES \

292 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_FLUSH_ATTRIBUTES

#define DEBUGGER_COMMAND_FLUSH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

294#define DEBUGGER_COMMAND_FLUSH_ATTRIBUTES \

295 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_FORMATS_ATTRIBUTES

#define DEBUGGER_COMMAND_FORMATS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

329#define DEBUGGER_COMMAND_FORMATS_ATTRIBUTES \

330 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_G_ATTRIBUTES

#define DEBUGGER_COMMAND_G_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_GG_ATTRIBUTES

#define DEBUGGER_COMMAND_GG_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_GU_ATTRIBUTES

#define DEBUGGER_COMMAND_GU_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

458#define DEBUGGER_COMMAND_GU_ATTRIBUTES \

459 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_HELP_ATTRIBUTES

#define DEBUGGER_COMMAND_HELP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

234#define DEBUGGER_COMMAND_HELP_ATTRIBUTES \

235 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_HIDE_ATTRIBUTES

#define DEBUGGER_COMMAND_HIDE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_HWDBG_HW_ATTRIBUTES

#define DEBUGGER_COMMAND_HWDBG_HW_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

◆ DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES

#define DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

◆ DEBUGGER_COMMAND_I_ATTRIBUTES

#define DEBUGGER_COMMAND_I_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

395#define DEBUGGER_COMMAND_I_ATTRIBUTES \

396 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_IDT_ATTRIBUTES

#define DEBUGGER_COMMAND_IDT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

474#define DEBUGGER_COMMAND_IDT_ATTRIBUTES \

475 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES

#define DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_IOAPIC_ATTRIBUTES

#define DEBUGGER_COMMAND_IOAPIC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_IOIN_ATTRIBUTES

#define DEBUGGER_COMMAND_IOIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_IOOUT_ATTRIBUTES

#define DEBUGGER_COMMAND_IOOUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_K_ATTRIBUTES

#define DEBUGGER_COMMAND_K_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

438#define DEBUGGER_COMMAND_K_ATTRIBUTES \

439 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_KILL_ATTRIBUTES

#define DEBUGGER_COMMAND_KILL_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_LBR_ATTRIBUTES

#define DEBUGGER_COMMAND_LBR_ATTRIBUTES NULL

480#define DEBUGGER_COMMAND_LBR_ATTRIBUTES \

481 NULL

◆ DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES

#define DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

483#define DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES \

484 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_LISTEN_ATTRIBUTES

#define DEBUGGER_COMMAND_LISTEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

240#define DEBUGGER_COMMAND_LISTEN_ATTRIBUTES \

241 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_LM_ATTRIBUTES

#define DEBUGGER_COMMAND_LM_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_LOAD_ATTRIBUTES

#define DEBUGGER_COMMAND_LOAD_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES

#define DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

314#define DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES \

315 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES

#define DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

311#define DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES \

312 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_MEASURE_ATTRIBUTES

#define DEBUGGER_COMMAND_MEASURE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_MODE_ATTRIBUTES

#define DEBUGGER_COMMAND_MODE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_MONITOR_ATTRIBUTES

#define DEBUGGER_COMMAND_MONITOR_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES

#define DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES

#define DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES

#define DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

302#define DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES \

303 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_P_ATTRIBUTES

#define DEBUGGER_COMMAND_P_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

389#define DEBUGGER_COMMAND_P_ATTRIBUTES \

390 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_PA2VA_ATTRIBUTES

#define DEBUGGER_COMMAND_PA2VA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES

#define DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PAUSE_ATTRIBUTES

#define DEBUGGER_COMMAND_PAUSE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_PCICAM_ATTRIBUTES

#define DEBUGGER_COMMAND_PCICAM_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

471#define DEBUGGER_COMMAND_PCICAM_ATTRIBUTES \

472 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PCITREE_ATTRIBUTES

#define DEBUGGER_COMMAND_PCITREE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

468#define DEBUGGER_COMMAND_PCITREE_ATTRIBUTES \

469 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PE_ATTRIBUTES

#define DEBUGGER_COMMAND_PE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_PMC_ATTRIBUTES

#define DEBUGGER_COMMAND_PMC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES

#define DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES

#define DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_PRINT_ATTRIBUTES

#define DEBUGGER_COMMAND_PRINT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

305#define DEBUGGER_COMMAND_PRINT_ATTRIBUTES \

306 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_PROCESS_ATTRIBUTES

#define DEBUGGER_COMMAND_PROCESS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

263#define DEBUGGER_COMMAND_PROCESS_ATTRIBUTES \

264 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_PT_ATTRIBUTES

#define DEBUGGER_COMMAND_PT_ATTRIBUTES NULL

486#define DEBUGGER_COMMAND_PT_ATTRIBUTES \

487 NULL

◆ DEBUGGER_COMMAND_PTE_ATTRIBUTES

#define DEBUGGER_COMMAND_PTE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_R_ATTRIBUTES

#define DEBUGGER_COMMAND_R_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

407#define DEBUGGER_COMMAND_R_ATTRIBUTES \

408 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_RDMSR_ATTRIBUTES

#define DEBUGGER_COMMAND_RDMSR_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_RESTART_ATTRIBUTES

#define DEBUGGER_COMMAND_RESTART_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_REV_ATTRIBUTES

#define DEBUGGER_COMMAND_REV_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_S_ATTRIBUTES

#define DEBUGGER_COMMAND_S_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

404#define DEBUGGER_COMMAND_S_ATTRIBUTES \

405 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES

#define DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

299#define DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES \

300 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES

#define DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

275#define DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES \

276 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_SLEEP_ATTRIBUTES

#define DEBUGGER_COMMAND_SLEEP_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

269#define DEBUGGER_COMMAND_SLEEP_ATTRIBUTES \

270 DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_SMI_ATTRIBUTES

#define DEBUGGER_COMMAND_SMI_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

477#define DEBUGGER_COMMAND_SMI_ATTRIBUTES \

478 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_START_ATTRIBUTES

#define DEBUGGER_COMMAND_START_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_STATUS_ATTRIBUTES

#define DEBUGGER_COMMAND_STATUS_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_STRUCT_ATTRIBUTES

#define DEBUGGER_COMMAND_STRUCT_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

444#define DEBUGGER_COMMAND_STRUCT_ATTRIBUTES \

445 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_SWITCH_ATTRIBUTES

#define DEBUGGER_COMMAND_SWITCH_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_SYM_ATTRIBUTES

#define DEBUGGER_COMMAND_SYM_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

428#define DEBUGGER_COMMAND_SYM_ATTRIBUTES \

429 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES

#define DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

425#define DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES \

426 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES

#define DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_SYSRET_ATTRIBUTES

#define DEBUGGER_COMMAND_SYSRET_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_T_ATTRIBUTES

#define DEBUGGER_COMMAND_T_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

392#define DEBUGGER_COMMAND_T_ATTRIBUTES \

393 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE | DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_TEST_ATTRIBUTES

#define DEBUGGER_COMMAND_TEST_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_THREAD_ATTRIBUTES

#define DEBUGGER_COMMAND_THREAD_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

266#define DEBUGGER_COMMAND_THREAD_ATTRIBUTES \

267 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_TRACE_ATTRIBUTES

#define DEBUGGER_COMMAND_TRACE_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_TRACK_ATTRIBUTES

#define DEBUGGER_COMMAND_TRACK_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_TSC_ATTRIBUTES

#define DEBUGGER_COMMAND_TSC_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES

#define DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES

#define DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_VA2PA_ATTRIBUTES

#define DEBUGGER_COMMAND_VA2PA_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_VMCALL_ATTRIBUTES

#define DEBUGGER_COMMAND_VMCALL_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_WRMSR_ATTRIBUTES

#define DEBUGGER_COMMAND_WRMSR_ATTRIBUTES NULL

◆ DEBUGGER_COMMAND_X_ATTRIBUTES

#define DEBUGGER_COMMAND_X_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

431#define DEBUGGER_COMMAND_X_ATTRIBUTES \

432 DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_XSETBV_ATTRIBUTES

#define DEBUGGER_COMMAND_XSETBV_ATTRIBUTES DEBUGGER_COMMAND_ATTRIBUTE_EVENT

Typedef Documentation

◆ COMMAND_DETAIL

typedef struct _COMMAND_DETAIL COMMAND_DETAIL

Details of each command.

◆ CommandFuncTypeParser

typedef VOID(* CommandFuncTypeParser) (vector< CommandToken > CommandTokens, string Command)

Command's function type.

◆ CommandHelpFuncType

typedef VOID(* CommandHelpFuncType) ()

Command's help function type.

◆ CommandToken

typedef std::tuple<CommandParsingTokenType, std::string, std::string> CommandToken

Command's parsing type.

◆ CommandType

typedef std::map<std::string, COMMAND_DETAIL> CommandType

Type saving commands and mapping to command string.

◆ PCOMMAND_DETAIL

typedef struct _COMMAND_DETAIL * PCOMMAND_DETAIL

Enumeration Type Documentation

◆ CommandParsingTokenType

enum CommandParsingTokenType

Command's parsing type (enum).

Enumerator
Num
String
StringLiteral
BracketString

{
    Num,
    String,
    StringLiteral,
    BracketString
} CommandParsingTokenType;

Function Documentation

◆ CheckMultilineCommand()

BOOLEAN CheckMultilineCommand	(	CHAR *	CurrentCommand,
		BOOLEAN	Reset )

check for multi-line commands

Parameters

CurrentCommand
Reset

Returns: BOOLEAN return TRUE if the command needs extra input, otherwise return FALSE

{
    UINT32      CurrentCommandLen = 0;
    std::string CurrentCommandStr(CurrentCommand);
 
    if (Reset)
    {
        g_IsInterpreterOnString                    = FALSE;
        g_IsInterpreterPreviousCharacterABackSlash = FALSE;
        g_InterpreterCountOfOpenCurlyBrackets      = 0;
    }
 
    CurrentCommandLen = (UINT32)CurrentCommandStr.length();
 
    for (SIZE_T i = 0; i < CurrentCommandLen; i++)
    {
        switch (CurrentCommandStr.at(i))
        {
        case '"':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
            {
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
                break; // it's an escaped \" double-quote
            }
 
            if (g_IsInterpreterOnString)
                g_IsInterpreterOnString = FALSE;
            else
                g_IsInterpreterOnString = TRUE;
 
            break;
 
        case '{':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
 
            if (!g_IsInterpreterOnString)
                g_InterpreterCountOfOpenCurlyBrackets++;
 
            break;
 
        case '}':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
 
            if (!g_IsInterpreterOnString && g_InterpreterCountOfOpenCurlyBrackets > 0)
                g_InterpreterCountOfOpenCurlyBrackets--;
 
            break;
 
        case '\\':
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE; // it's not a escape character (two backslashes \\ )
            else
                g_IsInterpreterPreviousCharacterABackSlash = TRUE;
 
            break;
 
        default:
 
            if (g_IsInterpreterPreviousCharacterABackSlash)
                g_IsInterpreterPreviousCharacterABackSlash = FALSE;
 
            break;
        }
    }
 
    if (g_IsInterpreterOnString == FALSE && g_InterpreterCountOfOpenCurlyBrackets == 0)
    {
        //
        // either the command is finished or it's a single
        // line command
        //
        return FALSE;
    }
    else
    {
        //
        // There still other lines, this command is incomplete
        //
        return TRUE;
    }
}

◆ CommandApic()

VOID CommandApic	(	vector< CommandToken >	CommandTokens,
		string	Command )

!apic command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOLEAN    IsUsingX2APIC = FALSE;
    UINT8      i = 0, j = 0;
    UINT32     k         = 0;
    UINT32     Reg       = 0;
    LAPIC_PAGE LocalApic = {0};
 
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandApicHelp();
        return;
    }
 
    //
    // Get the local APIC results
    //
    if (HyperDbgGetLocalApic(&LocalApic, &IsUsingX2APIC) == FALSE)
    {
        return;
    }
 
    //
    // Show different fields of the Local APIC
    //
    ShowMessages("***  (%s Mode) PHYSICAL LAPIC ID = %u, Ver = 0x%x, MaxLvtEntry = %d, DirectedEOI = P%d/E%d, (SW: '%s')\n"
                 "     -> TPR = 0x%08x,  PPR = 0x%08x\n"
                 "     -> LDR = 0x%08x,  SVR = 0x%08x,  Err = 0x%08x\n"
                 "     -> LVT_INT0 = 0x%08x,  LVT_INT1 = 0x%08x\n"
                 "     -> LVT_CMCI = 0x%08x,  LVT_PMCR = 0x%08x\n"
                 "     -> LVT_TMR  = 0x%08x,  LVT_TSR  = 0x%08x\n"
                 "     -> LVT_ERR  = 0x%08x\n"
                 "     -> InitialCount = 0x%08x, CurrentCount = 0x%08x, DivideConfig = 0x%08x\n",
                 IsUsingX2APIC ? "X2APIC" : "XAPIC",
                 LocalApic.Id >> 24,
                 LocalApic.Version,
                 (LocalApic.Version & 0xFF0000) >> 16,
                 (LocalApic.Version >> 24) & 1,
                 (LocalApic.SpuriousInterruptVector >> 12) & 1,
                 (LocalApic.SpuriousInterruptVector & LAPIC_SVR_FLAG_SW_ENABLE) != 0 ? "Enabled" : "Disabled",
                 LocalApic.TPR,
                 LocalApic.ProcessorPriority,
                 LocalApic.LogicalDestination,
                 LocalApic.SpuriousInterruptVector,
                 LocalApic.ErrorStatus,
                 LocalApic.LvtLINT0,
                 LocalApic.LvtLINT1,
                 LocalApic.LvtCmci,
                 LocalApic.LvtPerfMonCounters,
                 LocalApic.LvtTimer,
                 LocalApic.LvtThermalSensor,
                 LocalApic.LvtError,
                 LocalApic.InitialCount,
                 LocalApic.CurrentCount,
                 LocalApic.DivideConfiguration);
 
    //
    // Print the ISR, TMR and IRR
    //
    ShowMessages("ISR : ");
 
    for (i = 0; i < 8; i++)
    {
        k   = 1;
        Reg = (UINT32)LocalApic.ISR[i * 4];
        for (j = 0; j < 32; j++)
        {
            if (0 != (Reg & k))
            {
                ShowMessages("0x%02hhx ", (UINT8)(i * 32 + j));
            }
            k = k << 1;
        }
    }
    ShowMessages("\n");
 
    ShowMessages("TMR : ");
 
    for (i = 0; i < 8; i++)
    {
        k   = 1;
        Reg = (UINT32)LocalApic.TMR[i * 4];
        for (j = 0; j < 32; j++)
        {
            if (Reg & k)
            {
                ShowMessages("0x%02hhx ", (UINT8)(i * 32 + j));
            }
            k = k << 1;
        }
    }
 
    ShowMessages("\n");
 
    ShowMessages("IRR : ");
 
    for (i = 0; i < 8; i++)
    {
        k   = 1;
        Reg = (UINT32)LocalApic.IRR[i * 4];
        for (j = 0; j < 32; j++)
        {
            if (Reg & k)
            {
                ShowMessages("0x%02hhx ", (UINT8)(i * 32 + j));
            }
            k = k << 1;
        }
    }
 
    ShowMessages("\n");
}

◆ CommandAssemble()

VOID CommandAssemble	(	vector< CommandToken >	CommandTokens,
		string	Command )

a and !a commands handler

Parameters

CommandTokens
Command

Returns: VOID

{
    DEBUGGER_EDIT_MEMORY_TYPE MemoryType {};
    _CMD                      CMD {};
    UINT64                    Address {};
    UINT64                    StartAddress {};
    UINT32                    ProcId = 0;
 
    CMD = ParseUserCmd(Command);
 
    if (CMD.isEmpty())
    {
        //
        // Error messages are already printed
        //
        return;
    }
 
    if (!CMD.ProcIdStr.empty())
    {
        if (!ConvertStringToUInt32(CMD.ProcIdStr, &ProcId))
        {
            ShowMessages("please specify a correct hex process id\n\n");
            CommandAssembleHelp();
            return;
        }
    }
 
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ProcId = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CMD.AsmSnippet.empty())
    {
        ShowMessages("no assembly snippet provided\n");
        CommandAssembleHelp();
        return;
    }
    else if (CMD.CommandStr == "a")
    {
        MemoryType = EDIT_VIRTUAL_MEMORY;
    }
    else if (CMD.CommandStr == "!a")
    {
        MemoryType = EDIT_PHYSICAL_MEMORY;
    }
    else
    {
        ShowMessages("unknown assemble command\n\n");
        CommandAssembleHelp();
        return;
    }
 
    //
    // Fetching start_address i.e. address to assemble to
    //
    if (!CMD.AddressStr.empty()) // was any address provided to assemble to?
    {
        if (!SymbolConvertNameOrExprToAddress(CMD.AddressStr, &Address))
        {
            ShowMessages("err, couldn't resolve Address at '%s'\n\n",
                         CMD.AddressStr.c_str());
            CommandAssembleHelp();
            return;
        }
    }
    else if (!CMD.StartAddressStr.empty()) // was a custom start_address provided?
    {
        if (!SymbolConvertNameOrExprToAddress(CMD.StartAddressStr, &StartAddress))
        {
            ShowMessages("err, couldn't resolve Address at '%s'\n\n",
                         CMD.StartAddressStr.c_str());
            CommandAssembleHelp();
            return;
        }
        Address = StartAddress;
    }
    else
    {
        ShowMessages("warning, no start address provided to calculate relative asm commands\n\n");
    }
 
    AssembleData AssembleData;
    AssembleData.AsmRaw = CMD.AsmSnippet; // third element
    AssembleData.ParseAssemblyData();
 
    if (AssembleData.Assemble(Address))
    {
        ShowMessages("err, code: '%u'\n\n", AssembleData.KsErr);
        CommandAssembleHelp();
        return;
    }
 
    if (ProcId == 0)
    {
        ProcId = PlatformGetCurrentProcessId();
    }
 
    if (Address) // was the user only trying to get the bytes?
    {
        if (HyperDbgWriteMemory(
                (PVOID)Address,
                MemoryType,
                ProcId,
                (PVOID)AssembleData.EncodedBytes,
                (UINT32)AssembleData.BytesCount))
        {
            ShowMessages("successfully assembled at 0x%016llx address\n", static_cast<UINT64>(Address));
        }
        else
        {
            ShowMessages("failed to write generated assembly to memory\n");
        }
    }
}

◆ CommandAttach()

VOID CommandAttach	(	vector< CommandToken >	CommandTokens,
		string	Command )

.attach command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32  TargetPid = 0;
    BOOLEAN NextIsPid = FALSE;
 
    //
    // Disable user-mode debugger in this version
    //
#if ActivateUserModeDebugger == FALSE
 
    if (!g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("the user-mode debugger in VMI Mode is still in the beta version and not stable. "
                     "we decided to exclude it from this release and release it in future versions. "
                     "if you want to test the user-mode debugger in VMI Mode, you should build "
                     "HyperDbg with special instructions. But attaching/switching to other processes\n"
                     "are fully supported in the Debugger Mode.\n"
                     "(it's not recommended to use it in VMI Mode yet!)\n");
        return;
    }
 
#endif // !ActivateUserModeDebugger
 
    //
    // It's a attach to a target PID
    //
    if (CommandTokens.size() >= 4)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandAttachHelp();
        return;
    }
 
    for (auto Section = CommandTokens.begin() + 1; Section != CommandTokens.end(); Section++)
    {
        //
        // Find out whether the user enters pid or not
        //
        if (NextIsPid)
        {
            NextIsPid = FALSE;
 
            if (!ConvertTokenToUInt32(*Section, &TargetPid))
            {
                ShowMessages("please specify a correct hex value for process id\n\n");
                CommandAttachHelp();
                return;
            }
        }
        else if (CompareLowerCaseStrings(*Section, "pid"))
        {
            //
            // next item is a pid for the process
            //
            NextIsPid = TRUE;
        }
        else
        {
            ShowMessages("unknown parameter at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(*Section).c_str());
            CommandAttachHelp();
            return;
        }
    }
 
    //
    // Check if the process id is empty or not
    //
    if (TargetPid == 0)
    {
        ShowMessages("please specify a hex value for process id\n\n");
        CommandAttachHelp();
        return;
    }
 
    //
    // Perform attach to target process
    //
    ShowMessages("Attaching to process 0x%llx (%lld)...\n\n", TargetPid, TargetPid);
    UdAttachToProcess(TargetPid, NULL, NULL, FALSE);
}

◆ CommandBc()

VOID CommandBc	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of bc command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64                            BreakpointId;
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandBcHelp();
        return;
    }
 
    //
    // Get the breakpoint id
    //
    if (!ConvertTokenToUInt64(CommandTokens.at(1), &BreakpointId))
    {
        ShowMessages("please specify a correct hex value for breakpoint id\n\n");
        CommandBcHelp();
 
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform clearing breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR;
 
        //
        // Set breakpoint id
        //
        Request.BreakpointId = BreakpointId;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
    }
    else
    {
        ShowMessages("err, clearing breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBd()

VOID CommandBd	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of bd command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64                            BreakpointId;
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandBdHelp();
        return;
    }
 
    //
    // Get the breakpoint id
    //
    if (!ConvertTokenToUInt64(CommandTokens.at(1), &BreakpointId))
    {
        ShowMessages("please specify a correct hex value for breakpoint id\n\n");
        CommandBdHelp();
 
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform disabling breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE;
 
        //
        // Set breakpoint id
        //
        Request.BreakpointId = BreakpointId;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
    }
    else
    {
        ShowMessages("err, disabling breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBe()

VOID CommandBe	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of be command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64                            BreakpointId;
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandBeHelp();
        return;
    }
 
    //
    // Get the breakpoint id
    //
    if (!ConvertTokenToUInt64(CommandTokens.at(1), &BreakpointId))
    {
        ShowMessages("please specify a correct hex value for breakpoint id\n\n");
        CommandBeHelp();
 
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform enabling breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE;
 
        //
        // Set breakpoint id
        //
        Request.BreakpointId = BreakpointId;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
    }
    else
    {
        ShowMessages("err, enabling breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBl()

VOID CommandBl	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of the bl command

Parameters

CommandTokens
Command

Returns: VOID

{
    DEBUGGEE_BP_LIST_OR_MODIFY_PACKET Request = {0};
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandBlHelp();
        return;
    }
 
    //
    // Check if the remote serial debuggee is paused or not (connected or not)
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Perform listing breakpoint
        //
        Request.Request = DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS;
 
        //
        // Send the request
        //
        KdSendListOrModifyPacketToDebuggee(&Request);
        ShowMessages("\n");
    }
    else
    {
        ShowMessages("err, listing breakpoints is only valid if you connected to "
                     "a debuggee in debugger-mode\n");
    }
}

◆ CommandBp()

VOID CommandBp	(	vector< CommandToken >	CommandTokens,
		string	Command )

bp command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL IsNextCoreId = FALSE;
    BOOL IsNextPid    = FALSE;
    BOOL IsNextTid    = FALSE;
 
    BOOLEAN SetCoreId  = FALSE;
    BOOLEAN SetPid     = FALSE;
    BOOLEAN SetTid     = FALSE;
    BOOLEAN SetAddress = FALSE;
 
    UINT32  Tid            = DEBUGGEE_BP_APPLY_TO_ALL_THREADS;
    UINT32  Pid            = DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES;
    UINT32  CoreNumer      = DEBUGGEE_BP_APPLY_TO_ALL_CORES;
    UINT64  Address        = NULL;
    BOOLEAN IsFirstCommand = TRUE;
 
    if (CommandTokens.size() >= 9)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandBpHelp();
        return;
    }
 
    //
// Disable user-mode debugger in this version
//
#if ActivateUserModeDebugger == FALSE
 
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("the user-mode debugger in VMI Mode is still in the beta version and not stable. "
                     "we decided to exclude it from this release and release it in future versions. "
                     "if you want to test the user-mode debugger in VMI Mode, you should build "
                     "HyperDbg with special instructions. But starting processes is fully supported "
                     "in the Debugger Mode.\n"
                     "(it's not recommended to use it in VMI Mode yet!)\n");
        return;
    }
 
#endif // !ActivateUserModeDebugger
 
    //
    // If the user is debugging a process, use its pid
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    for (auto Section : CommandTokens)
    {
        //
        // Ignore the first argument as it's the command string itself (bp)
        //
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextCoreId)
        {
            if (!ConvertTokenToUInt32(Section, &CoreNumer))
            {
                ShowMessages("please specify a correct hex value for core id\n\n");
                CommandBpHelp();
                return;
            }
            IsNextCoreId = FALSE;
            continue;
        }
        if (IsNextPid)
        {
            if (!ConvertTokenToUInt32(Section, &Pid))
            {
                ShowMessages("please specify a correct hex value for process id\n\n");
                CommandBpHelp();
                return;
            }
            IsNextPid = FALSE;
            continue;
        }
 
        if (IsNextTid)
        {
            if (!ConvertTokenToUInt32(Section, &Tid))
            {
                ShowMessages("please specify a correct hex value for thread id\n\n");
                CommandBpHelp();
                return;
            }
            IsNextTid = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "pid"))
        {
            IsNextPid = TRUE;
            continue;
        }
        if (CompareLowerCaseStrings(Section, "tid"))
        {
            IsNextTid = TRUE;
            continue;
        }
        if (CompareLowerCaseStrings(Section, "core"))
        {
            IsNextCoreId = TRUE;
            continue;
        }
 
        if (!SetAddress)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &Address))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandBpHelp();
                return;
            }
            else
            {
                //
                // Means that address is received
                //
                SetAddress = TRUE;
                continue;
            }
        }
    }
 
    //
    // Check if address is set or not
    //
    if (!SetAddress)
    {
        ShowMessages("please specify a correct hex value as the breakpoint address\n\n");
        CommandBpHelp();
        return;
    }
    if (IsNextPid)
    {
        ShowMessages("please specify a correct hex value for process id\n\n");
        CommandBpHelp();
        return;
    }
    if (IsNextCoreId)
    {
        ShowMessages("please specify a correct hex value for core\n\n");
        CommandBpHelp();
        return;
    }
    if (IsNextTid)
    {
        ShowMessages("please specify a correct hex value for thread id\n\n");
        CommandBpHelp();
        return;
    }
 
    if (!g_IsSerialConnectedToRemoteDebuggee && !g_ActiveProcessDebuggingState.IsActive)
    {
        ShowMessages("setting breakpoints is not possible when you're not connected "
                     "to a target debuggee (kernel debugger or user debugger)\n");
        return;
    }
 
    //
    // Request breakpoint the bp packet
    //
    if (!CommandBpRequest(Address, Pid, Tid, CoreNumer))
    {
        ShowMessages("err, couldn't set breakpoint\n");
    }
}

◆ CommandCls()

VOID CommandCls	(	vector< CommandToken >	CommandTokens,
		string	Command )

.cls command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandClsHelp();
        return;
    }
 
    system("cls");
}

◆ CommandConnect()

VOID CommandConnect	(	vector< CommandToken >	CommandTokens,
		string	Command )

.connect command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    string Ip;
    string Port;
 
    if (g_IsConnectedToHyperDbgLocally || g_IsConnectedToRemoteDebuggee ||
        g_IsConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a debugger, please use '.disconnect' "
                     "command\n");
        return;
    }
 
    if (g_IsSerialConnectedToRemoteDebuggee ||
        g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a an instance of HyperDbg, please use "
                     "'.debug close' command\n");
        return;
    }
 
    if (CommandTokens.size() == 1)
    {
        //
        // Means that user entered just a connect so we have to
        // ask to connect to what ?
        //
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandConnectHelp();
        return;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "local") && CommandTokens.size() == 2)
    {
        //
        // connect to local debugger
        //
        ShowMessages("local debugging (vmi-mode)\n");
 
        ConnectLocalDebugger();
 
        return;
    }
    else if (CommandTokens.size() == 3 || CommandTokens.size() == 2)
    {
        Ip = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1));
 
        if (CommandTokens.size() == 3)
        {
            Port = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2));
        }
 
        //
        // means that probably wants to connect to a remote
        // system, let's first check the if the parameters are
        // valid
        //
        if (!ValidateIP(Ip))
        {
            ShowMessages("incorrect ip address\n");
            return;
        }
 
        if (CommandTokens.size() == 3)
        {
            if (!IsNumber(Port) || stoi(Port) > 65535 || stoi(Port) < 0)
            {
                ShowMessages("incorrect port\n");
                return;
            }
 
            //
            // connect to remote debugger
            //
            ConnectRemoteDebugger(Ip.c_str(), Port.c_str());
        }
        else
        {
            //
            // connect to remote debugger (default port)
            //
            ConnectRemoteDebugger(Ip.c_str(), NULL);
        }
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandConnectHelp();
        return;
    }
}

◆ CommandContinue()

VOID CommandContinue	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of continue command

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandGHelp();
        return;
    }
 
    CommandContinueRequest();
}

◆ CommandCore()

VOID CommandCore	(	vector< CommandToken >	CommandTokens,
		string	Command )

~ command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32 TargetCore = 0;
 
    if (CommandTokens.size() != 1 && CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandCoreHelp();
        return;
    }
 
    //
    // Check if it's connected to a remote debuggee or not
    //
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, you're not connected to any debuggee\n");
        return;
    }
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("current processor : 0x%x\n", g_CurrentRemoteCore);
    }
    else if (CommandTokens.size() == 2)
    {
        if (!ConvertTokenToUInt32(CommandTokens.at(1), &TargetCore))
        {
            ShowMessages("please specify a correct hex value for the core that you "
                         "want to operate on it\n\n");
            CommandCoreHelp();
            return;
        }
 
        //
        // Send the changing core packet
        //
        KdSendSwitchCorePacketToDebuggee(TargetCore);
    }
}

◆ CommandCpu()

VOID CommandCpu	(	vector< CommandToken >	CommandTokens,
		string	Command )

cpu command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandCpuHelp();
        return;
    }
 
    ReadCpuDetails();
}

◆ CommandCpuid()

VOID CommandCpuid	(	vector< CommandToken >	CommandTokens,
		string	Command )

!cpuid command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    BOOLEAN                            GetEax                = FALSE;
    UINT32                             EventLength;
    UINT64                             SpecialTarget               = 0;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            CPUID_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any), of CPUID EAX index
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!cpuid"))
        {
            continue;
        }
        else if (!GetEax)
        {
            //
            // It's probably an index of EAX
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandCpuidHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                //
                // An special EAX is set
                //
                GetEax = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
 
            CommandCpuidHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target EAX (if not specific then it means all msrs)
    //
    Event->Options.OptionalParam1 = GetEax;
 
    if (GetEax)
    {
        Event->Options.OptionalParam2 = SpecialTarget;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandCrwrite()

VOID CommandCrwrite	(	vector< CommandToken >	CommandTokens,
		string	Command )

!crwrite command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             TargetRegister              = 1;
    UINT64                             MaskRegister                = 0xFFFFFFFFFFFFFFFF;
    BOOLEAN                            GetRegister                 = FALSE;
    BOOLEAN                            GetMask                     = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (CommandTokens.size() < 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandCrwriteHelp();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            CONTROL_REGISTER_MODIFIED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!crwrite"))
        {
            continue;
        }
        else if (!GetRegister)
        {
            //
            // It's probably a CR
            //
            if (!ConvertTokenToUInt64(Section, &TargetRegister))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandCrwriteHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetRegister = TRUE;
            }
        }
        else if (!GetMask)
        {
            if (!ConvertTokenToUInt64(Section, &MaskRegister))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandCrwriteHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetMask = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandCrwriteHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    if (TargetRegister != VMX_EXIT_QUALIFICATION_REGISTER_CR0 && TargetRegister != VMX_EXIT_QUALIFICATION_REGISTER_CR4)
    {
        ShowMessages("please choose either 0 for cr0 or 4 for cr4\n");
        CommandCrwriteHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the target control register
    //
    Event->Options.OptionalParam1 = TargetRegister;
 
    //
    // Set the mask to filter control register bits
    //
    Event->Options.OptionalParam2 = MaskRegister;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandDebug()

VOID CommandDebug	(	vector< CommandToken >	CommandTokens,
		string	Command )

.debug command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32  Baudrate;
    UINT32  Port;
    BOOLEAN IsFirstCommand          = TRUE;
    BOOLEAN IsRemote                = FALSE;
    BOOLEAN IsPrepare               = FALSE;
    BOOLEAN IsSerial                = FALSE;
    BOOLEAN IsNamedPipe             = FALSE;
    BOOLEAN IsPause                 = FALSE;
    BOOLEAN IsNamedPipeAddressKnown = FALSE;
    string  NamedPipeAddress;
    BOOLEAN IsComPortAddressKnown = FALSE;
    string  ComAddress;
    BOOLEAN IsComPortBaudrateKnown = FALSE;
 
    if (CommandTokens.size() == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "close"))
    {
        //
        // Check if the debugger is attached to a debuggee
        //
        if (!HyperDbgDebugCloseRemoteDebugger())
        {
            ShowMessages("err, debugger is not attached to any instance of debuggee\n");
        }
 
        return;
    }
    else if (CommandTokens.size() <= 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandDebugHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand)
        {
            IsFirstCommand = FALSE;
            continue;
        }
        else if (!IsRemote && CompareLowerCaseStrings(Section, "remote"))
        {
            IsRemote = TRUE;
            continue;
        }
        else if (!IsPrepare && CompareLowerCaseStrings(Section, "prepare"))
        {
            IsPrepare = TRUE;
            continue;
        }
        else if (!IsSerial && CompareLowerCaseStrings(Section, "serial"))
        {
            IsSerial = TRUE;
            continue;
        }
        else if (!IsNamedPipe && CompareLowerCaseStrings(Section, "namedpipe"))
        {
            IsNamedPipe = TRUE;
            continue;
        }
        else if (!IsPause && CompareLowerCaseStrings(Section, "pause"))
        {
            IsPause = TRUE;
            continue;
        }
        else if (!IsNamedPipeAddressKnown && IsNamedPipe)
        {
            IsNamedPipeAddressKnown = TRUE;
            NamedPipeAddress        = GetCaseSensitiveStringFromCommandToken(Section);
            continue;
        }
        else if (!IsComPortBaudrateKnown && IsSerial && IsNumber(GetCaseSensitiveStringFromCommandToken(Section)))
        {
            IsComPortBaudrateKnown = TRUE;
            Baudrate               = stoi(GetCaseSensitiveStringFromCommandToken(Section));
 
            //
            // Check if baudrate is valid or not
            //
            if (!CommandDebugCheckBaudrate(Baudrate))
            {
                //
                // Baud-rate is invalid
                //
                ShowMessages("err, baud rate is invalid\n\n");
                CommandDebugHelp();
                return;
            }
 
            continue;
        }
        else if (!IsComPortAddressKnown && IsSerial)
        {
            IsComPortAddressKnown = TRUE;
            ComAddress            = GetCaseSensitiveStringFromCommandToken(Section);
 
            //
            // check if com port address is valid or not
            //
            if (!CommandDebugCheckComPort(ComAddress.c_str(), &Port))
            {
                //
                // com port is invalid
                //
                ShowMessages("err, COM port is invalid\n\n");
                CommandDebugHelp();
                return;
            }
 
            continue;
        }
        else
        {
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandDebugHelp();
            return;
        }
    }
 
    //
    // Validate parameters
    //
    if (IsRemote && IsPrepare)
    {
        ShowMessages("err, both 'remote' and 'prepare' can't be used together\n\n");
        CommandDebugHelp();
        return;
    }
 
    if (!IsRemote && !IsPrepare)
    {
        ShowMessages("err, either 'remote' or 'prepare' should be used\n\n");
        CommandDebugHelp();
        return;
    }
 
    //
    // Prepare cannot be specified with the 'pause'
    //
    if (IsPrepare && IsPause)
    {
        ShowMessages("err, 'pause' cannot be used with 'prepare'\n\n");
        CommandDebugHelp();
        return;
    }
 
    //
    // Named pipe cannot be used with the 'prepare'
    //
    if (IsNamedPipe && IsPrepare)
    {
        ShowMessages("err, named pipe cannot be used with 'prepare'\n\n");
        CommandDebugHelp();
        return;
    }
 
    //
    // Check if named pipe is empty or not if it's a named pipe
    //
    if (IsNamedPipe && NamedPipeAddress.empty())
    {
        ShowMessages("err, named pipe address is empty\n\n");
        CommandDebugHelp();
        return;
    }
 
    //
    // If it's serial, COM address and bausrate should be known
    //
    if (IsSerial && (!IsComPortAddressKnown || !IsComPortBaudrateKnown))
    {
        ShowMessages("err, COM port address or baudrate is unknown\n\n");
        CommandDebugHelp();
        return;
    }
 
    //
    // Perform connecting to the remote machine or prepare to send
    //
    if (IsPrepare)
    {
        //
        // Everything is okay, prepare to send (debuggee)
        //
        HyperDbgDebugCurrentDeviceUsingComPort(ComAddress.c_str(), Baudrate);
    }
    else
    {
        //
        // Everything is okay, connect to the remote machine to send (debugger)
        //
        if (IsNamedPipe)
        {
            HyperDbgDebugRemoteDeviceUsingNamedPipe(NamedPipeAddress.c_str(), IsPause);
        }
        else if (IsSerial)
        {
            HyperDbgDebugRemoteDeviceUsingComPort(ComAddress.c_str(), Baudrate, IsPause);
        }
    }
}

◆ CommandDetach()

VOID CommandDetach	(	vector< CommandToken >	CommandTokens,
		string	Command )

.detach command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() >= 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandDetachHelp();
        return;
    }
 
    //
    // Perform detach from the process
    //
    DetachFromProcess();
}

◆ CommandDisconnect()

VOID CommandDisconnect	(	vector< CommandToken >	CommandTokens,
		string	Command )

.disconnect command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandDisconnectHelp();
        return;
    }
 
    if (!g_IsConnectedToHyperDbgLocally && !g_IsConnectedToRemoteDebuggee)
    {
        ShowMessages("you're not connected to any instance of HyperDbg, did you "
                     "use '.connect'? \n");
        return;
    }
 
    //
    // Check if it's local debugger and the driver is still
    // loading (not unloaded)
    //
    if (g_IsConnectedToHyperDbgLocally && g_DeviceHandle)
    {
        ShowMessages("you cannot disconnect in local debugging while the "
                     "driver is still loaded. please use 'unload' command before "
                     "disconnecting from the current instance of debugger\n");
        return;
    }
 
    //
    // Disconnect the session
    //
    g_IsConnectedToHyperDbgLocally = FALSE;
 
    //
    // This computer is connected to a remote system
    //
    if (g_IsConnectedToRemoteDebuggee)
    {
        //
        // We should kill the thread that was listening for the
        // remote commands and close the connection
        //
        TerminateThread(g_RemoteDebuggeeListeningThread, 0);
        CloseHandle(g_RemoteDebuggeeListeningThread);
        CloseHandle(g_EndOfMessageReceivedEvent);
        g_EndOfMessageReceivedEvent = NULL;
 
        RemoteConnectionCloseTheConnectionWithDebuggee();
 
        g_IsConnectedToRemoteDebuggee = FALSE;
    }
 
    ShowMessages("disconnected successfully\n");
}

◆ CommandDr()

VOID CommandDr	(	vector< CommandToken >	CommandTokens,
		string	Command )

!dr command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            DEBUG_REGISTERS_ACCESSED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (CommandTokens.size() > 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandDrHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandDtAndStruct()

VOID CommandDtAndStruct	(	vector< CommandToken >	CommandTokens,
		string	Command )

dt and struct command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    CommandToken TempTypeNameHolder;
    std::string  PdbexArgs                          = "";
    BOOLEAN      IsStruct                           = FALSE;
    UINT64       TargetAddress                      = NULL;
    PVOID        BufferAddressRetrievedFromDebuggee = NULL;
    UINT32       TargetPid                          = NULL;
    BOOLEAN      IsPhysicalAddress                  = FALSE;
 
    //
    // Check if command is 'struct' or not
    //
    if (CompareLowerCaseStrings(CommandTokens.at(0), "struct") ||
        CompareLowerCaseStrings(CommandTokens.at(0), "structure"))
    {
        IsStruct = TRUE;
    }
    else
    {
        IsStruct = FALSE;
    }
 
    //
    // Check if command is '!dt' for physical address or not
    //
    if (!IsStruct && CompareLowerCaseStrings(CommandTokens.at(0), "!dt"))
    {
        IsPhysicalAddress = TRUE;
    }
    else
    {
        IsPhysicalAddress = FALSE;
    }
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        if (IsStruct)
        {
            CommandStructHelp();
        }
        else
        {
            CommandDtHelp();
        }
 
        return;
    }
 
    //
    // Create TempSplitTokens by copying elements from CommandTokens, excluding the first element
    //
    std::vector<CommandToken> TempSplitTokens(CommandTokens.begin() + 1, CommandTokens.end());
 
    //
    // If the size is zero, then it's only a type name
    //
    if (TempSplitTokens.size() == 1)
    {
        //
        // Call the dt parser wrapper, it's only a structure (type) name
        // Call it with default configuration
        //
        CommandDtShowDataBasedOnSymbolTypes(GetCaseSensitiveStringFromCommandToken(TempSplitTokens.at(0)).c_str(),
                                            NULL,
                                            IsStruct,
                                            NULL,
                                            TargetPid,
                                            IsPhysicalAddress,
                                            PDBEX_DEFAULT_CONFIGURATION);
    }
    else
    {
        //
        // When we're here, it means we have size() >= 2, so we have to check
        // the first and the second method to see which one is the type and
        // which one is the symbol
        //
 
        //
        // Check if the first parameter is an address or valid expression
        //
        if (IsStruct || !SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(TempSplitTokens.at(0)).c_str(),
                                                          &TargetAddress))
        {
            //
            // No it's not, we'll get the first argument as the structure (type) name
            // And we have to check whether the second argument is a buffer address or not
            //
            if (IsStruct || !SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(TempSplitTokens.at(1)).c_str(),
                                                              &TargetAddress))
            {
                //
                // The second argument is also not buffer address
                // probably the user entered a structure (type) name along with some params
                //
                TempTypeNameHolder = TempSplitTokens.at(0);
 
                //
                // Remove the first argument
                //
                TempSplitTokens.erase(TempSplitTokens.begin());
 
                //
                // Convert to pdbex args
                //
                if (!CommandDtAndStructConvertHyperDbgArgsToPdbex(TempSplitTokens, PdbexArgs, &TargetPid))
                {
                    if (IsStruct)
                    {
                        CommandStructHelp();
                    }
                    else
                    {
                        CommandDtHelp();
                    }
 
                    return;
                }
 
                //
                // Call the wrapper of pdbex
                //
                CommandDtShowDataBasedOnSymbolTypes(GetCaseSensitiveStringFromCommandToken(TempTypeNameHolder).c_str(),
                                                    TargetAddress,
                                                    IsStruct,
                                                    BufferAddressRetrievedFromDebuggee,
                                                    TargetPid,
                                                    IsPhysicalAddress,
                                                    PdbexArgs.c_str());
            }
            else
            {
                //
                // The second argument is a buffer address
                // The user entered a structure (type) name along with buffer address
                //
                if (TempSplitTokens.size() == 2)
                {
                    //
                    // There is not parameters, only a symbol name and then a buffer address
                    // Call it with default configuration
                    //
                    CommandDtShowDataBasedOnSymbolTypes(GetCaseSensitiveStringFromCommandToken(TempSplitTokens.at(0)).c_str(),
                                                        TargetAddress,
                                                        IsStruct,
                                                        BufferAddressRetrievedFromDebuggee,
                                                        TargetPid,
                                                        IsPhysicalAddress,
                                                        PDBEX_DEFAULT_CONFIGURATION);
                }
                else
                {
                    //
                    // Other than the first argument which is a structure (type) name, and
                    // the second argument which is buffer address, there are other parameters, so
                    // we WON'T call it with default parameters
                    //
                    TempTypeNameHolder = TempSplitTokens.at(0);
 
                    //
                    // Remove the first, and the second arguments
                    //
                    TempSplitTokens.erase(TempSplitTokens.begin());
                    TempSplitTokens.erase(TempSplitTokens.begin());
 
                    //
                    // Convert to pdbex args
                    //
                    if (!CommandDtAndStructConvertHyperDbgArgsToPdbex(TempSplitTokens, PdbexArgs, &TargetPid))
                    {
                        if (IsStruct)
                        {
                            CommandStructHelp();
                        }
                        else
                        {
                            CommandDtHelp();
                        }
 
                        return;
                    }
 
                    //
                    // Call the wrapper of pdbex
                    //
                    CommandDtShowDataBasedOnSymbolTypes(GetCaseSensitiveStringFromCommandToken(TempTypeNameHolder).c_str(),
                                                        TargetAddress,
                                                        IsStruct,
                                                        BufferAddressRetrievedFromDebuggee,
                                                        TargetPid,
                                                        IsPhysicalAddress,
                                                        PdbexArgs.c_str());
                }
            }
        }
        else
        {
            //
            // The first argument is a buffer address, so we get the first argument as
            // a buffer address and the second argument as the structure (type) name
            //
            if (TempSplitTokens.size() == 2)
            {
                //
                // There is not parameters, only a buffer address and then a symbol name
                // Call it with default configuration
                //
                CommandDtShowDataBasedOnSymbolTypes(GetCaseSensitiveStringFromCommandToken(TempSplitTokens.at(1)).c_str(),
                                                    TargetAddress,
                                                    IsStruct,
                                                    BufferAddressRetrievedFromDebuggee,
                                                    TargetPid,
                                                    IsPhysicalAddress,
                                                    PDBEX_DEFAULT_CONFIGURATION);
            }
            else
            {
                //
                // Other than the first argument which is a buffer address, and the second
                // argument which is structure (type) name, there are other parameters, so
                // we WON'T call it with default parameters
                //
                TempTypeNameHolder = TempSplitTokens.at(1);
 
                //
                // Remove the first, and the second arguments
                //
                TempSplitTokens.erase(TempSplitTokens.begin());
                TempSplitTokens.erase(TempSplitTokens.begin());
 
                //
                // Convert to pdbex args
                //
                if (!CommandDtAndStructConvertHyperDbgArgsToPdbex(TempSplitTokens, PdbexArgs, &TargetPid))
                {
                    if (IsStruct)
                    {
                        CommandStructHelp();
                    }
                    else
                    {
                        CommandDtHelp();
                    }
 
                    return;
                }
 
                //
                // Call the wrapper of pdbex
                //
                CommandDtShowDataBasedOnSymbolTypes(GetCaseSensitiveStringFromCommandToken(TempTypeNameHolder).c_str(),
                                                    TargetAddress,
                                                    IsStruct,
                                                    BufferAddressRetrievedFromDebuggee,
                                                    TargetPid,
                                                    IsPhysicalAddress,
                                                    PdbexArgs.c_str());
            }
        }
    }
}

◆ CommandDump()

VOID CommandDump	(	vector< CommandToken >	CommandTokens,
		string	Command )

.dump command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    wstring                   Filepath;
    UINT32                    ActualLength;
    UINT32                    Iterator;
    UINT32                    Pid                 = 0;
    UINT32                    Length              = 0;
    UINT64                    StartAddress        = 0;
    UINT64                    EndAddress          = 0;
    BOOLEAN                   IsFirstCommand      = TRUE;
    BOOLEAN                   NextIsProcId        = FALSE;
    BOOLEAN                   NextIsPath          = FALSE;
    BOOLEAN                   IsTheFirstAddr      = FALSE;
    BOOLEAN                   IsTheSecondAddr     = FALSE;
    BOOLEAN                   IsDumpPathSpecified = FALSE;
    string                    FirstCommand        = GetLowerStringFromCommandToken(CommandTokens.front());
    DEBUGGER_READ_MEMORY_TYPE MemoryType          = DEBUGGER_READ_VIRTUAL_ADDRESS;
 
    if (CommandTokens.size() <= 4)
    {
        ShowMessages("err, incorrect use of the '.dump' command\n\n");
        CommandDumpHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
        else if (NextIsProcId)
        {
            if (!ConvertTokenToUInt32(Section, &Pid))
            {
                ShowMessages("please specify a correct hex value for process id\n\n");
                CommandDumpHelp();
                return;
            }
            NextIsProcId = FALSE;
            continue;
        }
        else if (NextIsPath)
        {
            //
            // Convert path to wstring
            //
            StringToWString(Filepath, GetCaseSensitiveStringFromCommandToken(Section));
            IsDumpPathSpecified = TRUE;
 
            NextIsPath = FALSE;
        }
        else if (CompareLowerCaseStrings(Section, "pid"))
        {
            NextIsProcId = TRUE;
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "path"))
        {
            NextIsPath = TRUE;
            continue;
        }
        //
        // Check the 'From' address
        //
        else if (!IsTheFirstAddr &&
                 SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &StartAddress))
        {
            IsTheFirstAddr = TRUE;
        }
        //
        // Check the 'To' address
        //
        else if (!IsTheSecondAddr &&
                 SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &EndAddress))
        {
            IsTheSecondAddr = TRUE;
        }
        else
        {
            //
            // invalid input
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandDumpHelp();
 
            return;
        }
    }
 
    //
    // Check if 'pid' is not specified
    //
    if (NextIsProcId)
    {
        ShowMessages("please specify a correct hex value for process id\n\n");
        CommandDumpHelp();
        return;
    }
 
    //
    // Check if 'path' is either specified, not completely specified
    //
    if (NextIsPath || !IsDumpPathSpecified)
    {
        ShowMessages("please specify a correct path for saving the dump\n\n");
        CommandDumpHelp();
        return;
    }
 
    //
    // Check if start address or end address is null
    //
    if (!IsTheFirstAddr || !IsTheSecondAddr)
    {
        ShowMessages("err, please specify the start and end address in hex format\n");
        return;
    }
 
    //
    // Check if end address is bigger than start address
    //
    if (StartAddress >= EndAddress)
    {
        ShowMessages("err, please note that the 'to' address should be greater than the 'from' address\n");
        return;
    }
 
    //
    // Check to prevent using process id in d* and u* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && Pid != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    if (Pid == 0)
    {
        //
        // Default process we read from current process
        //
        Pid = PlatformGetCurrentProcessId();
    }
 
    //
    // Check whether it's physical or virtual address
    //
    if (!FirstCommand.compare("!dump"))
    {
        MemoryType = DEBUGGER_READ_PHYSICAL_ADDRESS;
    }
 
    //
    // Create or open the file for writing the dump file
    //
    // TEMPORARY LINUX SHIM (same as in pe.cpp): std::wstring stores native
    // wchar_t (4 bytes on Linux), but the HyperDbg WCHAR type is 2 bytes
    // (UINT16) and PlatformOpenFileForWriting takes a const WCHAR *. On Linux
    // the cast is a bogus 2-byte reinterpretation, acceptable only because
    // Linux file I/O is still stubbed (the path is never opened). On Windows
    // WCHAR == wchar_t, so it is a plain correct pointer. TODO(Linux): remove
    // once real file I/O lands and convert wchar_t -> 2-byte WCHAR properly.
    //
#ifdef __linux__
    DumpFileHandle = PlatformOpenFileForWriting((const WCHAR *)Filepath.c_str());
#else
    DumpFileHandle = PlatformOpenFileForWriting(Filepath.c_str());
#endif
 
    if (DumpFileHandle == INVALID_HANDLE_VALUE)
    {
        ShowMessages("err, unable to create or open the file\n");
        return;
    }
 
    //
    // Compute the length
    //
    Length = (UINT32)(EndAddress - StartAddress);
 
    ActualLength = NULL;
    Iterator     = Length / PAGE_SIZE;
 
    for (SIZE_T i = 0; i <= Iterator; i++)
    {
        UINT64 Address = StartAddress + (i * PAGE_SIZE);
 
        if (Length >= PAGE_SIZE)
        {
            ActualLength = PAGE_SIZE;
        }
        else
        {
            ActualLength = Length;
        }
 
        Length -= ActualLength;
 
        if (ActualLength != 0)
        {
            // ShowMessages("address: 0x%llx | actual length: 0x%llx\n", Address, ActualLength);
 
            HyperDbgShowMemoryOrDisassemble(
                DEBUGGER_SHOW_COMMAND_DUMP,
                Address,
                MemoryType,
                READ_FROM_KERNEL,
                Pid,
                ActualLength,
                NULL);
        }
    }
 
    //
    // Close the file handle if it's not already closed
    //
    if (DumpFileHandle != NULL)
    {
        PlatformCloseFile(DumpFileHandle);
        DumpFileHandle = NULL;
    }
 
    ShowMessages("the dump file is saved at: %ls\n", Filepath.c_str());
}

◆ CommandDumpSaveIntoFile()

VOID CommandDumpSaveIntoFile	(	PVOID	Buffer,
		UINT32	Length )

Saves the received buffers into the files.

Parameters

Buffer
Length

Returns: VOID

{
    //
    // Check if handle is valid
    //
    if (DumpFileHandle == NULL)
    {
        ShowMessages("err, invalid handle for saving the dump buffer is specified\n");
        return;
    }
 
    //
    // Write the buffer into the dump file
    //
    if (!PlatformWriteFile(DumpFileHandle, Buffer, Length))
    {
        ShowMessages("err, unable to write buffer into the dump\n");
 
        PlatformCloseFile(DumpFileHandle);
        DumpFileHandle = NULL;
 
        return;
    }
}

◆ CommandEditMemory()

VOID CommandEditMemory	(	vector< CommandToken >	CommandTokens,
		string	Command )

!e* and e* commands handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64                         Address;
    UINT64 *                       FinalBuffer;
    vector<UINT64>                 ValuesToEdit;
    DEBUGGER_EDIT_MEMORY_TYPE      MemoryType;
    DEBUGGER_EDIT_MEMORY_BYTE_SIZE ByteSize;
    BOOL                           SetAddress     = FALSE;
    BOOL                           SetValue       = FALSE;
    BOOL                           SetProcId      = FALSE;
    BOOL                           NextIsProcId   = FALSE;
    UINT64                         Value          = 0;
    UINT32                         ProcId         = 0;
    UINT32                         CountOfValues  = 0;
    UINT32                         FinalSize      = 0;
    BOOLEAN                        IsFirstCommand = TRUE;
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ProcId = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CommandTokens.size() <= 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandEditMemoryHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand)
        {
            if (CompareLowerCaseStrings(Section, "!eb"))
            {
                MemoryType = EDIT_PHYSICAL_MEMORY;
                ByteSize   = EDIT_BYTE;
            }
            else if (CompareLowerCaseStrings(Section, "!ed"))
            {
                MemoryType = EDIT_PHYSICAL_MEMORY;
                ByteSize   = EDIT_DWORD;
            }
            else if (CompareLowerCaseStrings(Section, "!eq"))
            {
                MemoryType = EDIT_PHYSICAL_MEMORY;
                ByteSize   = EDIT_QWORD;
            }
            else if (CompareLowerCaseStrings(Section, "eb"))
            {
                MemoryType = EDIT_VIRTUAL_MEMORY;
                ByteSize   = EDIT_BYTE;
            }
            else if (CompareLowerCaseStrings(Section, "ed"))
            {
                MemoryType = EDIT_VIRTUAL_MEMORY;
                ByteSize   = EDIT_DWORD;
            }
            else if (CompareLowerCaseStrings(Section, "eq"))
            {
                MemoryType = EDIT_VIRTUAL_MEMORY;
                ByteSize   = EDIT_QWORD;
            }
            else
            {
                //
                // What's this? :(
                //
                ShowMessages("unknown error happened !\n\n");
                CommandEditMemoryHelp();
                return;
            }
 
            IsFirstCommand = FALSE;
 
            continue;
        }
 
        if (NextIsProcId)
        {
            //
            // It's a process id
            //
            NextIsProcId = FALSE;
 
            if (!ConvertTokenToUInt32(Section, &ProcId))
            {
                ShowMessages("please specify a correct hex process id\n\n");
                CommandEditMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the proc id is set, next we should read value
                //
                continue;
            }
        }
 
        //
        // Check if it's a process id or not
        //
        if (!SetProcId && CompareLowerCaseStrings(Section, "pid"))
        {
            NextIsProcId = TRUE;
            continue;
        }
 
        if (!SetAddress)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &Address))
            {
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandEditMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the address is set, next we should read value
                //
                SetAddress = TRUE;
                continue;
            }
        }
 
        if (SetAddress)
        {
            //
            // Remove the hex notations
            //
            std::string TargetVal = GetCaseSensitiveStringFromCommandToken(Section);
 
            if (TargetVal.rfind("0x", 0) == 0 || TargetVal.rfind("0X", 0) == 0 ||
                TargetVal.rfind("\\x", 0) == 0 || TargetVal.rfind("\\X", 0) == 0)
            {
                TargetVal = TargetVal.erase(0, 2);
            }
            else if (TargetVal.rfind('x', 0) == 0 || TargetVal.rfind('X', 0) == 0)
            {
                TargetVal = TargetVal.erase(0, 1);
            }
 
            TargetVal.erase(remove(TargetVal.begin(), TargetVal.end(), '`'), TargetVal.end());
 
            //
            // Check if the value is valid based on byte counts
            //
            if (ByteSize == EDIT_BYTE && TargetVal.size() >= 3)
            {
                ShowMessages("please specify a byte (hex) value for 'eb' or '!eb'\n\n");
                return;
            }
            if (ByteSize == EDIT_DWORD && TargetVal.size() >= 9)
            {
                ShowMessages(
                    "please specify a dword (hex) value for 'ed' or '!ed'\n\n");
                return;
            }
            if (ByteSize == EDIT_QWORD && TargetVal.size() >= 17)
            {
                ShowMessages(
                    "please specify a qword (hex) value for 'eq' or '!eq'\n\n");
                return;
            }
 
            //
            // Qword is checked by the following function, no need to double
            // check it above.
            //
 
            if (!ConvertStringToUInt64(TargetVal, &Value))
            {
                ShowMessages("please specify a correct hex value to change the memory "
                             "content\n\n");
                CommandEditMemoryHelp();
                return;
            }
            else
            {
                //
                // Add it to the list
                //
 
                ValuesToEdit.push_back(Value);
 
                //
                // Keep track of values to modify
                //
                CountOfValues++;
 
                if (!SetValue)
                {
                    //
                    // At least on value is there
                    //
                    SetValue = TRUE;
                }
                continue;
            }
        }
    }
 
    //
    // Check to prevent using process id in e* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && ProcId != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    //
    // Only valid for VMI Mode
    //
    if (ProcId == 0)
    {
        ProcId = GetCurrentProcessId();
    }
 
    //
    // Check if address and value are set or not
    //
    if (!SetAddress)
    {
        ShowMessages("please specify a correct hex address\n\n");
        CommandEditMemoryHelp();
        return;
    }
    if (!SetValue)
    {
        ShowMessages(
            "please specify a correct hex value as the content to edit\n\n");
        CommandEditMemoryHelp();
        return;
    }
    if (NextIsProcId)
    {
        ShowMessages("please specify a correct hex value as the process id\n\n");
        CommandEditMemoryHelp();
        return;
    }
 
    //
    // Make the chunks for editing
    //
    FinalSize = (CountOfValues * sizeof(UINT64));
 
    //
    // Allocate structure + buffer
    //
    FinalBuffer = (UINT64 *)malloc(FinalSize);
 
    if (!FinalBuffer)
    {
        ShowMessages("unable to allocate memory\n\n");
        return;
    }
 
    //
    // Zero the buffer
    //
    ZeroMemory(FinalBuffer, FinalSize);
 
    //
    // Put the values in 64 bit structures
    //
    std::copy(ValuesToEdit.begin(), ValuesToEdit.end(), FinalBuffer);
 
    //
    // Perform the write operation
    //
    WriteMemoryContent(Address,
                       MemoryType,
                       ByteSize,
                       ProcId,
                       CountOfValues,
                       FinalBuffer);
 
    //
    // Free the malloc buffer
    //
    free(FinalBuffer);
}

◆ CommandEptHook()

VOID CommandEptHook	(	vector< CommandToken >	CommandTokens,
		string	Command )

!epthook command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    BOOLEAN                            GetAddress                  = FALSE;
    UINT64                             OptionalParam1              = 0; // Set the target address
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (CommandTokens.size() < 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandEptHookHelp();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            HIDDEN_HOOK_EXEC_CC,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check here to make sure that the user didn't specified the calling stages for this ept hook
    //
    if (Event->EventStage != VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION)
    {
        ShowMessages("the utilization of 'post' or 'all' event calling stages is not meaningful "
                     "for the hidden hook; therefore, this command does not support them\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!epthook"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably address
            //
            if (!SymbolConvertNameOrExprToAddress(
                    GetCaseSensitiveStringFromCommandToken(Section),
                    &OptionalParam1))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandEptHookHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandEptHookHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
    if (OptionalParam1 == 0)
    {
        ShowMessages("please choose an address to put the hidden breakpoint on it\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the optional parameters
    //
    Event->Options.OptionalParam1 = OptionalParam1;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandEptHook2()

VOID CommandEptHook2	(	vector< CommandToken >	CommandTokens,
		string	Command )

!epthook2 command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    BOOLEAN                            GetAddress                  = FALSE;
    UINT64                             OptionalParam1              = 0; // Set the target address
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (CommandTokens.size() < 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandEptHook2Help();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            HIDDEN_HOOK_EXEC_DETOURS,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check here to make sure that the user didn't specified the calling stages for this ept hook
    //
    if (Event->EventStage != VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION)
    {
        ShowMessages("the utilization of 'post' or 'all' event calling stages is not meaningful "
                     "for the hidden hook; therefore, this command does not support them\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!epthook2"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably address
            //
            if (!SymbolConvertNameOrExprToAddress(
                    GetCaseSensitiveStringFromCommandToken(Section),
                    &OptionalParam1))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandEptHook2Help();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandEptHook2Help();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
    if (OptionalParam1 == 0)
    {
        ShowMessages("please choose an address to put the hook on it\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the optional parameters
    //
    Event->Options.OptionalParam1 = OptionalParam1;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandEval()

VOID CommandEval	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of ? command

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandEvalHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove the first command from it
    //
    Command.erase(0, GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Check if it's a test-case check or not
    //
    if (!Command.compare("test"))
    {
        //
        // It's a test-case checker
        //
        if (!CommandEvalCheckTestcase())
        {
            ShowMessages("err, testing script engine test-cases was not successful\n");
        }
        else
        {
            ShowMessages("testing script engine test-cases was successful\n");
        }
 
        return;
    }
 
    //
    // Check if we're connected to a remote debuggee (kernel debugger) or the user debugger
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Send data to the target user debugger or kernel debugger
        //
        ScriptEngineExecuteSingleExpression((CHAR *)Command.c_str(), TRUE, FALSE);
    }
    else
    {
        //
        // It's a test (simulated) run of the script-engine
        //
        ShowMessages("this command should not be used while you're in VMI-Mode (not attached to the user debugger) "
                     "or not in the debugger mode, the results that you see is a simulated result for TESTING  the script engine "
                     "and is not based on the status of your system. You can use this command, either in the debugger mode "
                     "(kernel debugger), or when you attached to a user debugger\n\n");
 
        ShowMessages("test expression : %s \n", Command.c_str());
        ScriptEngineWrapperTestParser(Command);
    }
}

◆ CommandEvents()

VOID CommandEvents	(	vector< CommandToken >	CommandTokens,
		string	Command )

events command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    DEBUGGER_MODIFY_EVENTS_TYPE RequestedAction;
    UINT64                      RequestedTag;
 
    //
    // Validate the parameters (size)
    //
    if (CommandTokens.size() != 1 && CommandTokens.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandEventsHelp();
        return;
    }
 
    if (CommandTokens.size() == 1)
    {
        if (!g_EventTraceInitialized)
        {
            ShowMessages("no active/disabled events \n");
            return;
        }
 
        CommandEventsShowEvents();
 
        //
        // No need to continue any further
        //
        return;
    }
 
    //
    // Validate second argument as it's not just a simple
    // events without any parameter
    //
    if (CompareLowerCaseStrings(CommandTokens.at(1), "e"))
    {
        RequestedAction = DEBUGGER_MODIFY_EVENTS_ENABLE;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "d"))
    {
        RequestedAction = DEBUGGER_MODIFY_EVENTS_DISABLE;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "c"))
    {
        RequestedAction = DEBUGGER_MODIFY_EVENTS_CLEAR;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "sc"))
    {
        if (CompareLowerCaseStrings(CommandTokens.at(2), "on"))
        {
            KdSendShortCircuitingEventToDebuggee(TRUE);
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(2), "off"))
        {
            KdSendShortCircuitingEventToDebuggee(FALSE);
        }
        else
        {
            ShowMessages(
                "please specify a correct 'on' or 'off' state for the short-circuiting state\n\n");
            CommandEventsHelp();
            return;
        }
 
        //
        // No need to further continue
        //
        return;
    }
    else
    {
        //
        // unknown second command
        //
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandEventsHelp();
        return;
    }
 
    //
    // Validate third argument as it's not just a simple
    // events without any parameter
    //
    if (CompareLowerCaseStrings(CommandTokens.at(2), "all"))
    {
        RequestedTag = DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG;
    }
    else if (!ConvertTokenToUInt64(CommandTokens.at(2), &RequestedTag))
    {
        ShowMessages(
            "please specify a correct hex value for tag id (event number)\n\n");
        CommandEventsHelp();
        return;
    }
 
    //
    // Send the request to the kernel, we add it to a constant
    // that's because we want start tags from that constant
    //
    if (RequestedTag != DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG)
    {
        RequestedTag = RequestedTag + DebuggerEventTagStartSeed;
    }
 
    //
    // Perform event related tasks
    //
    CommandEventsModifyAndQueryEvents(RequestedTag, RequestedAction);
}

◆ CommandException()

VOID CommandException	(	vector< CommandToken >	CommandTokens,
		string	Command )

!exception command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_EXCEPTIONS_ALL_FIRST_32_ENTRIES;
    BOOLEAN                            GetEntry                    = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            EXCEPTION_OCCURRED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!exception"))
        {
            continue;
        }
        else if (!GetEntry)
        {
            //
            // It's probably an index
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandExceptionHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                //
                // Check if entry is valid or not (start from zero)
                //
                if (SpecialTarget >= 31)
                {
                    //
                    // Entry is invalid (this command is designed for just first 32
                    // entries)
                    //
                    ShowMessages("the entry should be between 0x0 to 0x1f or first 32 "
                                 "entries'\n\n");
                    CommandExceptionHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                GetEntry = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandExceptionHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target exception (if not specific then it means all exceptions)
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandExit()

VOID CommandExit	(	vector< CommandToken >	CommandTokens,
		string	Command )

exit command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandExitHelp();
        return;
    }
 
    if (g_IsConnectedToHyperDbgLocally)
    {
        //
        // It is in VMI mode
        //
 
        //
        // unload and exit if the any module is loaded
        //
        if (g_DeviceHandle)
        {
            //
            // Unload all modules
            //
            HyperDbgUnloadAllModules();
        }
    }
    else if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // It is in debugger mode
        //
 
        KdCloseConnection();
    }
 
    exit(0);
}

◆ CommandFlush()

VOID CommandFlush	(	vector< CommandToken >	CommandTokens,
		string	Command )

flush command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandFlushHelp();
        return;
    }
 
    //
    // Flush the buffer
    //
    CommandFlushRequestFlush();
}

◆ CommandFormats()

VOID CommandFormats	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of .formats command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64  ConstantValue = 0;
    BOOLEAN HasError      = TRUE;
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandFormatsHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove .formats from it
    //
    Command.erase(0, GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Evaluate a single expression
    //
    ConstantValue = ScriptEngineEvalSingleExpression(Command, &HasError);
 
    if (HasError)
    {
        ShowMessages("err, couldn't resolve error at '%s'\n", Command.c_str());
    }
    else
    {
        //
        // Show formats results for a constant
        //
        CommandFormatsShowResults(ConstantValue);
    }
}

◆ CommandG()

VOID CommandG	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of g command

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandGHelp();
        return;
    }
 
    CommandGRequest();
}

◆ CommandGg()

VOID CommandGg	(	vector< CommandToken >	CommandTokens,
		string	Command )

gg command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() == 1)
    {
        ShowMessages("Good Game! :)\n");
    }
    else if (CommandTokens.size() == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "wp"))
    {
        ShowMessages("Good Game, Well Played! :)\n");
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandGgHelp();
        return;
    }
}

◆ CommandGu()

VOID CommandGu	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of gu command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32  StepCount;
    BOOLEAN LastInstruction        = FALSE;
    BOOLEAN BreakOnNextInstruction = FALSE;
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 1 && CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandGuHelp();
        return;
    }
 
    //
    // Check if the command has a counter parameter
    //
    if (CommandTokens.size() == 2)
    {
        if (!ConvertTokenToUInt32(CommandTokens.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandGuHelp();
            return;
        }
    }
    else
    {
        StepCount = DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Check if the thread is paused or not
        //
        if (g_ActiveProcessDebuggingState.IsActive && !g_ActiveProcessDebuggingState.IsPaused)
        {
            ShowMessages("the target process is running, use the "
                         "'pause' command or press CTRL+C to pause the process\n");
            return;
        }
 
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (SIZE_T i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            //
            // Check if the current instruction is 'ret' or not
            //
            if (HyperDbgCheckWhetherTheCurrentInstructionIsRet(
                    g_CurrentRunningInstruction,
                    MAXIMUM_INSTR_SIZE,
                    g_IsRunningInstruction32Bit ? FALSE : TRUE // equals to !g_IsRunningInstruction32Bit
                    ))
            {
                BreakOnNextInstruction = TRUE;
 
                //
                // It's the last instruction, so we gonna show the instruction
                //
                LastInstruction = TRUE;
            }
 
            //
            // Perform a GU step
            //
            SteppingStepOverForGu(LastInstruction);
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
 
            //
            // Check if we see 'ret' in the previous instruction or not
            //
            if (BreakOnNextInstruction)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, going up (gu) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandHide()

VOID CommandHide	(	vector< CommandToken >	CommandTokens,
		string	Command )

!hide command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32  TargetPid;
    BOOLEAN TrueIfProcessIdAndFalseIfProcessName;
 
#if ActivateHyperEvadeProject != TRUE
 
    ShowMessages("warning, the !hide command (hyperevade project) is in the Beta phase and is not yet well-tested, "
                 "so it is disabled in this version. If you want to test, you can enable it "
                 "from the configuration file (set ActivateHyperEvadeProject to TRUE) and recompile HyperDbg\n\n");
    return;
 
#endif
 
    if (CommandTokens.size() != 1 && CommandTokens.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandHideHelp();
        return;
    }
 
    //
    // Find out whether the user enters pid or name
    //
    if (CommandTokens.size() == 1)
    {
        if (g_ActiveProcessDebuggingState.IsActive)
        {
            TrueIfProcessIdAndFalseIfProcessName = TRUE;
            TargetPid                            = g_ActiveProcessDebuggingState.ProcessId;
        }
        else
        {
            //
            // There is no user-debugging process
            //
            ShowMessages("you're not attached to any user-mode process, "
                         "please explicitly specify the process id or process name\n\n");
            CommandHideHelp();
            return;
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "pid"))
    {
        TrueIfProcessIdAndFalseIfProcessName = TRUE;
 
        //
        // Check for the user to not add extra arguments
        //
        if (CommandTokens.size() != 3)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandHideHelp();
            return;
        }
 
        //
        // It's just a pid for the process
        //
        if (!ConvertTokenToUInt32(CommandTokens.at(2), &TargetPid))
        {
            ShowMessages("incorrect process id\n\n");
            return;
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "name"))
    {
        TrueIfProcessIdAndFalseIfProcessName = FALSE;
    }
    else
    {
        //
        // Invalid argument for the second parameter to the command
        //
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandHideHelp();
        return;
    }
 
    //
    // Enable the transparent mode
    //
    if (TrueIfProcessIdAndFalseIfProcessName)
    {
        HyperDbgEnableTransparentMode(TargetPid,
                                      NULL,
                                      TRUE);
    }
    else
    {
        HyperDbgEnableTransparentMode(NULL,
                                      (CHAR *)GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str(),
                                      FALSE);
    }
}

◆ CommandHw()

VOID CommandHw	(	vector< CommandToken >	CommandTokens,
		string	Command )

!hw command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() >= 2 && CompareLowerCaseStrings(CommandTokens.at(1), "script"))
    {
        //
        // Perform test with default file path and initial BRAM buffer size
        //
        HwdbgScriptRunScript(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str(),
                             HWDBG_TEST_READ_INSTANCE_INFO_PATH,
                             HWDBG_TEST_WRITE_SCRIPT_BUFFER_PATH,
                             DEFAULT_INITIAL_BRAM_BUFFER_SIZE);
    }
    else if (CommandTokens.size() >= 2 &&
             (CompareLowerCaseStrings(CommandTokens.at(1), "eval") || CompareLowerCaseStrings(CommandTokens.at(1), "evaluation")))
    {
        //
        // Perform test evaluation
        //
        ScriptEngineWrapperTestParserForHwdbg(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)));
    }
    else if (CommandTokens.size() == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "unload"))
    {
        //
        // Unload the script
        //
        g_HwdbgInstanceInfoIsValid = FALSE;
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandHwHelp();
        return;
    }
}

◆ CommandHwClk()

VOID CommandHwClk	(	vector< CommandToken >	CommandTokens,
		string	Command )

!hw_clk command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() >= 2)
    {
        //
        // Perform test with default file path and initial BRAM buffer size
        //
        CommandHwClkPerformTest(CommandTokens,
                               HWDBG_TEST_READ_INSTANCE_INFO_PATH,
                               HWDBG_TEST_WRITE_INSTANCE_INFO_PATH,
                               HWDBG_TEST_WRITE_SCRIPT_BUFFER_PATH,
                               DEFAULT_INITIAL_BRAM_BUFFER_SIZE);
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandHwClkHelp();
        return;
    }
}

◆ CommandI()

VOID CommandI	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of i command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32 StepCount;
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 1 && CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandIHelp();
        return;
    }
 
    //
    // Check if we're in VMI mode
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ShowMessages("the instrumentation step-in is only supported in Debugger Mode\n");
        return;
    }
 
    //
    // Check if the command has a counter parameter
    //
    if (CommandTokens.size() == 2)
    {
        if (!ConvertTokenToUInt32(CommandTokens.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandIHelp();
            return;
        }
    }
    else
    {
        StepCount = 1;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (SIZE_T i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            //
            // It's stepping over serial connection in kernel debugger
            //
            SteppingInstrumentationStepIn();
 
            if (CompareLowerCaseStrings(CommandTokens.at(0), "ir"))
            {
                //
                // Show registers
                //
                HyperDbgRegisterShowAll();
 
                if (i != StepCount - 1)
                {
                    ShowMessages("\n");
                }
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, stepping (i) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandIdt()

VOID CommandIdt	(	vector< CommandToken >	CommandTokens,
		string	Command )

!idt command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32                                       IdtEntry;
    INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS * IdtPacket       = NULL;
    BOOLEAN                                      ShowAllEntries  = TRUE;
    UINT64                                       UsedBaseAddress = NULL;
 
    //
    // Check if the command should show all entries or just one entry
    //
    if (CommandTokens.size() == 1)
    {
        ShowAllEntries = TRUE;
    }
    else if (CommandTokens.size() == 2)
    {
        ShowAllEntries = FALSE;
 
        //
        // Get the IDT entry number
        //
        if (ConvertTokenToUInt32(CommandTokens.at(1), &IdtEntry) == FALSE)
        {
            ShowMessages("err, invalid IDT entry number\n");
            return;
        }
 
        if (IdtEntry > MAX_NUMBER_OF_IDT_ENTRIES)
        {
            ShowMessages("err, invalid IDT entry number\n");
            return;
        }
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandIdtHelp();
        return;
    }
 
    //
    // Allocate buffer for IDT entry
    //
    IdtPacket = (INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS *)malloc(sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS));
 
    if (IdtPacket == NULL)
    {
        ShowMessages("err, allocating buffer for receiving IDT entries");
    }
 
    RtlZeroMemory(IdtPacket, sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS));
 
    //
    // Get the IDT buffer
    //
    if (HyperDbgGetIdtEntry(IdtPacket) == TRUE)
    {
        //
        // Show (dump) entries
        //
        if (ShowAllEntries)
        {
            ShowMessages("IDT Entries:\n\n");
 
            for (UINT32 i = 0; i < MAX_NUMBER_OF_IDT_ENTRIES; i++)
            {
                ShowMessages("IDT[0x%x:%d]\t: %s\t",
                             i,
                             i,
                             SeparateTo64BitValue(IdtPacket->IdtEntry[i]).c_str());
 
                //
                // Apply addressconversion of settings here
                //
                if (g_AddressConversion)
                {
                    //
                    // Showing function names here
                    //
                    if (SymbolShowFunctionNameBasedOnAddress(IdtPacket->IdtEntry[i], &UsedBaseAddress))
                    {
                        //
                        // The symbol address is showed (nothing to do)
                        //
                    }
                }
 
                ShowMessages("\n");
            }
        }
        else
        {
            ShowMessages("IDT[0x%x:%d] : %s\t",
                         IdtEntry,
                         IdtEntry,
                         SeparateTo64BitValue(IdtPacket->IdtEntry[IdtEntry]).c_str());
 
            //
            // Apply addressconversion of settings here
            //
            if (g_AddressConversion)
            {
                //
                // Showing function names here
                //
                if (SymbolShowFunctionNameBasedOnAddress(IdtPacket->IdtEntry[IdtEntry], &UsedBaseAddress))
                {
                    //
                    // The symbol address is showed (nothing to do)
                    //
                }
 
                ShowMessages("\n");
            }
        }
    }
 
    //
    // Deallocate the buffer
    //
    free(IdtPacket);
}

◆ CommandInterrupt()

VOID CommandInterrupt	(	vector< CommandToken >	CommandTokens,
		string	Command )

!interrupt command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = 0;
    BOOLEAN                            GetEntry                    = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            EXTERNAL_INTERRUPT_OCCURRED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!interrupt"))
        {
            continue;
        }
        else if (!GetEntry)
        {
            //
            // It's probably an index
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandInterruptHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                //
                // Check if entry is valid or not
                //
                if (!(SpecialTarget >= 32 && SpecialTarget <= 0xff))
                {
                    //
                    // Entry is invalid (this command is designed for just entries
                    // between 32 to 255)
                    //
                    ShowMessages("the entry should be between 0x20 to 0xFF or the "
                                 "entries between 32 to 255\n\n");
                    CommandInterruptHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                GetEntry = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandInterruptHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    if (SpecialTarget == 0)
    {
        //
        // The user didn't set the target interrupt, even though it's possible to
        // get all interrupts but it makes the system not responsive so it's wrong
        // to trigger event on all interrupts and we're not going to support it
        //
        ShowMessages("please specify an interrupt index to monitor, HyperDbg "
                     "doesn't support to trigger events on all interrupts because "
                     "it's not reasonable and make the system unresponsive\n");
        CommandInterruptHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the target interrupt
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandIoapic()

VOID CommandIoapic	(	vector< CommandToken >	CommandTokens,
		string	Command )

!ioapic command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    IO_APIC_ENTRY_PACKETS * IoApicPackets = NULL;
 
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandIoapicHelp();
        return;
    }
 
    //
    // Allocate buffer for I/O APIC
    //
    IoApicPackets = (IO_APIC_ENTRY_PACKETS *)malloc(sizeof(IO_APIC_ENTRY_PACKETS));
 
    if (IoApicPackets == NULL)
    {
        ShowMessages("err, allocating buffer for receiving I/O APIC");
    }
 
    RtlZeroMemory(IoApicPackets, sizeof(IO_APIC_ENTRY_PACKETS));
 
    //
    // Get the I/O APIC buffer
    //
    if (HyperDbgGetIoApic(IoApicPackets) == TRUE)
    {
        //
        // Show (dump) entries
        //
        CommandIoapicShowIoApicEntries(IoApicPackets);
    }
 
    //
    // Deallocate the buffer
    //
    free(IoApicPackets);
}

◆ CommandIoin()

VOID CommandIoin	(	vector< CommandToken >	CommandTokens,
		string	Command )

!ioin command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_ALL_IO_PORTS;
    BOOLEAN                            GetPort                     = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            IN_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!ioin"))
        {
            continue;
        }
        else if (!GetPort)
        {
            //
            // It's probably an I/O port
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandIoinHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetPort = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandIoinHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target I/O port
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandIoout()

VOID CommandIoout	(	vector< CommandToken >	CommandTokens,
		string	Command )

!ioout command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_ALL_IO_PORTS;
    BOOLEAN                            GetPort                     = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            OUT_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!ioout"))
        {
            continue;
        }
        else if (!GetPort)
        {
            //
            // It's probably an I/O port
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandIooutHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetPort = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandIooutHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target I/O port
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandK()

VOID CommandK	(	vector< CommandToken >	CommandTokens,
		string	Command )

k command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64  BaseAddress    = NULL;      // Null base address means current RSP register
    UINT32  Length         = PAGE_SIZE; // Default length
    BOOLEAN IsFirstCommand = TRUE;
    BOOLEAN IsNextBase     = FALSE;
    BOOLEAN IsNextLength   = FALSE;
 
    if (CommandTokens.size() >= 6)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandKHelp();
        return;
    }
 
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages("err, tracing callstack is not possible when you're not "
                     "connected to a debuggee\n");
        return;
    }
 
    //
    // Set the default length
    //
    if (g_IsRunningInstruction32Bit)
    {
        Length = PAGE_SIZE;
    }
    else
    {
        Length = PAGE_SIZE * 2;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand)
        {
            IsFirstCommand = FALSE;
            continue;
        }
        if (IsNextBase == TRUE)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section),
                                                  &BaseAddress))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                return;
            }
 
            IsNextBase = FALSE;
            continue;
        }
 
        if (IsNextLength == TRUE)
        {
            if (!ConvertTokenToUInt32(Section, &Length))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
            IsNextLength = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "l"))
        {
            IsNextLength = TRUE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "base"))
        {
            IsNextBase = TRUE;
            continue;
        }
 
        //
        // User inserts unexpected input
        //
        ShowMessages("err, incorrect use of the '%s' command\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandKHelp();
 
        return;
    }
 
    if (IsNextLength || IsNextBase)
    {
        ShowMessages("incorrect use of the '%s' command\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandKHelp();
        return;
    }
 
    //
    // Send callstack request
    //
 
    if (CompareLowerCaseStrings(CommandTokens.at(0), "k"))
    {
        KdSendCallStackPacketToDebuggee(BaseAddress,
                                        Length,
                                        DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITHOUT_PARAMS,
                                        g_IsRunningInstruction32Bit);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "kq"))
    {
        KdSendCallStackPacketToDebuggee(BaseAddress,
                                        Length,
                                        DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS,
                                        FALSE);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "kd"))
    {
        KdSendCallStackPacketToDebuggee(BaseAddress,
                                        Length,
                                        DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS,
                                        TRUE);
    }
}

◆ CommandKill()

VOID CommandKill	(	vector< CommandToken >	CommandTokens,
		string	Command )

.kill command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandKillHelp();
        return;
    }
 
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Kill the current active process
        //
        if (!UdKillProcess(g_ActiveProcessDebuggingState.ProcessId))
        {
            ShowMessages("process does not exists, is it already terminated?\n");
        }
    }
    else if (g_ProcessIdOfLatestStartingProcess != NULL)
    {
        if (!UdKillProcess(g_ProcessIdOfLatestStartingProcess))
        {
            ShowMessages("process does not exists, is it already terminated?\n");
        }
 
        //
        // No longer the last process exists
        //
        g_ProcessIdOfLatestStartingProcess = NULL;
    }
    else
    {
        ShowMessages("nothing to terminate!\n");
        return;
    }
}

◆ CommandLbr()

VOID CommandLbr	(	vector< CommandToken >	CommandTokens,
		string	Command )

!lbr command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    HYPERTRACE_LBR_OPERATION_PACKETS LbrRequest  = {0};
    BOOLEAN                          ParseResult = FALSE;
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandLbrHelp();
        return;
    }
 
    //
    // Dispatch to the appropriate parser based on the subcommand
    //
    if (CompareLowerCaseStrings(CommandTokens.at(1), "enable") ||
        CompareLowerCaseStrings(CommandTokens.at(1), "disable") ||
        CompareLowerCaseStrings(CommandTokens.at(1), "flush"))
    {
        ParseResult = CommandLbrParseSimpleOperation(CommandTokens, &LbrRequest);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "filter"))
    {
        ParseResult = CommandLbrParseFilterOperation(CommandTokens, &LbrRequest);
    }
    else
    {
        ParseResult = FALSE;
    }
 
    if (!ParseResult)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandLbrHelp();
        return;
    }
 
    //
    // Check if the HyperTrace module is loaded, as it is required for LBR operations
    //
    AssertShowMessageReturnStmt(g_IsHyperTraceModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_HYPERTRACE_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    //
    // Send the LBR operation request
    //
    if (CommandLbrSendRequest(&LbrRequest))
    {
        CommandLbrShowSuccessMessage(&LbrRequest);
    }
    else
    {
        ShowErrorMessage(LbrRequest.KernelStatus);
    }
}

◆ CommandLbrdump()

VOID CommandLbrdump	(	vector< CommandToken >	CommandTokens,
		string	Command )

!lbrdump command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    HYPERTRACE_LBR_DUMP_PACKETS LbrdumpRequest          = {0};
    UINT32                      CoreId                  = 0;
    BOOLEAN                     ContinueDumpingAllCores = TRUE;
 
    if (CommandTokens.size() != 1 && CommandTokens.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandLbrdumpHelp();
        return;
    }
 
    //
    // Check if the HyperTrace module is loaded, as it is required for LBR operations
    //
    AssertShowMessageReturnStmt(g_IsHyperTraceModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_HYPERTRACE_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    if (CommandTokens.size() == 3)
    {
        if (CompareLowerCaseStrings(CommandTokens.at(1), "core"))
        {
            if (!ConvertTokenToUInt32(CommandTokens.at(2), &CoreId))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
                CommandLbrdumpHelp();
 
                return;
            }
        }
        else
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandLbrdumpHelp();
            return;
        }
    }
    else
    {
        //
        // If no core is specified, we can set the CoreId to a special value (e.g., 0xFFFFFFFF) to indicate that the dump should be performed for all cores
        //
        CoreId = HYPERTRACE_LBR_DUMP_ALL_CORES;
    }
 
    //
    // If the CoreId is set to the special value for dumping all cores,
    // we can set it to 0 to start dumping from the first core and rely on the NextCoreIsValid flag
    // in the dump request structure to indicate whether there are more cores to be dumped or not in
    // the driver response
    //
    if (CoreId == HYPERTRACE_LBR_DUMP_ALL_CORES)
    {
        LbrdumpRequest.CoreId = 0;
    }
    else
    {
        LbrdumpRequest.CoreId = CoreId;
    }
 
    while (ContinueDumpingAllCores)
    {
        //
        // Send the LBR dump request
        //
        if (HyperDbgLbrdumpSendRequest(&LbrdumpRequest))
        {
            if (LbrdumpRequest.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
            {
                //
                // Show entries of the LBR stack in the request structure which are filled by the driver in response to the dump request
                //
                CommandLbrdumpPrint(&LbrdumpRequest);
 
                if (CoreId == HYPERTRACE_LBR_DUMP_ALL_CORES && LbrdumpRequest.NextCoreIsValid)
                {
                    //
                    // If the NextCoreIsValid flag is set, it means there are more cores to be
                    // dumped in the case of dumping all cores, so we can update the CoreId
                    // in the dump request structure to the next core number for the next
                    // iteration of dumping
                    //
                    LbrdumpRequest.CoreId++;
                }
                else
                {
                    //
                    // If the NextCoreIsValid flag is not set, it means there are no more
                    // cores to be dumped in the case of dumping all cores, so we can break the loop
                    //
                    ContinueDumpingAllCores = FALSE;
                }
            }
            else
            {
                ShowErrorMessage(LbrdumpRequest.KernelStatus);
                break;
            }
        }
        else
        {
            ShowMessages("failed to send LBR dump request\n");
            break;
        }
    }
}

◆ CommandListen()

VOID CommandListen	(	vector< CommandToken >	CommandTokens,
		string	Command )

listen command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    string Port;
 
    if (CommandTokens.size() >= 3)
    {
        //
        // Means that user entered invalid parameters
        //
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandListenHelp();
        return;
    }
 
    if (g_IsConnectedToHyperDbgLocally || g_IsConnectedToRemoteDebuggee ||
        g_IsConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a debugger, please use '.disconnect' "
                     "command\n");
        return;
    }
 
    //
    // Check to avoid using this command in debugger-mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a an instance of HyperDbg, please use "
                     "'.debug close' command\n");
        return;
    }
 
    if (CommandTokens.size() == 1)
    {
        //
        // listen on default port
        //
        ShowMessages("listening on %s ...\n", DEFAULT_PORT);
        RemoteConnectionListen(DEFAULT_PORT);
 
        return;
    }
    else if (CommandTokens.size() == 2)
    {
        Port = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1));
 
        //
        // means that probably wants to listen
        // on a specific port, let's see if the
        // port is valid or not
        //
        if (!IsNumber(Port) || stoi(Port) > 65535 || stoi(Port) < 0)
        {
            ShowMessages("incorrect port\n");
            return;
        }
 
        //
        // listen on the port
        //
        ShowMessages("listening on %s ...\n", Port.c_str());
        RemoteConnectionListen(Port.c_str());
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandListenHelp();
        return;
    }
}

◆ CommandLm()

VOID CommandLm	(	vector< CommandToken >	CommandTokens,
		string	Command )

handle lm command

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOLEAN SetPid                = FALSE;
    BOOLEAN SetSearchFilter       = FALSE;
    BOOLEAN SearchStringEntered   = FALSE;
    BOOLEAN OnlyShowKernelModules = FALSE;
    BOOLEAN OnlyShowUserModules   = FALSE;
    UINT32  TargetPid             = NULL;
    CHAR    Search[MAX_PATH]      = {0};
    CHAR *  SearchString          = NULL;
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "lm"))
        {
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "pid") && !SetPid)
        {
            SetPid = TRUE;
        }
        else if (CompareLowerCaseStrings(Section, "m") && !SetSearchFilter)
        {
            SetSearchFilter = TRUE;
        }
        else if (SetPid)
        {
            if (!ConvertTokenToUInt32(Section, &TargetPid))
            {
                //
                // couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandLmHelp();
                return;
            }
            SetPid = FALSE;
        }
        else if (SetSearchFilter)
        {
            if (GetCaseSensitiveStringFromCommandToken(Section).length() >= MAX_PATH)
            {
                ShowMessages("err, string is too large for search, please enter "
                             "smaller string\n");
 
                return;
            }
 
            SearchStringEntered = TRUE;
            strcpy(Search, GetLowerStringFromCommandToken(Section).c_str());
 
            SetSearchFilter = FALSE;
        }
        else if (CompareLowerCaseStrings(Section, "km"))
        {
            if (OnlyShowUserModules)
            {
                ShowMessages("err, you cannot use both 'um', and 'km', by default "
                             "HyperDbg shows both user-mode and kernel-mode modules\n");
                return;
            }
 
            OnlyShowKernelModules = TRUE;
        }
        else if (CompareLowerCaseStrings(Section, "um"))
        {
            if (OnlyShowKernelModules)
            {
                ShowMessages("err, you cannot use both 'um', and 'km', by default "
                             "HyperDbg shows both user-mode and kernel-mode modules\n");
                return;
            }
 
            OnlyShowUserModules = TRUE;
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandLmHelp();
            return;
        }
    }
 
    if (SetPid)
    {
        ShowMessages("err, please enter a valid process id in hex format, "
                     "or if you want to use it in decimal format, add '0n' "
                     "prefix to the number\n");
        return;
    }
 
    if (SetSearchFilter)
    {
        ShowMessages("err, please enter a valid string to search in modules\n");
        return;
    }
 
    //
    // Check if we have string to search
    //
    if (SearchStringEntered)
    {
        SearchString = Search;
    }
 
    //
    // Show user mode modules
    //
    if (!OnlyShowKernelModules)
    {
        if (TargetPid != NULL)
        {
            CommandLmShowUserModeModule(TargetPid, SearchString);
        }
        else if (g_ActiveProcessDebuggingState.IsActive)
        {
            CommandLmShowUserModeModule(g_ActiveProcessDebuggingState.ProcessId, SearchString);
        }
        else
        {
            CommandLmShowUserModeModule(GetCurrentProcessId(), SearchString);
        }
    }
 
    //
    // Show kernel mode modules
    //
    if (!OnlyShowUserModules)
    {
        if (!OnlyShowKernelModules)
        {
            ShowMessages("\n==============================================================================\n\n");
        }
 
        CommandLmShowKernelModeModule(SearchString);
    }
}

◆ CommandLoad()

VOID CommandLoad	(	vector< CommandToken >	CommandTokens,
		string	Command )

load command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandLoadHelp();
        return;
    }
 
    if (!g_IsConnectedToHyperDbgLocally)
    {
        ShowMessages("you're not connected to any instance of HyperDbg, did you "
                     "use '.connect'? \n");
        return;
    }
 
    //
    // Check for the module
    //
    if (CompareLowerCaseStrings(CommandTokens.at(1), "all") || CompareLowerCaseStrings(CommandTokens.at(1), "."))
    {
        //
        // Load aa Modules
        //
        ShowMessages("loading the all modules\n");
 
        if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadAllModules() == 1)
        {
            ShowMessages("failed to install or load drivers\n");
            return;
        }
 
        //
        // If in vmi-mode then initialize and load symbols (pdb)
        // for previously downloaded symbols
        // When the VMM module is loaded, we use the current
        // process (HyperDbg's process) as the base for user-mode
        // symbols
        //
        SymbolLocalReload(GetCurrentProcessId());
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "vmm") ||
             CompareLowerCaseStrings(CommandTokens.at(1), "vm"))
    {
        //
        // Check to make sure that the driver is not already loaded
        //
        if (g_IsVmmModuleLoaded)
        {
            ShowMessages("the vmm module is already running, if you use 'load' before, please "
                         "first unload it using the 'unload' command\n");
            return;
        }
 
        //
        // Load the VMM Module
        //
        ShowMessages("loading the vmm module\n");
 
        if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadVmmModule() == 1)
        {
            ShowMessages("failed to install or load the driver\n");
            return;
        }
 
        //
        // If in vmi-mode then initialize and load symbols (pdb)
        // for previously downloaded symbols
        // When the VMM module is loaded, we use the current
        // process (HyperDbg's process) as the base for user-mode
        // symbols
        //
        SymbolLocalReload(GetCurrentProcessId());
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "trace") ||
             CompareLowerCaseStrings(CommandTokens.at(1), "hypertrace"))
    {
        //
        // Check to make sure that the driver is not already loaded
        //
        if (g_IsHyperTraceModuleLoaded)
        {
            ShowMessages("the trace module is already running, if you use 'load' before, please "
                         "first unload it using the 'unload' command\n");
            return;
        }
 
        //
        // Load the HyperTrace Module
        //
        ShowMessages("loading the trace module\n");
 
        if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadHyperTraceModule() == 1)
        {
            ShowMessages("failed to install or load the driver\n");
            return;
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "kd") ||
             CompareLowerCaseStrings(CommandTokens.at(1), "dbg") ||
             CompareLowerCaseStrings(CommandTokens.at(1), "debugger") ||
             CompareLowerCaseStrings(CommandTokens.at(1), "debug") ||
             CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebugger") ||
             CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebug"))
    {
        //
        // Check to make sure that the driver is not already loaded
        //
        if (g_IsKdModuleLoaded)
        {
            ShowMessages("the kd module is already running, if you use 'load' before, please "
                         "first unload it using the 'unload' command\n");
            return;
        }
 
        //
        // Load the KD Module
        //
        ShowMessages("loading the kd module\n");
 
        if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadKdModule() == 1)
        {
            ShowMessages("failed to install or load the driver\n");
            return;
        }
    }
    else
    {
        //
        // Module not found
        //
        ShowMessages("err, module not found\n");
    }
}

◆ CommandLogclose()

VOID CommandLogclose	(	vector< CommandToken >	CommandTokens,
		string	Command )

.logclose command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandLogcloseHelp();
        return;
    }
    if (!g_LogOpened)
    {
        ShowMessages("there is no opened log, did you use '.logopen'? \n");
        return;
    }
 
    //
    // Show the time and message before close
    //
    time_t    t  = time(NULL);
    struct tm tm = *localtime(&t);
    ShowMessages("log file closed (%d-%02d-%02d "
                 "%02d:%02d:%02d)\n",
                 tm.tm_year + 1900,
                 tm.tm_mon + 1,
                 tm.tm_mday,
                 tm.tm_hour,
                 tm.tm_min,
                 tm.tm_sec);
    //
    // close the file
    //
    g_LogOpenFile.close();
 
    //
    // Globally indicate that file is no longer available
    //
    g_LogOpened = FALSE;
}

◆ CommandLogopen()

VOID CommandLogopen	(	vector< CommandToken >	CommandTokens,
		string	Command )

.logopen command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandLogopenHelp();
        return;
    }
 
    if (g_LogOpened)
    {
        ShowMessages("log was opened previously, you have the close it first "
                     "(using .logclose)\n");
        return;
    }
 
    //
    // Try to open it as file
    //
    g_LogOpenFile.open(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
 
    //
    // Check if it's okay
    //
    if (g_LogOpenFile.is_open())
    {
        //
        // Start intercepting logs
        //
        g_LogOpened = TRUE;
 
        //
        // Enable save to the file (Message + time)
        //
        time_t    t  = time(NULL);
        struct tm tm = *localtime(&t);
 
        ShowMessages("save commands and results into file : %s (%d-%02d-%02d "
                     "%02d:%02d:%02d)\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str(),
                     tm.tm_year + 1900,
                     tm.tm_mon + 1,
                     tm.tm_mday,
                     tm.tm_hour,
                     tm.tm_min,
                     tm.tm_sec);
    }
    else
    {
        ShowMessages("unable to open file : %s\n", GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        return;
    }
}

◆ CommandMeasure()

VOID CommandMeasure	(	vector< CommandToken >	CommandTokens,
		string	Command )

!measure command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOLEAN DefaultMode = FALSE;
 
    ShowMessages("This command is deprecated, you should not use it anymore!\n");
    return;
 
    if (CommandTokens.size() >= 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandMeasureHelp();
        return;
    }
 
    if (CommandTokens.size() == 2 && !CompareLowerCaseStrings(CommandTokens.at(1), "default"))
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandMeasureHelp();
        return;
    }
    else if (CommandTokens.size() == 2 &&
             CompareLowerCaseStrings(CommandTokens.at(1), "default"))
    {
        DefaultMode = TRUE;
    }
 
    //
    // Check if debugger is loaded or not
    //
    if (g_DeviceHandle && !DefaultMode)
    {
        ShowMessages(
            "Debugger is loaded and your machine is already in a hypervisor, you "
            "should measure the times before 'load'-ing the debugger, please "
            "'unload' the debugger and use '!measure' again or use '!measure "
            "default' to use hardcoded measurements\n");
        return;
    }
 
    if (!DefaultMode)
    {
        if (TransparentModeCheckHypervisorPresence(
                &g_CpuidAverage,
                &g_CpuidStandardDeviation,
                &g_CpuidMedian))
        {
            ShowMessages(
                "we detected that there is a hypervisor, on your system, it "
                "leads to wrong measurement results for our transparent-mode, please "
                "make sure that you're not in a hypervisor then measure the result "
                "again; otherwise the transparent-mode will not work but you can use "
                "'!measure default' to use the hardcoded measurements !\n\n");
 
            return;
        }
 
        if (TransparentModeCheckRdtscpVmexit(
                &g_RdtscAverage,
                &g_RdtscStandardDeviation,
                &g_RdtscMedian))
        {
            ShowMessages(
                "we detected that there is a hypervisor, on your system, it "
                "leads to wrong measurement results for our transparent-mode, please "
                "make sure that you're not in a hypervisor then measure the result "
                "again; otherwise the transparent-mode will not work but you can use "
                "'!measure default' to use the hardcoded measurements !\n\n");
 
            return;
        }
    }
    else
    {
        //
        // It's a default mode
        //
 
        //
        // Default values for cpuid
        //
        g_CpuidAverage           = 0x5f;
        g_CpuidStandardDeviation = 0x10;
        g_CpuidMedian            = 0x5f;
 
        //
        // Default values for rdtsc/p
        //
        g_RdtscAverage           = 0x16;
        g_RdtscStandardDeviation = 0x5;
        g_RdtscMedian            = 0x16;
    }
 
    ShowMessages("the measurements were successful\nyou can use the '!hide' command now\n");
 
    //
    // Indicate that the measurements was successful
    //
    g_TransparentResultsMeasured = TRUE;
}

◆ CommandMode()

VOID CommandMode	(	vector< CommandToken >	CommandTokens,
		string	Command )

!mode command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
    BOOLEAN                            SetMode                = FALSE;
    DEBUGGER_EVENT_MODE_TYPE           TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_INVALID;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            TRAP_EXECUTION_MODE_CHANGED,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check here to make sure that the user didn't specified the calling stages for this mode change execution trap
    //
    if (Event->EventStage != VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION)
    {
        ShowMessages("the utilization of 'post' or 'all' event calling stages is not meaningful "
                     "for the mode (user-mode/kernel-mode) change traps; therefore, this command does not support them\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check for size
    //
    if (CommandTokens.size() > 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandModeHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!mode"))
        {
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "u") && !SetMode)
        {
            TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_USER_MODE;
            SetMode                = TRUE;
        }
        else if (CompareLowerCaseStrings(Section, "k") && !SetMode)
        {
            TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE;
            SetMode                = TRUE;
        }
        else if ((CompareLowerCaseStrings(Section, "uk") || CompareLowerCaseStrings(Section, "ku")) && !SetMode)
        {
            TargetInterceptionMode = DEBUGGER_EVENT_MODE_TYPE_USER_MODE_AND_KERNEL_MODE;
            SetMode                = TRUE;
        }
        else
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
 
            CommandModeHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        }
    }
 
    //
    // Check if user specified the execution mode or not
    //
    if (!SetMode)
    {
        ShowMessages("please specify the mode(s) that you want to intercept their execution (u, k, ku)\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check if user specified the process id or not
    //
    if (Event->ProcessId == DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES)
    {
        ShowMessages("this event only applies to the selected process(es). please specify "
                     "the 'pid' or the process id of the target process that you want to trap its execution\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the first parameter to the required execution mode
    //
    Event->Options.OptionalParam1 = (UINT64)TargetInterceptionMode;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandMonitor()

VOID CommandMonitor	(	vector< CommandToken >	CommandTokens,
		string	Command )

!monitor command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT32                             HookLength                  = 0;
    UINT64                             OptionalParam1              = 0; // Set the 'from' target address
    UINT64                             OptionalParam2              = 0; // Set the 'to' target address
    BOOLEAN                            SetFrom                     = FALSE;
    BOOLEAN                            SetTo                       = FALSE;
    BOOLEAN                            IsNextLength                = FALSE;
    BOOLEAN                            LengthAlreadySet            = FALSE;
    BOOLEAN                            SetAttributes               = FALSE;
    BOOLEAN                            HookMemoryTypeSet           = FALSE;
    DEBUGGER_HOOK_MEMORY_TYPE          HookMemoryType              = DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS; // by default virtual address
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    if (CommandTokens.size() < 4)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandMonitorHelp();
        return;
    }
 
    //
    // Interpret and fill the general event and action fields
    //
    // We use HIDDEN_HOOK_READ_AND_WRITE here but it might be changed to
    // HIDDEN_HOOK_READ or HIDDEN_HOOK_WRITE or other events it is because
    // we are not sure what kind event the user need
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!monitor"))
        {
            continue;
        }
        else if (IsNextLength)
        {
            if (!ConvertTokenToUInt32(Section, &HookLength))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
 
            IsNextLength     = FALSE;
            LengthAlreadySet = TRUE;
            SetTo            = TRUE; // No longer need a second address
        }
        else if (CompareLowerCaseStrings(Section, "r") && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ;
            SetAttributes    = TRUE;
        }
        else if (CompareLowerCaseStrings(Section, "w") && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_WRITE;
            SetAttributes    = TRUE;
        }
        else if (CompareLowerCaseStrings(Section, "x") && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if ((CompareLowerCaseStrings(Section, "rw") || CompareLowerCaseStrings(Section, "wr")) && !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ_AND_WRITE;
            SetAttributes    = TRUE;
        }
        else if ((CompareLowerCaseStrings(Section, "rx") || CompareLowerCaseStrings(Section, "xr")) &&
                 !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ_AND_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if ((CompareLowerCaseStrings(Section, "wx") || CompareLowerCaseStrings(Section, "xw")) &&
                 !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_WRITE_AND_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if ((CompareLowerCaseStrings(Section, "rwx") ||
                  CompareLowerCaseStrings(Section, "rxw") ||
                  CompareLowerCaseStrings(Section, "wrx") ||
                  CompareLowerCaseStrings(Section, "wxr") ||
                  CompareLowerCaseStrings(Section, "xrw") ||
                  CompareLowerCaseStrings(Section, "xwr")) &&
                 !SetAttributes)
        {
            Event->EventType = HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE;
            SetAttributes    = TRUE;
        }
        else if (CompareLowerCaseStrings(Section, "l") && !SetTo && !LengthAlreadySet)
        {
            IsNextLength = TRUE;
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "va") && !HookMemoryTypeSet)
        {
            HookMemoryType    = DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS;
            HookMemoryTypeSet = TRUE;
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "pa") && !HookMemoryTypeSet)
        {
            HookMemoryType    = DEBUGGER_MEMORY_HOOK_PHYSICAL_ADDRESS;
            HookMemoryTypeSet = TRUE;
            continue;
        }
        else
        {
            //
            // It's probably address
            //
            if (!SetFrom)
            {
                if (!SymbolConvertNameOrExprToAddress(
                        GetCaseSensitiveStringFromCommandToken(Section),
                        &OptionalParam1))
                {
                    //
                    // couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 GetCaseSensitiveStringFromCommandToken(Section).c_str());
                    CommandMonitorHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                SetFrom = TRUE;
            }
            else if (!SetTo && !LengthAlreadySet)
            {
                if (!SymbolConvertNameOrExprToAddress(
                        GetCaseSensitiveStringFromCommandToken(Section),
                        &OptionalParam2))
                {
                    //
                    // Couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 GetCaseSensitiveStringFromCommandToken(Section).c_str());
 
                    CommandMonitorHelp();
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                SetTo = TRUE;
            }
            else
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandMonitorHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
        }
    }
 
    //
    // Check  if all parameters are received
    //
    if (!SetFrom || !SetTo)
    {
        ShowMessages("please choose the 'from' or 'to' values or specify the length\n");
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check if user specified the 'l' rather than providing two addresses
    //
    if (LengthAlreadySet)
    {
        //
        // Because when the user specifies length, the last byte should be ignored
        //
        OptionalParam2 = OptionalParam1 + HookLength - 1;
    }
 
    //
    // Check for invalid order of address
    //
    if (OptionalParam1 > OptionalParam2)
    {
        //
        // 'from' is greater than 'to'
        //
        ShowMessages("please choose the 'from' value first, then choose the 'to' "
                     "value\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Check if user set the attributes of !monitor or not
    //
    if (!SetAttributes)
    {
        ShowMessages("please specify the attribute(s) that you want to monitor (r, w, x, rw, rx, wx, rwx)\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the optional parameters
    //
    Event->Options.OptionalParam1 = OptionalParam1;
    Event->Options.OptionalParam2 = OptionalParam2;
    Event->Options.OptionalParam3 = HookMemoryType;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandMsrread()

VOID CommandMsrread	(	vector< CommandToken >	CommandTokens,
		string	Command )

!msrread command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS;
    BOOLEAN                            GetAddress                  = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            RDMSR_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any), it is because we can use
    // special msr bitmap here
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!msrread") || CompareLowerCaseStrings(Section, "!msread"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably an msr
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandMsrreadHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandMsrreadHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target msr (if not specific then it means all msrs)
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandMsrwrite()

VOID CommandMsrwrite	(	vector< CommandToken >	CommandTokens,
		string	Command )

!msrwrite command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS;
    BOOLEAN                            GetAddress                  = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            WRMSR_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any), it is because we can use
    // special msr bitmap here
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!msrwrite"))
        {
            continue;
        }
        else if (!GetAddress)
        {
            //
            // It's probably an msr
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandMsrwriteHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                GetAddress = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandMsrwriteHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target msr (if not specific then it means all msrs)
    //
    Event->Options.OptionalParam1 = SpecialTarget;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandOutput()

VOID CommandOutput	(	vector< CommandToken >	CommandTokens,
		string	Command )

output command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_EVENT_FORWARDING     EventForwardingObject;
    DEBUGGER_EVENT_FORWARDING_TYPE Type;
    DEBUGGER_OUTPUT_SOURCE_STATUS  Status;
    string                         DetailsOfSource;
    UINT32                         IndexToShowList;
    PLIST_ENTRY                    TempList          = 0;
    BOOLEAN                        OutputSourceFound = FALSE;
    HANDLE                         SourceHandle      = INVALID_HANDLE_VALUE;
    SOCKET                         Socket            = NULL;
    HMODULE                        Module            = NULL;
 
    if ((CommandTokens.size() != 1 && CommandTokens.size() <= 2) || CommandTokens.size() >= 6)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandOutputHelp();
        return;
    }
 
    //
    // Check if the user needs a list of outputs or not
    //
    if (CommandTokens.size() == 1)
    {
        IndexToShowList = 0;
 
        if (g_OutputSourcesInitialized)
        {
            TempList = &g_OutputSources;
 
            while (&g_OutputSources != TempList->Blink)
            {
                TempList = TempList->Blink;
 
                PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails =
                    CONTAINING_RECORD(TempList, DEBUGGER_EVENT_FORWARDING, OutputSourcesList);
 
                //
                // Increase index
                //
                IndexToShowList++;
 
                string TempStateString = "";
                string TempTypeString  = "";
 
                if (CurrentOutputSourceDetails->State ==
                    EVENT_FORWARDING_STATE_NOT_OPENED)
                {
                    TempStateString = "not opened";
                }
                else if (CurrentOutputSourceDetails->State ==
                         EVENT_FORWARDING_STATE_OPENED)
                {
                    TempStateString = "opened    ";
                }
                else if (CurrentOutputSourceDetails->State ==
                         EVENT_FORWARDING_CLOSED)
                {
                    TempStateString = "closed    ";
                }
 
                if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_NAMEDPIPE)
                {
                    TempTypeString = "namedpipe";
                }
                else if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_FILE)
                {
                    TempTypeString = "file     ";
                }
                else if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_TCP)
                {
                    TempTypeString = "tcp      ";
                }
                else if (CurrentOutputSourceDetails->Type == EVENT_FORWARDING_MODULE)
                {
                    TempTypeString = "module   ";
                }
 
                ShowMessages("%x  %s   %s\t%s\n", IndexToShowList, TempTypeString.c_str(), TempStateString.c_str(), CurrentOutputSourceDetails->Name);
            }
        }
        else
        {
            ShowMessages("output forwarding list is empty\n");
        }
 
        return;
    }
 
    //
    // Check if it's a create, open, or close
    //
    if (CompareLowerCaseStrings(CommandTokens.at(1), "create"))
    {
        //
        // It's a create
        //
 
        //
        // check if the parameters are okay for a create or not
        //
        if (CommandTokens.size() <= 4)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandOutputHelp();
            return;
        }
 
        //
        // Check for the type of the output source
        //
        if (CompareLowerCaseStrings(CommandTokens.at(3), "file"))
        {
            Type = EVENT_FORWARDING_FILE;
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(3), "namedpipe"))
        {
            Type = EVENT_FORWARDING_NAMEDPIPE;
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(3), "tcp"))
        {
            Type = EVENT_FORWARDING_TCP;
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(3), "module"))
        {
            Type = EVENT_FORWARDING_MODULE;
        }
        else
        {
            ShowMessages("incorrect type near '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)).c_str());
            CommandOutputHelp();
            return;
        }
 
        //
        // Check to make sure that the name doesn't exceed the maximum character
        //
        if (GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).size() >=
            MAXIMUM_CHARACTERS_FOR_EVENT_FORWARDING_NAME)
        {
            ShowMessages("name of the output cannot exceed form %d characters\n\n",
                         MAXIMUM_CHARACTERS_FOR_EVENT_FORWARDING_NAME);
            CommandOutputHelp();
            return;
        }
 
        //
        // Search to see if there is another output source with the
        // same name which we don't want to create two or more output
        // sources with the same name
        //
        if (g_OutputSourcesInitialized)
        {
            TempList = &g_OutputSources;
 
            while (&g_OutputSources != TempList->Flink)
            {
                TempList = TempList->Flink;
 
                PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails =
                    CONTAINING_RECORD(TempList, DEBUGGER_EVENT_FORWARDING, OutputSourcesList);
 
                if (strcmp(CurrentOutputSourceDetails->Name,
                           GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str()) == 0)
                {
                    //
                    // Indicate that we found this item
                    //
                    OutputSourceFound = TRUE;
 
                    //
                    // No need to search through the list anymore
                    //
                    break;
                }
            }
 
            //
            // Check whether the entered name already exists
            //
            if (OutputSourceFound)
            {
                ShowMessages("err, the name you entered, already exists, please choose "
                             "another name\n");
                return;
            }
        }
 
        //
        // try to open the source and get the handle
        //
        DetailsOfSource = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(4));
 
        SourceHandle = ForwardingCreateOutputSource(Type, DetailsOfSource, &Socket, &Module);
 
        //
        // Check if it's a valid handle or not
        //
        if (SourceHandle == INVALID_HANDLE_VALUE)
        {
            ShowMessages(
                "err, invalid address or cannot open or find the address\n");
            return;
        }
 
        //
        // allocate the buffer for storing the event forwarding details
        //
        EventForwardingObject =
            (PDEBUGGER_EVENT_FORWARDING)malloc(sizeof(DEBUGGER_EVENT_FORWARDING));
 
        if (EventForwardingObject == NULL)
        {
            ShowMessages("err, in allocating memory for event forwarding\n");
            return;
        }
 
        RtlZeroMemory(EventForwardingObject, sizeof(DEBUGGER_EVENT_FORWARDING));
 
        //
        // Set the state
        //
        EventForwardingObject->State = EVENT_FORWARDING_STATE_NOT_OPENED;
 
        //
        // Set the type
        //
        EventForwardingObject->Type = Type;
 
        //
        // Get a new tag
        //
        EventForwardingObject->OutputUniqueTag = ForwardingGetNewOutputSourceTag();
 
        //
        // Set the handle or in the case of TCP, set the socket
        // or if it's a module the set the module handle
        //
        if (Type == EVENT_FORWARDING_TCP)
        {
            EventForwardingObject->Socket = Socket;
        }
        else if (Type == EVENT_FORWARDING_MODULE)
        {
            EventForwardingObject->Module = Module;
 
            //
            // Handle is the function address
            //
            EventForwardingObject->Handle = SourceHandle;
        }
        else
        {
            EventForwardingObject->Handle = SourceHandle;
        }
 
        //
        // Move the name of the output source to the buffer
        //
        strcpy_s(EventForwardingObject->Name,
                 GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
 
        //
        // Check if list is initialized or not
        //
        if (!g_OutputSourcesInitialized)
        {
            g_OutputSourcesInitialized = TRUE;
            InitializeListHead(&g_OutputSources);
        }
 
        //
        // Add the source to the trace list
        //
        InsertHeadList(&g_OutputSources,
                       &(EventForwardingObject->OutputSourcesList));
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "open"))
    {
        //
        // It's an open
        //
        if (!g_OutputSourcesInitialized)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
 
        //
        // Now we should find the corresponding object in the memory and
        // pass it to the global open functions
        //
        TempList = &g_OutputSources;
 
        while (&g_OutputSources != TempList->Flink)
        {
            TempList = TempList->Flink;
 
            PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails = CONTAINING_RECORD(
                TempList,
                DEBUGGER_EVENT_FORWARDING,
                OutputSourcesList);
 
            if (strcmp(CurrentOutputSourceDetails->Name,
                       GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str()) == 0)
            {
                //
                // Indicate that we found this item
                //
                OutputSourceFound = TRUE;
 
                //
                // Open the output
                //
                Status = ForwardingOpenOutputSource(CurrentOutputSourceDetails);
 
                if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_ALREADY_CLOSED)
                {
                    ShowMessages("err, the name you entered was already closed\n");
                    return;
                }
                else if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_ALREADY_OPENED)
                {
                    ShowMessages("err, the name you entered was already opened\n");
                    return;
                }
                else if (Status !=
                         DEBUGGER_OUTPUT_SOURCE_STATUS_SUCCESSFULLY_OPENED)
                {
                    ShowMessages("err, unable to open the output source\n");
                    return;
                }
 
                //
                // No need to search through the list anymore
                //
                break;
            }
        }
 
        if (!OutputSourceFound)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "close"))
    {
        //
        // It's a close
        //
        if (!g_OutputSourcesInitialized)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
 
        //
        // Now we should find the corresponding object in the memory and
        // pass it to the global close functions
        //
        TempList = &g_OutputSources;
 
        while (&g_OutputSources != TempList->Flink)
        {
            TempList = TempList->Flink;
 
            PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails = CONTAINING_RECORD(
                TempList,
                DEBUGGER_EVENT_FORWARDING,
                OutputSourcesList);
 
            if (strcmp(CurrentOutputSourceDetails->Name,
                       GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str()) == 0)
            {
                //
                // Indicate that we found this item
                //
                OutputSourceFound = TRUE;
 
                //
                // Close the output if it's not already closed
                //
                Status = ForwardingCloseOutputSource(CurrentOutputSourceDetails);
 
                if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_ALREADY_CLOSED)
                {
                    ShowMessages("err, the name you entered was already closed\n");
                    return;
                }
                else if (Status == DEBUGGER_OUTPUT_SOURCE_STATUS_UNKNOWN_ERROR)
                {
                    ShowMessages("err, unable to close the source\n");
                    return;
                }
                else if (Status !=
                         DEBUGGER_OUTPUT_SOURCE_STATUS_SUCCESSFULLY_CLOSED)
                {
                    ShowMessages("err, unable to close the source\n");
                    return;
                }
 
                //
                // No need to search through the list anymore
                //
                break;
            }
        }
 
        if (!OutputSourceFound)
        {
            ShowMessages("err, the name you entered, not found\n");
            return;
        }
    }
    else
    {
        //
        // Invalid argument
        //
        ShowMessages("incorrect option at '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandOutputHelp();
        return;
    }
}

◆ CommandP()

VOID CommandP	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of p command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32                           StepCount;
    DEBUGGER_REMOTE_STEPPING_REQUEST RequestFormat;
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 1 && CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPHelp();
        return;
    }
 
    //
    // Set type of request
    //
    RequestFormat = DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER;
 
    //
    // Check if the command has a counter parameter
    //
    if (CommandTokens.size() == 2)
    {
        if (!ConvertTokenToUInt32(CommandTokens.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandPHelp();
            return;
        }
    }
    else
    {
        StepCount = 1;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Check if the thread is paused or not
        //
        if (g_ActiveProcessDebuggingState.IsActive && !g_ActiveProcessDebuggingState.IsPaused)
        {
            ShowMessages("the target process is running, use the "
                         "'pause' command or press CTRL+C to pause the process\n");
            return;
        }
 
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (SIZE_T i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            //
            // Perform Step-over
            //
            SteppingStepOver();
 
            if (CompareLowerCaseStrings(CommandTokens.at(0), "pr"))
            {
                //
                // Show registers
                //
                HyperDbgRegisterShowAll();
 
                if (i != StepCount - 1)
                {
                    ShowMessages("\n");
                }
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, stepping (p) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandPa2va()

VOID CommandPa2va	(	vector< CommandToken >	CommandTokens,
		string	Command )

!pa2va command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                              Status;
    ULONG                             ReturnedLength;
    UINT64                            TargetPa;
    UINT32                            Pid            = 0;
    DEBUGGER_VA2PA_AND_PA2VA_COMMANDS AddressDetails = {0};
 
    if (CommandTokens.size() == 1 || CommandTokens.size() >= 5 || CommandTokens.size() == 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandPa2vaHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CommandTokens.size() == 2)
    {
        //
        // It's just a address for current process
        //
        if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)), &TargetPa))
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
            return;
        }
    }
    else
    {
        //
        // It might be address + pid
        //
        if (CompareLowerCaseStrings(CommandTokens.at(1), "pid"))
        {
            if (!ConvertTokenToUInt32(CommandTokens.at(2), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)), &TargetPa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)).c_str());
                return;
            }
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(2), "pid"))
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)), &TargetPa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
 
                return;
            }
            if (!ConvertTokenToUInt32(CommandTokens.at(3), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
        }
        else
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandPa2vaHelp();
            return;
        }
    }
 
    //
    // Prepare the buffer
    // We use same buffer for input and output
    //
    AddressDetails.PhysicalAddress    = TargetPa;
    AddressDetails.ProcessId          = Pid; // it's null if in debugger mode
    AddressDetails.IsVirtual2Physical = FALSE;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Check to prevent using process id in !pa2va command
        //
        if (Pid != 0)
        {
            ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
            return;
        }
 
        //
        // Send the request over serial kernel debugger
        //
 
        KdSendVa2paAndPa2vaPacketToDebuggee(&AddressDetails);
    }
    else
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        if (Pid == 0)
        {
            Pid                      = GetCurrentProcessId();
            AddressDetails.ProcessId = Pid;
        }
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                           // Handle to device
            IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS,  // IO Control Code (IOCTL)
            &AddressDetails,                          // Input Buffer to driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Input buffer length
            &AddressDetails,                          // Output Buffer from driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Length of output
                                                      // buffer in bytes.
            &ReturnedLength,                          // Bytes placed in buffer.
            NULL                                      // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (AddressDetails.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            //
            // Show the results
            //
            ShowMessages("%llx\n", AddressDetails.VirtualAddress);
        }
        else
        {
            //
            // An err occurred, no results
            //
            ShowErrorMessage(AddressDetails.KernelStatus);
        }
    }
}

◆ CommandPagein()

VOID CommandPagein	(	vector< CommandToken >	CommandTokens,
		string	Command )

.pagein command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32               Pid                = 0;
    UINT64               Length             = 0;
    UINT64               TargetAddressFrom  = NULL;
    UINT64               TargetAddressTo    = NULL;
    BOOLEAN              IsNextProcessId    = FALSE;
    BOOLEAN              IsFirstCommand     = TRUE;
    BOOLEAN              IsNextLength       = FALSE;
    PAGE_FAULT_EXCEPTION PageFaultErrorCode = {0};
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CommandTokens.size() == 1)
    {
        //
        // Means that user entered one command without any parameter
        //
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPageinHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand)
        {
            IsFirstCommand = FALSE;
            continue;
        }
        if (IsNextProcessId == TRUE)
        {
            if (!ConvertTokenToUInt32(Section, &Pid))
            {
                ShowMessages("err, you should enter a valid process id\n\n");
                return;
            }
            IsNextProcessId = FALSE;
            continue;
        }
 
        if (IsNextLength == TRUE)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &Length))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
            IsNextLength = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "l"))
        {
            IsNextLength = TRUE;
            continue;
        }
 
        // if (CompareLowerCaseStrings(Section, "pid"))
        // {
        //     IsNextProcessId = TRUE;
        //     continue;
        // }
 
        //
        // Probably it's address or mode string
        //
 
        if (CommandPageinCheckAndInterpretModeString(GetLowerStringFromCommandToken(Section), &PageFaultErrorCode))
        {
            continue;
        }
        else if (TargetAddressFrom == 0)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section),
                                                  &TargetAddressFrom))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                return;
            }
        }
        else
        {
            //
            // User inserts two address
            //
            ShowMessages("err, incorrect use of the '.pagein' command\n\n");
            CommandPageinHelp();
 
            return;
        }
    }
 
    if (!TargetAddressFrom)
    {
        //
        // User inserts two address
        //
        ShowMessages("err, please enter a valid address\n\n");
 
        return;
    }
 
    if (IsNextLength || IsNextProcessId)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPageinHelp();
        return;
    }
 
    //
    // If the user didn't specified a range, then only one page will be
    // paged-in; so we use the same AddressFrom and AddressTo
    //
    if (Length == 0)
    {
        TargetAddressTo = TargetAddressFrom;
    }
    else
    {
        TargetAddressTo = TargetAddressFrom + Length;
    }
 
    //
    // Send the request
    //
    // ShowMessages(".pagin address from: %llx -> to %llx, page-fault code: 0x%x, pid: %x, length: 0x%llx",
    //              TargetAddressFrom,
    //              TargetAddressTo,
    //              PageFaultErrorCode.AsUInt,
    //              Pid,
    //              Length);
 
    //
    // Request the page-in
    //
    CommandPageinRequest(TargetAddressFrom,
                         TargetAddressTo,
                         PageFaultErrorCode,
                         Pid);
}

◆ CommandPause()

VOID CommandPause	(	vector< CommandToken >	CommandTokens,
		string	Command )

pause command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPauseHelp();
        return;
    }
 
    //
    // request to pause
    //
    CommandPauseRequest();
}

◆ CommandPcicam()

VOID CommandPcicam	(	vector< CommandToken >	CommandTokens,
		string	Command )

!pcicam command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                                        Status;
    ULONG                                       ReturnedLength;
    DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET PcidevinfoPacket = {0};
    UINT32                                      TargetBus        = 0;
    UINT32                                      TargetDevice     = 0;
    UINT32                                      TargetFunction   = 0;
 
    const CHAR * PciHeaderTypes[] = {"Endpoint", "PCI-to-PCI Bridge", "PCI-to-CardBus Bridge"};
 
    if (CommandTokens.size() < 4 || CommandTokens.size() > 5)
    {
        ShowMessages("Incorrect use of '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPcicamHelp();
        return;
    }
 
    if (ConvertTokenToUInt32(CommandTokens.at(1), &TargetBus))
    {
        if (TargetBus > BUS_MAX_NUM)
        {
            ShowMessages("Invalid bus number '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
            CommandPcicamHelp();
            return;
        }
        PcidevinfoPacket.DeviceInfo.Bus = (UINT8)TargetBus;
    }
 
    if (ConvertTokenToUInt32(CommandTokens.at(2), &TargetDevice))
    {
        if (TargetDevice > DEVICE_MAX_NUM)
        {
            ShowMessages("Invalid device number '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
            CommandPcicamHelp();
            return;
        }
        PcidevinfoPacket.DeviceInfo.Device = (UINT8)TargetDevice;
    }
 
    if (ConvertTokenToUInt32(CommandTokens.at(3), &TargetFunction))
    {
        if (TargetFunction > FUNCTION_MAX_NUM)
        {
            ShowMessages("Invalid function number '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)).c_str());
            CommandPcicamHelp();
            return;
        }
        PcidevinfoPacket.DeviceInfo.Function = (UINT8)TargetFunction;
    }
 
    if (CommandTokens.size() == 5)
    {
        if (strncmp(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(4)).c_str(), "x", 1) == 0)
        {
            PcidevinfoPacket.PrintRaw = TRUE;
        }
        else
        {
            ShowMessages("Invalid parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(4)).c_str());
            CommandPcicamHelp();
            return;
        }
    }
 
    //
    // Send buffer
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        KdSendPcidevinfoPacketToDebuggee(&PcidevinfoPacket);
    }
    else
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                                     // Handle to device
            IOCTL_PCIDEVINFO_ENUM,                              // IO Control Code (IOCTL)
            &PcidevinfoPacket,                                  // Input Buffer to driver.
            SIZEOF_DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET, // Input buffer length
            &PcidevinfoPacket,                                  // Output Buffer from driver.
            SIZEOF_DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET, // Length of output
                                                                // buffer in bytes.
            &ReturnedLength,                                    // Bytes placed in buffer.
            NULL                                                // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (PcidevinfoPacket.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            //
            // For some reason, MSVC refuses to initialize these at top of case
            //
            const CHAR * PciHeaderTypeAsString[]  = {"Endpoint", "PCI-to-PCI Bridge", "PCI-to-CardBus Bridge"};
            const CHAR * PciMmioBarTypeAsString[] = {"32-bit Wide",
                                                     "Reserved",
                                                     "64-bit Wide",
                                                     "Reserved"};
            UINT8        BarNumOffset             = 0;
 
            ShowMessages("PCI configuration space (CAM) for device %04x:%02x:%02x:%x\n",
                         0, // TODO: Add support for domains beyond 0000
                         PcidevinfoPacket.DeviceInfo.Bus,
                         PcidevinfoPacket.DeviceInfo.Device,
                         PcidevinfoPacket.DeviceInfo.Function);
 
            if (!PcidevinfoPacket.PrintRaw)
            {
                Vendor * CurrentVendor     = GetVendorById(PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.VendorId);
                CHAR *   CurrentVendorName = (CHAR *)"N/A";
                CHAR *   CurrentDeviceName = (CHAR *)"N/A";
 
                if (CurrentVendor != NULL)
                {
                    CurrentVendorName      = CurrentVendor->VendorName;
                    Device * CurrentDevice = GetDeviceFromVendor(CurrentVendor, PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.DeviceId);
 
                    if (CurrentDevice != NULL)
                    {
                        CurrentDeviceName = CurrentDevice->DeviceName;
                    }
                }
 
                ShowMessages("\nCommon Header:\nVID:DID: %04x:%04x\nVendor Name: %-17.*s\nDevice Name: %.*s\nCommand: %04x\n",
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.VendorId,
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.DeviceId,
                             strnlen_s(CurrentVendorName, PCI_NAME_STR_LENGTH),
                             CurrentVendorName,
                             strnlen_s(CurrentDeviceName, PCI_NAME_STR_LENGTH),
                             CurrentDeviceName,
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Command);
 
                if ((PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x01) << 7 == 0) // Only applicable to endpoints
                {
                    ShowMessages("  Memory Space: %u\n  I/O Space: %u\n",
                                 (PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Command & 0x2) >> 1,
                                 (PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Command & 0x1));
                }
 
                ShowMessages("Status: %04x\nRevision ID: %02x\nClass Code: %06x\nCacheLineSize: %02x\nPrimaryLatencyTimer: %02x\nHeaderType: %s (%02x)\n  Multi-function Device: %s\nBist: %02x\n",
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Status,
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.RevisionId,
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.ClassCode,
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.CacheLineSize,
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.PrimaryLatencyTimer,
                             (PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x3f) < 2 ? PciHeaderTypeAsString[(PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x1)] : "Unknown",
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType,
                             (PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x1) ? "True" : "False",
                             PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Bist);
                FreeVendor(CurrentVendor);
                FreePciIdDatabase();
 
                ShowMessages("\nDevice Header:\n");
 
                if ((PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x01) << 7 == 0) // Endpoint
                {
                    for (UINT8 i = 0; i < 5; i++)
                    {
                        //
                        // Memory I/O
                        //
                        if ((PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x1) == 0)
                        {
                            //
                            // 64-bit BAR
                            //
                            if (((PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x6) >> 1) == 2)
                            {
                                UINT64 BarMsb    = PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i + 1];
                                UINT64 BarLsb    = PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i];
                                UINT64 ActualBar = ((BarMsb & 0xFFFFFFFF) << 32) + (BarLsb & 0xFFFFFFF0);
 
                                ShowMessages("BAR%u %s\n BAR Type: MMIO\n MMIO BAR Type: %s (%02x)\n BAR MSB: %08x\n BAR LSB: %08x\n BAR (actual): %016llx\n Prefetchable: %s\n",
                                             i - BarNumOffset,
                                             ((PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Command & 0x2) >> 1 == 0) || !PcidevinfoPacket.DeviceInfo.MmioBarInfo[i].IsEnabled ? "[disabled]" : "",
                                             PciMmioBarTypeAsString[(PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x6) >> 1],
                                             (PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x6) >> 1,
                                             BarMsb,
                                             BarLsb,
                                             ActualBar,
                                             (PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x8 >> 3) ? "True" : "False");
 
                                i++;
                                BarNumOffset++;
                            }
                            //
                            // 32-bit BAR
                            //
                            else
                            {
                                UINT32 ActualBar = (PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0xFFFFFFF0);
 
                                ShowMessages("BAR%u %s\n BAR Type: MMIO\n BAR: %08x\n BAR (actual): %08x\n Prefetchable: %s\n",
                                             i - BarNumOffset,
                                             ((PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Command & 0x2) >> 1 == 0) || !PcidevinfoPacket.DeviceInfo.MmioBarInfo[i].IsEnabled ? "[disabled]" : "",
                                             PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i],
                                             ActualBar,
                                             (PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x8 >> 3) ? "True" : "False");
                            }
                        }
                        //
                        // Port I/O
                        //
                        else
                        {
                            //
                            // 32-bit BAR is the only flavor we have here
                            //
                            UINT32 ActualBar32 = PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0xFFFFFFFC;
 
                            ShowMessages("BAR%u %s\n BAR Type: Port IO\n BAR: %08x\n BAR (actual): %08x\n Reserved: %u\n",
                                         i - BarNumOffset,
                                         ((PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.Command & 0x1) == 0) ? "[disabled]" : "",
                                         PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i],
                                         ActualBar32,
                                         (PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x2) >> 1);
                        }
                    }
 
                    ShowMessages("Cardbus CIS Pointer: %08x\nSubsystem Vendor ID: %04x\nSubsystem ID: %04x\nROM BAR: %08x\nCapabilities Pointer: %02x\nReserved (0xD): %06x\nReserved (0xE): %08x\nInterrupt Line: %02x\nInterrupt Pin: %02x\nMin Grant: %02x\nMax latency: %02x\n",
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.CardBusCISPtr,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.SubVendorId,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.SubSystemId,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.ROMBar,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.CapabilitiesPtr,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Reserved,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Reserved1,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.InterruptLine,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.InterruptPin,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.MinGnt,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.MaxLat);
                }
                else if ((PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x3f) == 1) // PCI-to-PCI Bridge
                {
                    ShowMessages("BAR0: %08x\nBAR1: %08x\n", PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.Bar[0], PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.Bar[1]);
 
                    ShowMessages("Primary Bus Number: %02x\nSecondary Bus Number: %02x\nSubordinate Bus Number: %02x\nSecondary Latency Timer: %02x\nI/O Base: %02x\nI/O Limit: %02x\nSecondary Status: %04x\nMemory Base: %04x\nMemory Limit: %04x\nPrefetchable Memory Base: %04x\nPrefetchable Memory Limit: %04x\nPrefetchable Base Upper 32 Bits: %08x\nPrefetchable Limit Upper 32 Bits: %08x\nI/O Base Upper 16 Bits: %04x\nI/O Limit Upper 16 Bits: %04x\nCapability Pointer: %02x\nReserved: %06x\nROM BAR: %08x\nInterrupt Line: %02x\nInterrupt Pin: %02x\nBridge Control: %04x\n",
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.PrimaryBusNumber,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.SecondaryBusNumber,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.SubordinateBusNumber,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.SecondaryLatencyTimer,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.IoBase,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.IoLimit,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.SecondaryStatus,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.MemoryBase,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.MemoryLimit,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.PrefetchableMemoryBase,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.PrefetchableMemoryLimit,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.PrefetchableBaseUpper32b,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.PrefetchableLimitUpper32b,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.IoLimitUpper16b,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.IoBaseUpper16b,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.CapabilityPtr,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.Reserved,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.ROMBar,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.InterruptLine,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.InterruptPin,
                                 PcidevinfoPacket.DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpacePtpBridge.BridgeControl);
                }
                else if ((PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x3f) == 2) // PCI-to-CardBus Bridge
                {
                    ShowMessages("Parsing header type %s (%02x) currently unsupported\n", PciHeaderTypeAsString[PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x01], PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x01);
                }
                else
                {
                    ShowMessages("\nDevice Header:\nUnknown header type %02x\n", (PcidevinfoPacket.DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x3f));
                }
            }
            else
            {
                UINT32 * cs = (UINT32 *)&PcidevinfoPacket.DeviceInfo.ConfigSpace; // Overflows into .ConfigSpaceAdditional - no padding due to pack(0)
 
                ShowMessages("    00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f\n");
 
                for (UINT16 i = 0; i < CAM_CONFIG_SPACE_LENGTH; i += 16)
                {
                    ShowMessages("%02x: ", i);
                    for (UINT8 j = 0; j < 16; j++)
                    {
                        ShowMessages("%02x ", *(((BYTE *)cs) + j));
                    }
 
                    //
                    // Print ASCII representation
                    // Replace non-printable characters with "."
                    //
                    for (UINT8 j = 0; j < 16; j++)
                    {
                        CHAR c = (CHAR) * (cs + j);
                        if (c >= 32 && c <= 126)
                        {
                            ShowMessages("%c", c);
                        }
                        else
                        {
                            ShowMessages(".");
                        }
                    }
                    ShowMessages("\n");
                    cs += 4;
                }
            }
        }
        else
        {
            //
            // An err occurred, no results
            //
            ShowMessages("An error occurred, no results:");
 
            ShowErrorMessage(PcidevinfoPacket.KernelStatus);
        }
    }
}

◆ CommandPcitree()

VOID CommandPcitree	(	vector< CommandToken >	CommandTokens,
		string	Command )

!pcitree command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                                     Status;
    ULONG                                    ReturnedLength;
    DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET PcitreePacket = {0};
 
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPcitreeHelp();
        return;
    }
 
    //
    // Send buffer
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        KdSendPcitreePacketToDebuggee(&PcitreePacket);
    }
    else
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                                  // Handle to device
            IOCTL_PCIE_ENDPOINT_ENUM,                        // IO Control Code (IOCTL)
            &PcitreePacket,                                  // Input Buffer to driver.
            SIZEOF_DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET, // Input buffer length
            &PcitreePacket,                                  // Output Buffer from driver.
            SIZEOF_DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET, // Length of output
                                                             // buffer in bytes.
            &ReturnedLength,                                 // Bytes placed in buffer.
            NULL                                             // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (PcitreePacket.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            //
            // Print PCI device tree
            //
            ShowMessages("%-12s | %-9s | %-17s | %s \n%s\n", "DBDF", "VID:DID", "Vendor Name", "Device Name", "----------------------------------------------------------------------");
            for (UINT8 i = 0; i < (PcitreePacket.DeviceInfoListNum < DEV_MAX_NUM ? PcitreePacket.DeviceInfoListNum : DEV_MAX_NUM); i++)
            {
                Vendor * CurrentVendor     = GetVendorById(PcitreePacket.DeviceInfoList[i].ConfigSpace.VendorId);
                CHAR *   CurrentVendorName = (CHAR *)"N/A";
                CHAR *   CurrentDeviceName = (CHAR *)"N/A";
 
                if (CurrentVendor != NULL)
                {
                    CurrentVendorName      = CurrentVendor->VendorName;
                    Device * CurrentDevice = GetDeviceFromVendor(CurrentVendor, PcitreePacket.DeviceInfoList[i].ConfigSpace.DeviceId);
 
                    if (CurrentDevice != NULL)
                    {
                        CurrentDeviceName = CurrentDevice->DeviceName;
                    }
                }
 
                ShowMessages("%04x:%02x:%02x:%x | %04x:%04x | %-17.*s | %.*s\n",
                             0, // TODO: Add support for domains beyond 0000
                             PcitreePacket.DeviceInfoList[i].Bus,
                             PcitreePacket.DeviceInfoList[i].Device,
                             PcitreePacket.DeviceInfoList[i].Function,
                             PcitreePacket.DeviceInfoList[i].ConfigSpace.VendorId,
                             PcitreePacket.DeviceInfoList[i].ConfigSpace.DeviceId,
                             strnlen_s(CurrentVendorName, PCI_NAME_STR_LENGTH),
                             CurrentVendorName,
                             strnlen_s(CurrentDeviceName, PCI_NAME_STR_LENGTH),
                             CurrentDeviceName
 
                );
 
                FreeVendor(CurrentVendor);
            }
            FreePciIdDatabase();
        }
        else
        {
            //
            // An err occurred, no results
            //
            ShowErrorMessage(PcitreePacket.KernelStatus);
        }
    }
}

◆ CommandPe()

VOID CommandPe	(	vector< CommandToken >	CommandTokens,
		string	Command )

.pe command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOLEAN Is32Bit = FALSE;
    wstring Filepath;
    string  TempFilePath;
    BOOLEAN ShowDumpOfSection = FALSE;
 
    if (CommandTokens.size() <= 2)
    {
        ShowMessages("err, incorrect use of the '%s' command\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPeHelp();
        return;
    }
 
    //
    // Check for first option
    //
    if (CompareLowerCaseStrings(CommandTokens.at(1), "section"))
    {
        if (CommandTokens.size() == 3)
        {
            ShowMessages("err, incorrect use of the '%s' command\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandPeHelp();
            return;
        }
 
        if (CommandTokens.size() != 4)
        {
            ShowMessages("err, incorrect use of the '%s' command\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandPeHelp();
            return;
        }
        ShowDumpOfSection = TRUE;
        TempFilePath      = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3));
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "header"))
    {
        if (CommandTokens.size() != 3)
        {
            ShowMessages("err, incorrect use of the '%s' command\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandPeHelp();
            return;
        }
 
        ShowDumpOfSection = FALSE;
        TempFilePath      = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2));
    }
    else
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        CommandPeHelp();
        return;
    }
 
    //
    // Convert path to wstring
    //
    StringToWString(Filepath, TempFilePath);
 
    //
    // TEMPORARY LINUX SHIM:
    //   std::wstring stores native wchar_t, which is 4 bytes on Linux, but the
    //   HyperDbg WCHAR type is 2 bytes (UINT16) and the PE-parser path APIs take
    //   a const WCHAR *. The cast below exists ONLY so the project compiles on
    //   Linux. On Linux it produces a bogus 2-byte reinterpretation of the 4-byte
    //   buffer; that is acceptable for now only because Linux file I/O is still
    //   stubbed (the path is never actually opened). On Windows WCHAR == wchar_t,
    //   so it is a plain, correct pointer with no reinterpretation.
    //
    //   TODO (Linux): remove this cast once real Linux file I/O lands. The proper
    //   fix is to convert the 4-byte wchar_t path into a 2-byte WCHAR/UTF-16
    //   buffer (e.g. a std::wstring -> WCHAR helper) and pass that, so the PE
    //   parser receives a valid path. The same conversion is needed by
    //   PlatformMapFileReadOnly / PlatformOpenFileForWriting.
    //
#ifdef __linux__
    const WCHAR * FilepathW = (const WCHAR *)Filepath.c_str();
#else
    const WCHAR * FilepathW = Filepath.c_str();
#endif
 
    //
    // Detect whether PE is 32-bit or 64-bit
    //
    if (!PeIsPE32BitOr64Bit(FilepathW, &Is32Bit))
    {
        //
        // File was invalid, the error message is shown in the above function
        //
        return;
    }
 
    //
    // Parse PE file
    //
    if (!ShowDumpOfSection)
    {
        PeShowSectionInformationAndDump(FilepathW, NULL, Is32Bit);
    }
    else
    {
        PeShowSectionInformationAndDump(FilepathW, GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str(), Is32Bit);
    }
}

◆ CommandPmc()

VOID CommandPmc	(	vector< CommandToken >	CommandTokens,
		string	Command )

!pmc command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            PMC_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (CommandTokens.size() > 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPmcHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandPreactivate()

VOID CommandPreactivate	(	vector< CommandToken >	CommandTokens,
		string	Command )

preactivate command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                         Status;
    ULONG                        ReturnedLength;
    DEBUGGER_PREACTIVATE_COMMAND PreactivateRequest = {};
 
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPreactivateHelp();
        return;
    }
 
    //
    // Set the type of preactivation
    //
    if (CompareLowerCaseStrings(CommandTokens.at(1), "mode") || CompareLowerCaseStrings(CommandTokens.at(1), "!mode"))
    {
        PreactivateRequest.Type = DEBUGGER_PREACTIVATE_COMMAND_TYPE_MODE;
    }
    else
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        return;
    }
 
    AssertShowMessageReturnStmt(g_IsVmmModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_VMM_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    //
    // Send IOCTL
    //
    Status = PlatformDeviceIoControl(
        g_DeviceHandle,                      // Handle to device
        IOCTL_PREACTIVATE_FUNCTIONALITY,     // IO Control Code (IOCTL)
        &PreactivateRequest,                 // Input Buffer to driver.
        SIZEOF_DEBUGGER_PREACTIVATE_COMMAND, // Input buffer length
        &PreactivateRequest,                 // Output Buffer from driver.
        SIZEOF_DEBUGGER_PREACTIVATE_COMMAND, // Length of output
                                             // buffer in bytes.
        &ReturnedLength,                     // Bytes placed in buffer.
        NULL                                 // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", PlatformGetLastError());
        return;
    }
 
    if (PreactivateRequest.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("the requested service is activated successfully!\n");
    }
    else
    {
        //
        // An err occurred, no results
        //
        ShowErrorMessage(PreactivateRequest.KernelStatus);
    }
}

◆ CommandPrealloc()

VOID CommandPrealloc	(	vector< CommandToken >	CommandTokens,
		string	Command )

prealloc command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                      Status;
    ULONG                     ReturnedLength;
    UINT64                    Count;
    DEBUGGER_PREALLOC_COMMAND PreallocRequest = {};
    string                    SecondParam;
 
    if (CommandTokens.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPreallocHelp();
        return;
    }
 
    SecondParam = GetLowerStringFromCommandToken(CommandTokens.at(1));
 
    //
    // Set the type of pre-allocation
    //
    if (!SecondParam.compare("thread-interception"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION;
    }
    else if (!SecondParam.compare("monitor") || !SecondParam.compare("!monitor"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR;
    }
    else if (!SecondParam.compare("epthook") || !SecondParam.compare("!epthook"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK;
    }
    else if (!SecondParam.compare("epthook2") || !SecondParam.compare("!epthook2"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK2;
    }
    else if (!SecondParam.compare("regular-event"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_EVENT;
    }
    else if (!SecondParam.compare("big-event"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_EVENT;
    }
    else if (!SecondParam.compare("regular-safe-buffer"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_SAFE_BUFFER;
    }
    else if (!SecondParam.compare("big-safe-buffer"))
    {
        PreallocRequest.Type = DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_SAFE_BUFFER;
    }
    else
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        return;
    }
 
    //
    // Get the count of needed pre-allocated buffers
    //
    if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)), &Count))
    {
        //
        // Couldn't resolve or unknown parameter
        //
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
        return;
    }
 
    //
    // Set the counter
    //
    PreallocRequest.Count = (UINT32)Count;
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    //
    // Send IOCTL
    //
    Status = PlatformDeviceIoControl(
        g_DeviceHandle,                    // Handle to device
        IOCTL_RESERVE_PRE_ALLOCATED_POOLS, // IO Control Code (IOCTL)
        &PreallocRequest,                  // Input Buffer to driver.
        SIZEOF_DEBUGGER_PREALLOC_COMMAND,  // Input buffer length
        &PreallocRequest,                  // Output Buffer from driver.
        SIZEOF_DEBUGGER_PREALLOC_COMMAND,  // Length of output
                                           // buffer in bytes.
        &ReturnedLength,                   // Bytes placed in buffer.
        NULL                               // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", PlatformGetLastError());
        return;
    }
 
    if (PreallocRequest.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("the requested pools are allocated and reserved\n");
    }
    else
    {
        //
        // An err occurred, no results
        //
        ShowErrorMessage(PreallocRequest.KernelStatus);
    }
}

◆ CommandPrint()

VOID CommandPrint	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of print command

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPrintHelp();
        return;
    }
 
    //
    // Trim the command
    //
    Trim(Command);
 
    //
    // Remove print from it
    //
    Command.erase(0, GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).size());
 
    //
    // Trim it again
    //
    Trim(Command);
 
    //
    // Prepend and append 'print(' and ')'
    //
    Command.insert(0, "print(");
    Command.append(");");
 
    //
    // Execute the expression
    //
    ScriptEngineExecuteSingleExpression((CHAR *)Command.c_str(), TRUE, FALSE);
}

◆ CommandProcess()

VOID CommandProcess	(	vector< CommandToken >	CommandTokens,
		string	Command )

.process command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32                               TargetProcessId            = 0;
    UINT64                               TargetProcess              = 0;
    UINT64                               AddressOfActiveProcessHead = 0; // nt!PsActiveProcessHead
    UINT32                               OffsetOfImageFileName      = 0; // nt!_EPROCESS.ImageFileName
    UINT32                               OffsetOfUniqueProcessId    = 0; // nt!_EPROCESS.UniqueProcessId
    UINT32                               OffsetOfActiveProcessLinks = 0; // nt!_EPROCESS.ActiveProcessLinks
    BOOLEAN                              ResultOfGettingOffsets     = FALSE;
    BOOLEAN                              IsSetByClkIntr             = FALSE;
    DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededItems     = {0};
 
    if (CommandTokens.size() >= 4)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandProcessHelp();
        return;
    }
 
    if (CommandTokens.size() == 1)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Get the process details in VMI mode
            //
            ObjectShowProcessesOrThreadDetails(TRUE);
        }
        else
        {
            //
            // Send the packet to get current process
            //
            KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS,
                                                NULL,
                                                NULL,
                                                FALSE,
                                                NULL);
        }
    }
    else if (CommandTokens.size() == 2)
    {
        if (CompareLowerCaseStrings(CommandTokens.at(1), "list"))
        {
            //
            // Query for nt!_EPROCESS.ImageFileName, nt!_EPROCESS.UniqueProcessId,
            // nt!_EPROCESS.UniqueProcessId offset from the top of nt!_EPROCESS,
            // and nt!PsActiveProcessHead address and check if we find them or not,
            // otherwise, it means that the PDB for ntoskrnl.exe is not available
            //
            if (ScriptEngineGetFieldOffsetWrapper((CHAR *)"nt!_EPROCESS", (CHAR *)"ActiveProcessLinks", &OffsetOfActiveProcessLinks) &&
                ScriptEngineGetFieldOffsetWrapper((CHAR *)"nt!_EPROCESS", (CHAR *)"ImageFileName", &OffsetOfImageFileName) &&
                ScriptEngineGetFieldOffsetWrapper((CHAR *)"nt!_EPROCESS", (CHAR *)"UniqueProcessId", &OffsetOfUniqueProcessId) &&
                SymbolConvertNameOrExprToAddress("nt!PsActiveProcessHead", &AddressOfActiveProcessHead))
            {
                //
                // For test offsets and addresses
                //
 
                /*
                ShowMessages("Address of ActiveProcessHead : %llx\n", AddressOfActiveProcessHead);
                ShowMessages("Offset Of ActiveProcessLinks : 0x%x\n", OffsetOfActiveProcessLinks);
                ShowMessages("Offset Of ImageFileName : 0x%x\n", OffsetOfImageFileName);
                ShowMessages("Offset Of UniqueProcessId : 0x%x\n", OffsetOfUniqueProcessId);
                */
 
                ProcessListNeededItems.PsActiveProcessHead      = AddressOfActiveProcessHead;
                ProcessListNeededItems.ActiveProcessLinksOffset = OffsetOfActiveProcessLinks;
                ProcessListNeededItems.ImageFileNameOffset      = OffsetOfImageFileName;
                ProcessListNeededItems.UniquePidOffset          = OffsetOfUniqueProcessId;
 
                if (!g_IsSerialConnectedToRemoteDebuggee)
                {
                    //
                    // Get list of processes in VMI mode
                    //
                    ObjectShowProcessesOrThreadList(TRUE,
                                                    &ProcessListNeededItems,
                                                    NULL,
                                                    NULL);
                }
                else
                {
                    //
                    // Send the packet to show list of process
                    //
                    KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST,
                                                        NULL,
                                                        NULL,
                                                        FALSE,
                                                        &ProcessListNeededItems);
                }
            }
            else
            {
                ShowMessages("err, the need offset to iterate over processes not found, "
                             "make sure to load ntoskrnl.exe's PDB file. use '.help .sym' for "
                             "more information\n");
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
            CommandProcessHelp();
            return;
        }
    }
    else if (CommandTokens.size() == 3)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            ShowMessages("err, you're not connected to any debuggee in Debugger Mode, "
                         "you can use the '.attach', or the '.detach' commands if you're "
                         "operating in VMI Mode\n");
            return;
        }
 
        if (CompareLowerCaseStrings(CommandTokens.at(1), "pid"))
        {
            if (!ConvertTokenToUInt32(CommandTokens.at(2), &TargetProcessId))
            {
                ShowMessages(
                    "please specify a correct hex value for the process id that you "
                    "want to operate on it\n\n");
                CommandProcessHelp();
                return;
            }
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(1), "process"))
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)), &TargetProcess))
            {
                ShowMessages(
                    "please specify a correct hex value for the process (nt!_EPROCESS) that you "
                    "want to operate on it\n\n");
                CommandProcessHelp();
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
            CommandProcessHelp();
            return;
        }
 
        //
        // Check for switching method
        //
        if (CompareLowerCaseStrings(CommandTokens.at(0), ".process2"))
        {
            IsSetByClkIntr = FALSE;
        }
        else
        {
            IsSetByClkIntr = TRUE;
        }
 
        //
        // Send the packet to change process
        //
        KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH,
                                            TargetProcessId,
                                            TargetProcess,
                                            IsSetByClkIntr,
                                            NULL);
    }
    else
    {
        ShowMessages("invalid parameter\n\n");
        CommandProcessHelp();
        return;
    }
}

◆ CommandPt()

VOID CommandPt	(	vector< CommandToken >	CommandTokens,
		string	Command )

!pt command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    HYPERTRACE_PT_OPERATION_PACKETS PtRequest = {0};
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandPtHelp();
        return;
    }
 
    if (CompareLowerCaseStrings(CommandTokens.at(1), "enable") && CommandTokens.size() == 2)
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_ENABLE;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "disable") && CommandTokens.size() == 2)
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DISABLE;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "pause") && CommandTokens.size() == 2)
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_PAUSE;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "resume") && CommandTokens.size() == 2)
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_RESUME;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "size") && CommandTokens.size() == 2)
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_SIZE;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "dump") && CommandTokens.size() == 2)
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DUMP;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "flush") && CommandTokens.size() == 2)
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FLUSH;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "filter"))
    {
        PtRequest.PtOperationType = HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FILTER;
 
        if (!CommandPtParseFilterOptions(CommandTokens, &PtRequest))
        {
            CommandPtHelp();
            return;
        }
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPtHelp();
        return;
    }
 
    //
    // Send the PT operation request
    //
    if (CommandPtSendRequest(&PtRequest))
    {
        switch (PtRequest.PtOperationType)
        {
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_ENABLE:
            ShowMessages("PT enabled successfully\n");
            break;
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DISABLE:
            ShowMessages("PT disabled successfully\n");
            break;
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_PAUSE:
            ShowMessages("PT trace paused\n");
            break;
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_RESUME:
            ShowMessages("PT trace resumed\n");
            break;
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_SIZE:
            ShowMessages("PT buffer bytes-written per CPU:\n");
            for (UINT32 i = 0; i < PtRequest.NumCpus; i++)
            {
                ShowMessages("  core %u : 0x%llx\n", i, PtRequest.BytesPerCpu[i]);
            }
            break;
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DUMP:
            ShowMessages("PT trace state is shown\n");
            break;
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FLUSH:
            ShowMessages("PT trace state is flushed\n");
            break;
        case HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FILTER:
            ShowMessages("PT filter / config updated successfully\n");
            break;
        default:
            ShowMessages("unknown PT operation type\n");
            break;
        }
    }
    else
    {
        ShowErrorMessage(PtRequest.KernelStatus);
        return;
    }
}

◆ CommandPte()

VOID CommandPte	(	vector< CommandToken >	CommandTokens,
		string	Command )

!pte command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                                     Status;
    ULONG                                    ReturnedLength;
    UINT64                                   TargetVa;
    UINT32                                   Pid            = 0;
    DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS AddressDetails = {0};
 
    if (CommandTokens.size() == 1 || CommandTokens.size() >= 5 ||
        CommandTokens.size() == 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandPteHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CommandTokens.size() == 2)
    {
        //
        // It's just an address for current process
        //
        if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)), &TargetVa))
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
            return;
        }
    }
    else
    {
        //
        // It might be address + pid
        //
        if (CompareLowerCaseStrings(CommandTokens.at(1), "pid"))
        {
            if (!ConvertTokenToUInt32(CommandTokens.at(2), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
 
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)).c_str());
                return;
            }
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(2), "pid"))
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
                return;
            }
 
            if (!ConvertTokenToUInt32(CommandTokens.at(3), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
        }
        else
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandPteHelp();
            return;
        }
    }
 
    //
    // Prepare the buffer
    // We use same buffer for input and output
    //
    AddressDetails.VirtualAddress = TargetVa;
    AddressDetails.ProcessId      = Pid; // null in debugger mode
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Check to prevent using process id in !pte command
        //
        if (Pid != 0)
        {
            ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
            return;
        }
 
        //
        // Send the request over serial kernel debugger
        //
 
        KdSendPtePacketToDebuggee(&AddressDetails);
    }
    else
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        if (Pid == 0)
        {
            Pid                      = GetCurrentProcessId();
            AddressDetails.ProcessId = Pid;
        }
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                                  // Handle to device
            IOCTL_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS,  // IO Control Code (IOCTL)
            &AddressDetails,                                 // Input Buffer to driver.
            SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, // Input buffer length
            &AddressDetails,                                 // Output Buffer from driver.
            SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, // Length of output
                                                             // buffer in bytes.
            &ReturnedLength,                                 // Bytes placed in buffer.
            NULL                                             // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (AddressDetails.KernelStatus != DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            ShowErrorMessage(AddressDetails.KernelStatus);
            return;
        }
 
        //
        // Show the results
        //
        CommandPteShowResults(TargetVa, &AddressDetails);
    }
}

◆ CommandPteShowResults()

VOID CommandPteShowResults	(	UINT64	TargetVa,
		PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS	PteRead )

show results of !pte command

Parameters

TargetVa
PteRead

Returns: VOID

{
    /*
    VA fffff8003abc9370
    PXE at FFFF83C1E0F07F80    PPE at FFFF83C1E0FF0000    PDE at
    FFFF83C1FE000EA8    PTE at FFFF83FC001D5E48 contains 0000000004108063
    contains 0000000004109063  contains 00000000026008E3  contains
    0000000000000000 pfn 4108      ---DA--KWEV  pfn 4109      ---DA--KWEV  pfn
    2600      --LDA--KWEV  LARGE PAGE pfn 27c9
  */
    ShowMessages("VA %llx\n", TargetVa);
    ShowMessages("PML4E (PXE) at %016llx\tcontains %016llx\nPDPTE (PPE) at "
                 "%016llx\tcontains "
                 "%016llx\nPDE at %016llx\tcontains %016llx\n",
                 PteRead->Pml4eVirtualAddress,
                 PteRead->Pml4eValue,
                 PteRead->PdpteVirtualAddress,
                 PteRead->PdpteValue,
                 PteRead->PdeVirtualAddress,
                 PteRead->PdeValue);
 
    //
    // Check if it's a large PDE
    //
    if (PteRead->PdeVirtualAddress == PteRead->PteVirtualAddress)
    {
        ShowMessages("PDE is a large page, so it doesn't have a PTE\n");
    }
    else
    {
        ShowMessages("PTE at %016llx\tcontains %016llx\n",
                     PteRead->PteVirtualAddress,
                     PteRead->PteValue);
    }
}

◆ CommandR()

VOID CommandR	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of r command

Parameters

CommandTokens
Command

Returns: VOID

{
    REGS_ENUM                RegKind;
    std::vector<std::string> Tmp;
    std::string              SetRegisterValue;
 
    if (CommandTokens.size() == 1)
    {
        //
        // show all registers
        //
        if (g_IsSerialConnectedToRemoteDebuggee ||
            (g_ActiveProcessDebuggingState.IsActive && g_ActiveProcessDebuggingState.IsPaused))
        {
            HyperDbgRegisterShowAll();
        }
        else
        {
            ShowMessages("err, reading registers (r) is not valid in the current "
                         "context, you should connect to a debuggee or attach to a process\n");
        }
 
        return;
    }
 
    //
    // clear additional space of the command string
    //
 
    //
    // if command does not contain a '=' means user wants to read it
    //
    if (Command.find('=', 0) == string::npos)
    {
        //
        // erase '=' from the string now we have just the name of register
        //
        Command.erase(0, 1);
        ReplaceAll(Command, "@", "");
        ReplaceAll(Command, " ", "");
        if (RegistersMap.find(Command) != RegistersMap.end())
        {
            RegKind = RegistersMap[Command];
        }
        else
        {
            //
            // set the Reg to -1(invalid register)
            //
            RegKind = (REGS_ENUM)-1;
        }
 
        if (RegKind != -1)
        {
            //
            // send the request
            //
            if (g_IsSerialConnectedToRemoteDebuggee ||
                (g_ActiveProcessDebuggingState.IsActive && g_ActiveProcessDebuggingState.IsPaused))
            {
                HyperDbgRegisterShowTargetRegister(RegKind);
            }
            else
            {
                ShowMessages("err, reading registers (r) is not valid in the current "
                             "context, you should connect to a debuggee or attach to a process\n");
            }
        }
        else
        {
            ShowMessages("err, invalid register\n");
        }
    }
 
    //
    // if command contains a '=' means user wants modify the register
    //
    else if (Command.find('=', 0) != string::npos)
    {
        Command.erase(0, 1);
        Tmp = Split(Command, '=');
        if (Tmp.size() == 2)
        {
            ReplaceAll(Tmp[0], " ", "");
            string tmp = Tmp[0];
            if (RegistersMap.find(Tmp[0]) != RegistersMap.end())
            {
                RegKind = RegistersMap[Tmp[0]];
            }
            else
            {
                ReplaceAll(tmp, "@", "");
                if (RegistersMap.find(tmp) != RegistersMap.end())
                {
                    RegKind = RegistersMap[tmp];
                }
                else
                {
                    RegKind = (REGS_ENUM)-1;
                }
            }
            if (RegKind != -1)
            {
                //
                // send the request
                //
                SetRegisterValue = "@" + tmp + '=' + Tmp[1] + "; ";
 
                //
                // Send data to the target user debugger or kernel debugger
                //
                ScriptEngineExecuteSingleExpression((CHAR *)SetRegisterValue.c_str(), TRUE, FALSE);
            }
            else
            {
                //
                // error
                //
                ShowMessages("err, invalid register\n");
            }
        }
    }
}

◆ CommandRdmsr()

VOID CommandRdmsr	(	vector< CommandToken >	CommandTokens,
		string	Command )

rdmsr command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                           Status;
    SIZE_T                         NumCPU;
    DEBUGGER_READ_AND_WRITE_ON_MSR MsrReadRequest;
    ULONG                          ReturnedLength;
    UINT64                         Msr;
    BOOL                           IsNextCoreId   = FALSE;
    BOOL                           SetMsr         = FALSE;
    UINT32                         CoreNumer      = DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES;
    BOOLEAN                        IsFirstCommand = TRUE;
 
    if (CommandTokens.size() >= 5)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandRdmsrHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextCoreId)
        {
            if (!ConvertTokenToUInt32(Section, &CoreNumer))
            {
                ShowMessages("please specify a correct hex value for core id\n\n");
                CommandRdmsrHelp();
                return;
            }
            IsNextCoreId = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "core"))
        {
            IsNextCoreId = TRUE;
            continue;
        }
 
        if (SetMsr || !ConvertTokenToUInt64(Section, &Msr))
        {
            ShowMessages("please specify a correct hex value to be read\n\n");
            CommandRdmsrHelp();
            return;
        }
        SetMsr = TRUE;
    }
 
    //
    // Check if msr is set or not
    //
    if (!SetMsr)
    {
        ShowMessages("please specify a correct hex value to be read\n\n");
        CommandRdmsrHelp();
        return;
    }
    if (IsNextCoreId)
    {
        ShowMessages("please specify a correct hex value for core\n\n");
        CommandRdmsrHelp();
        return;
    }
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    MsrReadRequest.ActionType = DEBUGGER_MSR_READ;
    MsrReadRequest.Msr        = Msr;
    MsrReadRequest.CoreNumber = CoreNumer;
 
    //
    // Find logical cores count
    //
    SIZE_T NumCores = GetWindowsNumaNumberOfCores();
    NumCPU          = NumCores > 0 ? NumCores : GetWindowsCompatibleNumberOfCores();
 
    //
    // allocate buffer for transferring messages
    //
    UINT64 * OutputBuffer = (UINT64 *)malloc(sizeof(UINT64) * NumCPU);
 
    ZeroMemory(OutputBuffer, sizeof(UINT64) * NumCPU);
 
    Status = DeviceIoControl(
        g_DeviceHandle,                        // Handle to device
        IOCTL_DEBUGGER_READ_OR_WRITE_MSR,      // IO Control Code (IOCTL)
        &MsrReadRequest,                       // Input Buffer to driver.
        SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR, // Input buffer length
        OutputBuffer,                          // Output Buffer from driver.
        (DWORD)(sizeof(UINT64) * NumCPU),      // Length of output buffer in bytes.
        &ReturnedLength,                       // Bytes placed in buffer.
        NULL                                   // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code (%x), either msr index or core id is invalid\n",
                     GetLastError());
        free(OutputBuffer);
        return;
    }
 
    //
    // btw, %x is enough, no need to %llx
    //
    if (CoreNumer == DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES)
    {
        //
        // Show all cores
        //
        for (SIZE_T i = 0; i < NumCPU; i++)
        {
            ShowMessages("core : 0x%x - msr[%llx] = %s\n", i, Msr, SeparateTo64BitValue((OutputBuffer[i])).c_str());
        }
    }
    else
    {
        //
        // Show for a single-core
        //
        ShowMessages("core : 0x%x - msr[%llx] = %s\n", CoreNumer, Msr, SeparateTo64BitValue((OutputBuffer[0])).c_str());
    }
 
    //
    // Free the buffer
    //
    free(OutputBuffer);
}

◆ CommandReadMemoryAndDisassembler()

VOID CommandReadMemoryAndDisassembler	(	vector< CommandToken >	CommandTokens,
		string	Command )

u* d* !u* !d* commands handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32  Pid             = 0;
    UINT32  Length          = 0;
    UINT64  TargetAddress   = 0;
    BOOLEAN IsNextProcessId = FALSE;
    BOOLEAN IsFirstCommand  = TRUE;
    BOOLEAN IsNextLength    = FALSE;
 
    string FirstCommand = GetCaseSensitiveStringFromCommandToken(CommandTokens.front());
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CommandTokens.size() == 1)
    {
        //
        // Means that user entered one command without any parameter
        //
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandReadMemoryAndDisassemblerHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextProcessId == TRUE)
        {
            if (!ConvertTokenToUInt32(Section, &Pid))
            {
                ShowMessages("err, you should enter a valid process id\n\n");
                return;
            }
            IsNextProcessId = FALSE;
            continue;
        }
 
        if (IsNextLength == TRUE)
        {
            if (!ConvertTokenToUInt32(Section, &Length))
            {
                ShowMessages("err, you should enter a valid length\n\n");
                return;
            }
            IsNextLength = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "l"))
        {
            IsNextLength = TRUE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "pid"))
        {
            IsNextProcessId = TRUE;
            continue;
        }
 
        //
        // Probably it's address
        //
        if (TargetAddress == 0)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &TargetAddress))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                return;
            }
        }
        else
        {
            //
            // User inserts two address
            //
            ShowMessages("err, incorrect use of the '%s' command\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandReadMemoryAndDisassemblerHelp();
 
            return;
        }
    }
 
    if (!TargetAddress)
    {
        //
        // User inserts two address
        //
        ShowMessages("err, please enter a valid address\n\n");
 
        return;
    }
 
    if (Length == 0)
    {
        //
        // Default length (user doesn't specified)
        //
        if (CompareLowerCaseStrings(CommandTokens.at(0), "u") ||
            CompareLowerCaseStrings(CommandTokens.at(0), "!u") ||
            CompareLowerCaseStrings(CommandTokens.at(0), "u64") ||
            CompareLowerCaseStrings(CommandTokens.at(0), "!u64"))
        {
            Length = 0x40;
        }
        else
        {
            Length = 0x80;
        }
    }
 
    if (IsNextLength || IsNextProcessId)
    {
        ShowMessages("incorrect use of the '%s' command\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandReadMemoryAndDisassemblerHelp();
        return;
    }
 
    //
    // Check to prevent using process id in d* and u* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && Pid != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    if (Pid == 0)
    {
        //
        // Default process we read from current process
        //
        Pid = GetCurrentProcessId();
    }
 
    if (CompareLowerCaseStrings(CommandTokens.at(0), "db"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DB,
                                        TargetAddress,
                                        DEBUGGER_READ_VIRTUAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "dc"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DC,
                                        TargetAddress,
                                        DEBUGGER_READ_VIRTUAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "dd"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DD,
                                        TargetAddress,
                                        DEBUGGER_READ_VIRTUAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "dq"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DQ,
                                        TargetAddress,
                                        DEBUGGER_READ_VIRTUAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "!db"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DB,
                                        TargetAddress,
                                        DEBUGGER_READ_PHYSICAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "!dc"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DC,
                                        TargetAddress,
                                        DEBUGGER_READ_PHYSICAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "!dd"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DD,
                                        TargetAddress,
                                        DEBUGGER_READ_PHYSICAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "!dq"))
    {
        HyperDbgShowMemoryOrDisassemble(DEBUGGER_SHOW_COMMAND_DQ,
                                        TargetAddress,
                                        DEBUGGER_READ_PHYSICAL_ADDRESS,
                                        READ_FROM_KERNEL,
                                        Pid,
                                        Length,
                                        NULL);
    }
 
    //
    // Disassembler (!u or u or u2 !u2)
    //
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "u") || CompareLowerCaseStrings(CommandTokens.at(0), "u64"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE64,
            TargetAddress,
            DEBUGGER_READ_VIRTUAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "!u") || CompareLowerCaseStrings(CommandTokens.at(0), "!u64"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE64,
            TargetAddress,
            DEBUGGER_READ_PHYSICAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "u2") || CompareLowerCaseStrings(CommandTokens.at(0), "u32"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE32,
            TargetAddress,
            DEBUGGER_READ_VIRTUAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(0), "!u2") || CompareLowerCaseStrings(CommandTokens.at(0), "!u32"))
    {
        HyperDbgShowMemoryOrDisassemble(
            DEBUGGER_SHOW_COMMAND_DISASSEMBLE32,
            TargetAddress,
            DEBUGGER_READ_PHYSICAL_ADDRESS,
            READ_FROM_KERNEL,
            Pid,
            Length,
            NULL);
    }
}

◆ CommandRestart()

VOID CommandRestart	(	vector< CommandToken >	CommandTokens,
		string	Command )

.restart command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandRestartHelp();
        return;
    }
 
    //
    // Check if the .start command is previously called or not
    //
    if (g_StartCommandPath.empty())
    {
        ShowMessages("nothing to restart, did you use the '.start' command before?\n");
        return;
    }
 
    //
    // Check to kill the current active process (if exists)
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // kill the process, we will restart the process even if we didn't
        // successfully killed the active process
        //
        UdKillProcess(g_ActiveProcessDebuggingState.ProcessId);
    }
    else if (g_ProcessIdOfLatestStartingProcess != NULL)
    {
        UdKillProcess(g_ProcessIdOfLatestStartingProcess);
 
        //
        // No longer the last process exists
        //
        g_ProcessIdOfLatestStartingProcess = NULL;
    }
 
    //
    // Perform run of the target file
    //
    if (g_StartCommandPathAndArguments.empty())
    {
        //
        // TEMPORARY LINUX SHIM (same as in pe.cpp/dump.cpp): the path is a
        // std::wstring of native wchar_t (4 bytes on Linux), but UdAttachToProcess
        // takes a 2-byte HyperDbg WCHAR * (UINT16). The cast is a bogus 2-byte
        // reinterpretation on Linux, acceptable only because the user-debugger
        // path is still stubbed there. On Windows WCHAR == wchar_t, so it is a
        // plain correct pointer. TODO(Linux): convert wchar_t -> 2-byte WCHAR
        // properly once the Linux user-debugger path is real.
        //
        UdAttachToProcess(NULL,
                          (WCHAR *)g_StartCommandPath.c_str(),
                          NULL,
                          FALSE);
    }
    else
    {
        //
        // TEMPORARY LINUX SHIM (same as in pe.cpp/dump.cpp): the path/arguments
        // are std::wstring of native wchar_t (4 bytes on Linux), but
        // UdAttachToProcess takes 2-byte HyperDbg WCHAR * (UINT16). The casts are
        // a bogus 2-byte reinterpretation on Linux, acceptable only because the
        // user-debugger path is still stubbed there. On Windows WCHAR == wchar_t,
        // so they are plain correct pointers. TODO(Linux): convert wchar_t ->
        // 2-byte WCHAR properly once the Linux user-debugger path is real.
        //
        UdAttachToProcess(NULL,
                          (WCHAR *)g_StartCommandPath.c_str(),
                          (WCHAR *)g_StartCommandPathAndArguments.c_str(),
                          FALSE);
    }
}

◆ CommandRev()

VOID CommandRev	(	vector< CommandToken >	CommandTokens,
		string	Command )

!rev command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST RevRequest         = {0};
    BOOLEAN                                      SetPid             = FALSE;
    UINT32                                       TargetPid          = NULL;
    BOOLEAN                                      IgnoreFirstCommand = TRUE;
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE    Mode               = REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN;
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE    Type               = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN;
 
    //
    // Interpret command specific details
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!rev") && IgnoreFirstCommand)
        {
            IgnoreFirstCommand = FALSE;
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "pid") && !SetPid)
        {
            SetPid = TRUE;
        }
        else if (SetPid)
        {
            if (!ConvertTokenToUInt32(Section, &TargetPid))
            {
                //
                // couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandRevHelp();
                return;
            }
            SetPid = FALSE;
        }
        else if (CompareLowerCaseStrings(Section, "pattern"))
        {
            Type = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN;
        }
        else if (CompareLowerCaseStrings(Section, "reconstruct"))
        {
            Type = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT;
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandRevHelp();
            return;
        }
    }
 
    if (SetPid)
    {
        ShowMessages("err, please enter a valid process id in hex format, "
                     "or if you want to use it in decimal format, add '0n' "
                     "prefix to the number\n");
        return;
    }
 
    RevRequest.ProcessId = TargetPid;
 
    // ================================================================================
 
    //
    // Send the request to the hypervisor (kernel)
    //
    RevRequestService(&RevRequest);
}

◆ CommandScript()

VOID CommandScript	(	vector< CommandToken >	CommandTokens,
		string	Command )

.script command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    vector<string> PathAndArgs;
    BOOLEAN        IsFirstCommand = FALSE;
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("please specify a file\n\n");
        CommandScriptHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (!IsFirstCommand)
        {
            IsFirstCommand = TRUE;
            continue;
        }
 
        //
        // Add the path and the arguments
        //
        PathAndArgs.push_back(GetCaseSensitiveStringFromCommandToken(Section));
    }
 
    //
    // Parse the file and the possible arguments
    //
    HyperDbgScriptReadFileAndExecuteCommand(PathAndArgs);
}

◆ CommandSearchMemory()

VOID CommandSearchMemory	(	vector< CommandToken >	CommandTokens,
		string	Command )

!s* s* commands handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64                 Address;
    vector<UINT64>         ValuesToEdit;
    BOOL                   SetAddress          = FALSE;
    BOOL                   SetValue            = FALSE;
    BOOL                   SetProcId           = FALSE;
    BOOL                   NextIsProcId        = FALSE;
    BOOL                   SetLength           = FALSE;
    BOOL                   NextIsLength        = FALSE;
    DEBUGGER_SEARCH_MEMORY SearchMemoryRequest = {0};
    UINT64                 Value               = 0;
    UINT64                 Length              = 0;
    UINT32                 ProcId              = 0;
    UINT32                 CountOfValues       = 0;
    UINT32                 FinalSize           = 0;
    UINT64 *               FinalBuffer         = NULL;
    BOOLEAN                IsFirstCommand      = TRUE;
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ProcId = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CommandTokens.size() <= 4)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandSearchMemoryHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand == TRUE)
        {
            std::string FirstCommand = GetLowerStringFromCommandToken(Section);
 
            if (!FirstCommand.compare("!sb"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_PHYSICAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_BYTE;
            }
            else if (!FirstCommand.compare("!sd"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_PHYSICAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_DWORD;
            }
            else if (!FirstCommand.compare("!sq"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_PHYSICAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_QWORD;
            }
            else if (!FirstCommand.compare("sb"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_VIRTUAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_BYTE;
            }
            else if (!FirstCommand.compare("sd"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_VIRTUAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_DWORD;
            }
            else if (!FirstCommand.compare("sq"))
            {
                SearchMemoryRequest.MemoryType = SEARCH_VIRTUAL_MEMORY;
                SearchMemoryRequest.ByteSize   = SEARCH_QWORD;
            }
            else
            {
                //
                // What's this? :(
                //
                ShowMessages("unknown error happened!\n\n");
                CommandSearchMemoryHelp();
                return;
            }
 
            IsFirstCommand = FALSE;
 
            continue;
        }
 
        if (NextIsProcId)
        {
            //
            // It's a process id
            //
            NextIsProcId = FALSE;
 
            if (!ConvertTokenToUInt32(Section, &ProcId))
            {
                ShowMessages("please specify a correct hex process id\n\n");
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the proc id is set, next we should read value
                //
                continue;
            }
        }
 
        if (NextIsLength)
        {
            //
            // It's a length
            //
            NextIsLength = FALSE;
 
            if (!ConvertTokenToUInt64(Section, &Length))
            {
                ShowMessages("please specify a correct hex length\n\n");
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the proc id is set, next we should read value
                //
                SetLength = TRUE;
                continue;
            }
        }
 
        //
        // Check if it's a process id or not
        //
        if (!SetProcId && CompareLowerCaseStrings(Section, "pid"))
        {
            NextIsProcId = TRUE;
            continue;
        }
 
        //
        // Check if it's a length or not
        //
        if (!SetLength && CompareLowerCaseStrings(Section, "l"))
        {
            NextIsLength = TRUE;
            continue;
        }
 
        if (!SetAddress)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &Address))
            {
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Means that the address is set, next we should read value
                //
                SetAddress = TRUE;
                continue;
            }
        }
 
        if (SetAddress)
        {
            //
            // Remove the hex notations
            //
            std::string TargetVal = GetCaseSensitiveStringFromCommandToken(Section);
 
            if (TargetVal.rfind("0x", 0) == 0 || TargetVal.rfind("0X", 0) == 0 ||
                TargetVal.rfind("\\x", 0) == 0 || TargetVal.rfind("\\X", 0) == 0)
            {
                TargetVal = TargetVal.erase(0, 2);
            }
            else if (TargetVal.rfind('x', 0) == 0 || TargetVal.rfind('X', 0) == 0)
            {
                TargetVal = TargetVal.erase(0, 1);
            }
 
            TargetVal.erase(remove(TargetVal.begin(), TargetVal.end(), '`'), TargetVal.end());
 
            //
            // Check if the value is valid based on byte counts
            //
            if (SearchMemoryRequest.ByteSize == SEARCH_BYTE && TargetVal.size() >= 3)
            {
                ShowMessages("please specify a byte (hex) value for 'sb' or '!sb'\n\n");
                return;
            }
 
            if (SearchMemoryRequest.ByteSize == SEARCH_DWORD && TargetVal.size() >= 9)
            {
                ShowMessages("please specify a dword (hex) value for 'sd' or '!sd'\n\n");
                return;
            }
 
            if (SearchMemoryRequest.ByteSize == SEARCH_QWORD && TargetVal.size() >= 17)
            {
                ShowMessages("please specify a qword (hex) value for 'sq' or '!sq'\n\n");
                return;
            }
 
            //
            // Qword is checked by the following function, no need to double
            // check it above.
            //
            if (!ConvertStringToUInt64(TargetVal, &Value))
            {
                ShowMessages("please specify a correct hex value to search in the "
                             "memory content\n\n");
                CommandSearchMemoryHelp();
                return;
            }
            else
            {
                //
                // Add it to the list
                //
                ValuesToEdit.push_back(Value);
 
                //
                // Keep track of values to modify
                //
                CountOfValues++;
 
                if (!SetValue)
                {
                    //
                    // At least one value is there
                    //
                    SetValue = TRUE;
                }
                continue;
            }
        }
    }
 
    //
    // Check to prevent using process id in s* commands
    //
    if (g_IsSerialConnectedToRemoteDebuggee && ProcId != 0)
    {
        ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
        return;
    }
 
    if (ProcId == 0)
    {
        ProcId = GetCurrentProcessId();
    }
 
    //
    // Fill the structure
    //
    SearchMemoryRequest.ProcessId       = ProcId;
    SearchMemoryRequest.Address         = Address;
    SearchMemoryRequest.CountOf64Chunks = CountOfValues;
 
    //
    // Check if address and value are set or not
    //
    if (!SetAddress)
    {
        ShowMessages("please specify a correct hex address\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (!SetValue)
    {
        ShowMessages(
            "please specify a correct hex value as the content to search\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (!SetLength)
    {
        ShowMessages("please specify a correct hex value as the length\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (NextIsProcId)
    {
        ShowMessages("please specify a correct hex value as the process id\n\n");
        CommandSearchMemoryHelp();
        return;
    }
    if (NextIsLength)
    {
        ShowMessages("please specify a correct hex length\n\n");
        CommandSearchMemoryHelp();
        return;
    }
 
    //
    // Now it's time to put everything together in one structure
    //
    FinalSize = (CountOfValues * sizeof(UINT64)) + SIZEOF_DEBUGGER_SEARCH_MEMORY;
 
    //
    // Set the size
    //
    SearchMemoryRequest.FinalStructureSize = FinalSize;
 
    //
    // Set the length
    //
    SearchMemoryRequest.Length = Length;
 
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
    }
 
    //
    // Allocate structure + buffer
    //
    FinalBuffer = (UINT64 *)malloc(FinalSize);
 
    if (!FinalBuffer)
    {
        ShowMessages("unable to allocate memory\n\n");
        return;
    }
 
    //
    // Zero the buffer
    //
    ZeroMemory(FinalBuffer, FinalSize);
 
    //
    // Copy the structure on top of the allocated buffer
    //
    memcpy(FinalBuffer, &SearchMemoryRequest, SIZEOF_DEBUGGER_SEARCH_MEMORY);
 
    //
    // Put the values in 64 bit structures
    //
    std::copy(ValuesToEdit.begin(), ValuesToEdit.end(), (UINT64 *)((UINT64)FinalBuffer + SIZEOF_DEBUGGER_SEARCH_MEMORY));
 
    //
    // Check if it's a connection in debugger mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // The buffer should be sent to the debugger
        //
        KdSendSearchRequestPacketToDebuggee(FinalBuffer, FinalSize);
    }
    else
    {
        //
        // it's a local connection, send the buffer directly
        //
        CommandSearchSendRequest(FinalBuffer, FinalSize);
    }
 
    //
    // Free the buffers
    //
    free(FinalBuffer);
}

◆ CommandSettings()

VOID CommandSettings	(	vector< CommandToken >	CommandTokens,
		string	Command )

settings command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() <= 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandSettingsHelp();
        return;
    }
 
    //
    // Interpret the field name
    //
    if (CompareLowerCaseStrings(CommandTokens.at(1), "autounpause"))
    {
        //
        // Handle it locally
        //
        CommandSettingsAutoUpause(CommandTokens);
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "syntax"))
    {
        //
        // If it's a remote debugger then we send it to the remote debugger
        //
        if (g_IsConnectedToRemoteDebuggee)
        {
            RemoteConnectionSendCommand(Command.c_str(), (UINT32)Command.length() + 1);
        }
        else
        {
            //
            // If it's a connection over serial or a local debugging then
            // we handle it locally
            //
            CommandSettingsSyntax(CommandTokens);
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "autoflush"))
    {
        //
        // If it's a remote debugger then we send it to the remote debugger
        //
        if (g_IsConnectedToRemoteDebuggee)
        {
            RemoteConnectionSendCommand(Command.c_str(), (UINT32)Command.length() + 1);
        }
        else
        {
            //
            // If it's a connection over serial or a local debugging then
            // we handle it locally
            //
            CommandSettingsAutoFlush(CommandTokens);
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "addressconversion"))
    {
        //
        // If it's a remote debugger then we send it to the remote debugger
        //
        if (g_IsConnectedToRemoteDebuggee)
        {
            RemoteConnectionSendCommand(Command.c_str(), (UINT32)Command.length() + 1);
        }
        else
        {
            //
            // If it's a connection over serial or a local debugging then
            // we handle it locally
            //
            CommandSettingsAddressConversion(CommandTokens);
        }
    }
    else
    {
        //
        // option not found
        //
        ShowMessages("incorrect use of the '%s', please use 'help %s' for more information\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str(),
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        return;
    }
}

◆ CommandSettingsGetValueFromConfigFile()

BOOLEAN CommandSettingsGetValueFromConfigFile	(	std::string	OptionName,
		std::string &	OptionValue )

Gets the setting values from config file.

Parameters

OptionName
OptionValue

Returns: BOOLEAN Shows if the settings is available or not

{
    inipp::Ini<char> Ini;
    WCHAR            ConfigPath[MAX_PATH] = {0};
    std::string      OptionValueFromFile;
 
    //
    // Get config file path
    //
    GetConfigFilePath(ConfigPath);
 
    if (!IsFileExistW(ConfigPath))
    {
        return FALSE;
    }
 
    //
    // Open the file
    //
    ifstream Is(ConfigPath);
 
    //
    // Read config file
    //
    Ini.parse(Is);
 
    //
    // Show config file
    //
    // Ini.generate(std::cout);
 
    inipp::get_value(Ini.sections["DEFAULT"], OptionName, OptionValueFromFile);
 
    Is.close();
 
    if (!OptionValueFromFile.empty())
    {
        OptionValue = OptionValueFromFile;
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

◆ CommandSettingsLoadDefaultValuesFromConfigFile()

VOID CommandSettingsLoadDefaultValuesFromConfigFile ( )

Loads default settings values from config file.

Returns: VOID

{
    string OptionValue;
 
    //
    // *** Set default configurations ***
    //
 
    //
    // Set the assembly syntax
    //
    if (CommandSettingsGetValueFromConfigFile("AsmSyntax", OptionValue))
    {
        //
        // The user tries to set a value as the syntax
        //
        if (!OptionValue.compare("intel"))
        {
            g_DisassemblerSyntax = 1;
        }
        else if (!OptionValue.compare("att") ||
                 !OptionValue.compare("at&t"))
        {
            g_DisassemblerSyntax = 2;
        }
        else if (!OptionValue.compare("masm"))
        {
            g_DisassemblerSyntax = 3;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect assembly syntax settings\n");
        }
    }
 
    //
    // Set the auto unpause
    //
    if (CommandSettingsGetValueFromConfigFile("AutoUnpause", OptionValue))
    {
        if (!OptionValue.compare("on"))
        {
            g_AutoUnpause = TRUE;
        }
        else if (!OptionValue.compare("off"))
        {
            g_AutoUnpause = FALSE;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect auto unpause settings\n");
        }
    }
 
    //
    // Set the auto flush
    //
    if (CommandSettingsGetValueFromConfigFile("AutoFlush", OptionValue))
    {
        if (!OptionValue.compare("on"))
        {
            g_AutoFlush = TRUE;
        }
        else if (!OptionValue.compare("off"))
        {
            g_AutoFlush = FALSE;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect auto flush settings\n");
        }
    }
 
    //
    // Set the address conversion
    //
    if (CommandSettingsGetValueFromConfigFile("AddrConv", OptionValue))
    {
        if (!OptionValue.compare("on"))
        {
            g_AddressConversion = TRUE;
        }
        else if (!OptionValue.compare("off"))
        {
            g_AddressConversion = FALSE;
        }
        else
        {
            //
            // Sth is incorrect
            //
            ShowMessages("err, incorrect address conversion settings\n");
        }
    }
}

◆ CommandSettingsSetValueFromConfigFile()

VOID CommandSettingsSetValueFromConfigFile	(	std::string	OptionName,
		std::string	OptionValue )

Sets the setting values from config file.

Parameters

OptionName
OptionValue

Returns: VOID

{
    inipp::Ini<char> Ini;
    WCHAR            ConfigPath[MAX_PATH] = {0};
 
    //
    // Get config file path
    //
    GetConfigFilePath(ConfigPath);
 
    ifstream Is(ConfigPath);
 
    //
    // Read config file
    //
    Ini.parse(Is);
 
    Is.close();
 
    //
    // Save the config
    //
    Ini.sections["DEFAULT"][OptionName] = OptionValue.c_str();
    Ini.interpolate();
 
    //
    // Test, show the config
    //
    // Ini.generate(std::cout);
 
    //
    // Save the config
    //
    ofstream Os(ConfigPath);
 
    Ini.generate(Os);
 
    Os.close();
}

◆ CommandSleep()

VOID CommandSleep	(	vector< CommandToken >	CommandTokens,
		string	Command )

sleep command help

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32 MillisecondsTime = 0;
 
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandSleepHelp();
        return;
    }
 
    if (!ConvertTokenToUInt32(CommandTokens.at(1), &MillisecondsTime))
    {
        ShowMessages(
            "please specify a correct hex value for time (milliseconds)\n\n");
        CommandSleepHelp();
        return;
    }
    Sleep(MillisecondsTime);
}

◆ CommandSmi()

VOID CommandSmi	(	vector< CommandToken >	CommandTokens,
		string	Command )

!smi command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    SMI_OPERATION_PACKETS SmiOperationRequest = {0};
 
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandSmiHelp();
        return;
    }
 
    if (CompareLowerCaseStrings(CommandTokens.at(1), "count"))
    {
        SmiOperationRequest.SmiOperationType = SMI_OPERATION_REQUEST_TYPE_READ_COUNT;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "trigger"))
    {
        SmiOperationRequest.SmiOperationType = SMI_OPERATION_REQUEST_TYPE_TRIGGER_POWER_SMI;
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandSmiHelp();
        return;
    }
 
    //
    // Send the SMI operation request
    //
    if (CommandSmiSendRequest(&SmiOperationRequest))
    {
        if (SmiOperationRequest.SmiOperationType == SMI_OPERATION_REQUEST_TYPE_READ_COUNT)
        {
            if (SmiOperationRequest.SmiCount == 0)
            {
                ShowMessages("SMI count: 0 (for security reasons, nested-virtualization environment (VMs) are unable to communicate with UEFI firmware)\n");
            }
            else
            {
                ShowMessages("SMI count: 0x%x\n", SmiOperationRequest.SmiCount);
            }
        }
        else if (SmiOperationRequest.SmiOperationType == SMI_OPERATION_REQUEST_TYPE_TRIGGER_POWER_SMI)
        {
            ShowMessages("power SMI triggered successfully (you can use '!smi count' to view the number of executed SMIs)\n");
        }
    }
    else
    {
        ShowErrorMessage(SmiOperationRequest.KernelStatus);
        return;
    }
}

◆ CommandStart()

VOID CommandStart	(	vector< CommandToken >	CommandTokens,
		string	Command )

.start command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    vector<string> PathAndArgs;
    string         Arguments      = "";
    BOOLEAN        IsFirstCommand = FALSE;
    BOOLEAN        PathIgnored    = FALSE;
    BOOLEAN        IsNextPath     = FALSE;
 
    if (CommandTokens.size() <= 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandStartHelp();
        return;
    }
 
//
// Disable user-mode debugger in this version
//
#if ActivateUserModeDebugger == FALSE
 
    if (!g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("the user-mode debugger in VMI Mode is still in the beta version and not stable. "
                     "we decided to exclude it from this release and release it in future versions. "
                     "if you want to test the user-mode debugger in VMI Mode, you should build "
                     "HyperDbg with special instructions. But starting processes is fully supported "
                     "in the Debugger Mode.\n"
                     "(it's not recommended to use it in VMI Mode yet!)\n");
        return;
    }
 
#endif // !ActivateUserModeDebugger
 
    //
    // Check if the first token is 'path'
    //
    if (!CompareLowerCaseStrings(CommandTokens.at(1), "path"))
    {
        ShowMessages("err, couldn't resolve error at '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        CommandStartHelp();
        return;
    }
 
    //
    // *** It's a run of target PE file ***
    //
 
    for (auto Section : CommandTokens)
    {
        //
        // Skip first two parameters
        //
        if (!IsFirstCommand)
        {
            IsFirstCommand = TRUE;
            continue;
        }
 
        //
        // Skip the path
        //
        if (!PathIgnored)
        {
            PathIgnored = TRUE;
            IsNextPath  = TRUE;
            continue;
        }
 
        //
        // Check if the next token is the actual path
        //
        if (IsNextPath)
        {
            IsNextPath = FALSE;
 
            //
            // Convert path to wstring
            //
            StringToWString(g_StartCommandPath, GetCaseSensitiveStringFromCommandToken(Section));
 
            continue;
        }
 
        //
        // Append the arguments and check if arguments contain spaces then add quotes
        //
        if (GetCaseSensitiveStringFromCommandToken(Section).find(' ') != std::string::npos)
        {
            Arguments += "\"" + GetCaseSensitiveStringFromCommandToken(Section) + "\" ";
        }
        else
        {
            Arguments += GetCaseSensitiveStringFromCommandToken(Section) + " ";
        }
    }
 
    //
    // Perform run of the target file
    //
    if (Arguments.empty())
    {
        //
        // TEMPORARY LINUX SHIM (same as in pe.cpp/dump.cpp): the path is a
        // std::wstring of native wchar_t (4 bytes on Linux), but UdAttachToProcess
        // takes a 2-byte HyperDbg WCHAR * (UINT16). The cast is a bogus 2-byte
        // reinterpretation on Linux, acceptable only because the user-debugger
        // path is still stubbed there. On Windows WCHAR == wchar_t, so it is a
        // plain correct pointer. TODO(Linux): convert wchar_t -> 2-byte WCHAR
        // properly once the Linux user-debugger path is real.
        //
        UdAttachToProcess(NULL,
                          (WCHAR *)g_StartCommandPath.c_str(),
                          NULL,
                          FALSE);
    }
    else
    {
        //
        // Remove the last space
        //
        Arguments.pop_back();
 
        //
        // Convert arguments to wstring if it's not empty
        //
        StringToWString(g_StartCommandPathAndArguments, Arguments);
 
        //
        // TEMPORARY LINUX SHIM (same as in pe.cpp/dump.cpp): the path/arguments
        // are std::wstring of native wchar_t (4 bytes on Linux), but
        // UdAttachToProcess takes 2-byte HyperDbg WCHAR * (UINT16). The casts are
        // a bogus 2-byte reinterpretation on Linux, acceptable only because the
        // user-debugger path is still stubbed there. On Windows WCHAR == wchar_t,
        // so they are plain correct pointers. TODO(Linux): convert wchar_t ->
        // 2-byte WCHAR properly once the Linux user-debugger path is real.
        //
        UdAttachToProcess(NULL,
                          (WCHAR *)g_StartCommandPath.c_str(),
                          (WCHAR *)g_StartCommandPathAndArguments.c_str(),
                          FALSE);
    }
}

◆ CommandStatus()

VOID CommandStatus	(	vector< CommandToken >	CommandTokens,
		string	Command )

.status and status command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandStatusHelp();
    }
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Connected to a remote debugger (serial port)
        //
        ShowMessages("remote debugging - debugger ('debugger mode')\n");
    }
    else if (g_IsSerialConnectedToRemoteDebugger)
    {
        //
        // Connected to a remote debuggee (serial port)
        //
        ShowMessages("remote debugging - debuggee ('debugger mode')\n");
    }
    else if (g_IsConnectedToRemoteDebuggee)
    {
        //
        // Connected to a remote debuggee
        //
        ShowMessages("remote debugging ('vmi mode'), ip : %s:%s \n",
                     g_ServerIp.c_str(),
                     g_ServerPort.c_str());
    }
    else if (g_IsConnectedToHyperDbgLocally)
    {
        //
        // Connected to a local system
        //
        ShowMessages("local debugging ('vmi mode')\n");
    }
    else if (g_IsConnectedToRemoteDebugger)
    {
        //
        // It's computer connect to a remote machine (this
        // message shouldn't be showed)
        //
        ShowMessages("a remote debugger connected to this system in ('vmi "
                     "mode'), ip : %s:%s \n",
                     g_ServerIp.c_str(),
                     g_ServerPort.c_str());
    }
    else
    {
        //
        // we never should see this message
        //
        ShowMessages("err, you're not connected to any instance of HyperDbg\n");
    }
}

◆ CommandSwitch()

VOID CommandSwitch	(	vector< CommandToken >	CommandTokens,
		string	Command )

.switch command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32 PidOrTid = NULL;
 
    if (CommandTokens.size() > 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandSwitchHelp();
        return;
    }
 
    //
    // Perform switching or listing the threads
    //
    if (CommandTokens.size() == 1 || (CommandTokens.size() == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "list")))
    {
        UdShowListActiveDebuggingProcessesAndThreads();
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "pid"))
    {
        if (!ConvertTokenToUInt32(CommandTokens.at(2), &PidOrTid))
        {
            ShowMessages("please specify a correct hex value for process id\n\n");
            return;
        }
 
        //
        // Switch by pid
        //
        if (UdSetActiveDebuggingThreadByPidOrTid(PidOrTid, FALSE))
        {
            ShowMessages("switched to process id: %x\n", PidOrTid);
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "tid"))
    {
        if (!ConvertTokenToUInt32(CommandTokens.at(2), &PidOrTid))
        {
            ShowMessages("please specify a correct hex value for thread id\n\n");
            return;
        }
 
        //
        // Switch by tid
        //
        if (UdSetActiveDebuggingThreadByPidOrTid(PidOrTid, TRUE))
        {
            ShowMessages("switched to thread id: %x\n", PidOrTid);
        }
    }
    else
    {
        ShowMessages("err, couldn't resolve error at '%s'\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        return;
    }
}

◆ CommandSym()

VOID CommandSym	(	vector< CommandToken >	CommandTokens,
		string	Command )

.sym command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64 BaseAddress   = NULL;
    UINT32 UserProcessId = NULL;
    string PathToPdb;
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandSymHelp();
        return;
    }
 
    if (CompareLowerCaseStrings(CommandTokens.at(1), "table"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // Show symbol table
        //
        SymbolBuildAndShowSymbolTable();
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "load") || CompareLowerCaseStrings(CommandTokens.at(1), "download"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // Load and download available symbols
        //
        if (CompareLowerCaseStrings(CommandTokens.at(1), "load"))
        {
            SymbolLoadOrDownloadSymbols(FALSE, FALSE);
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(1), "download"))
        {
            SymbolLoadOrDownloadSymbols(TRUE, FALSE);
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "reload"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2 && CommandTokens.size() != 4)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // Check for process id
        //
        if (CommandTokens.size() == 4)
        {
            if (CompareLowerCaseStrings(CommandTokens.at(2), "pid"))
            {
                if (!ConvertTokenToUInt32(CommandTokens.at(3), &UserProcessId))
                {
                    //
                    // couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)).c_str());
                    CommandSymHelp();
                    return;
                }
            }
            else
            {
                ShowMessages("incorrect use of the '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
                CommandSymHelp();
                return;
            }
        }
 
        //
        // Refresh and reload symbols
        //
        if (g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Update symbol table from remote debuggee in debugger-mode
            //
            SymbolReloadSymbolTableInDebuggerMode(UserProcessId);
        }
        else
        {
            //
            // Check if user explicitly specified the process id
            //
            if (UserProcessId == NULL)
            {
                //
                // User didn't explicitly specified the process id, so
                // if it's a user-debugger process, we use the modules
                // of the target user-debuggee's process, otherwise,
                // the current process (HyperDbg's process) is specified
                //
                if (g_ActiveProcessDebuggingState.IsActive)
                {
                    UserProcessId = g_ActiveProcessDebuggingState.ProcessId;
                }
                else
                {
                    UserProcessId = GetCurrentProcessId();
                }
            }
 
            //
            // Build locally and reload it
            //
            if (SymbolLocalReload(UserProcessId))
            {
                ShowMessages("symbol table updated successfully\n");
            }
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "unload"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // unload without any parameters, means that unload
        // all the symbols
        //
        ScriptEngineUnloadAllSymbolsWrapper();
 
        //
        // Size is 3 there is module name (not working ! I don't know why)
        //
        // ScriptEngineUnloadModuleSymbolWrapper((char *)SplitCommand.at(2).c_str());
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "add"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() < 6)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        if (CompareLowerCaseStrings(CommandTokens.at(2), "base"))
        {
            if (!ConvertTokenToUInt64(CommandTokens.at(3), &BaseAddress))
            {
                ShowMessages("please add a valid hex address to be used as the base address\n\n");
                CommandSymHelp();
                return;
            }
 
            //
            // Base address is now valid, check if next parameter is path
            //
            if (!CompareLowerCaseStrings(CommandTokens.at(4), "path"))
            {
                ShowMessages("incorrect use of the '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
                CommandSymHelp();
                return;
            }
 
            //
            // The rest of command is pdb path
            //
            PathToPdb = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(5));
 
            //
            // Check if pdb file exists or not
            //
            if (!IsFileExistA(PathToPdb.c_str()))
            {
                ShowMessages("pdb file not found\n");
                return;
            }
 
            ShowMessages("loading module symbol at '%s'\n", PathToPdb.c_str());
 
            //
            // Load the pdb file (the validation of pdb file is checked into pdb
            // parsing functions)
            //
            ScriptEngineLoadFileSymbolWrapper(BaseAddress, PathToPdb.c_str(), NULL);
        }
        else
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
    }
    else
    {
        ShowMessages("unknown parameter at '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        CommandSymHelp();
        return;
    }
}

◆ CommandSympath()

VOID CommandSympath	(	vector< CommandToken >	CommandTokens,
		string	Command )

.sympath command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    string SymbolServer = "";
    string Token;
 
    if (CommandTokens.size() == 1)
    {
        //
        // Show the current symbol path
        //
        if (!CommandSettingsGetValueFromConfigFile("SymbolServer", SymbolServer))
        {
            ShowMessages("symbol server is not configured, please use '.help .sympath'\n");
        }
        else
        {
            ShowMessages("current symbol server is : %s\n", SymbolServer.c_str());
        }
    }
    else
    {
        //
        // Save the symbol path
        //
 
        //
        // Because technically, the "https://" is containing characters that resemble the command token,
        // it's better to use the symbol server in quotes, but due to the fact that for compatibility reasons,
        // with the previous versions, we should support the old syntax, we should check if the symbol server
        // is in quotes or not to support both syntaxes
        //
 
        //
        // Trim the command
        //
        Trim(Command);
 
        //
        // Remove .sympath from it
        //
        Command.erase(0, GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).size());
 
        //
        // Trim it again
        //
        Trim(Command);
 
        //
        // Check if the symbol server starts with quotes
        //
        if (Command.at(0) == '\"')
        {
            //
            // Means that the symbol server is in quotes
            //
            Command = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1));
        }
 
        //
        // *** validate the symbols ***
        //
 
        //
        // Check if the string contains '*'
        //
        CHAR Delimiter = '*';
        if (Command.find(Delimiter) != std::string::npos)
        {
            //
            // Found
            //
            Token = Command.substr(0, Command.find(Delimiter));
            // using transform() function and ::tolower in STL
            transform(Token.begin(), Token.end(), Token.begin(), ::tolower);
 
            //
            // Check if it starts with srv
            //
            if (!Token.compare("srv"))
            {
                //
                // Save the config
                //
                CommandSettingsSetValueFromConfigFile("SymbolServer", Command);
 
                //
                // Show the message
                //
                ShowMessages("symbol server/path is configured successfully\n");
                ShowMessages("use '.sym load', '.sym reload', or '.sym download' to load pdb files\n");
            }
            else
            {
                ShowMessages("symbol path is invalid\n\n");
                CommandSympathHelp();
                return;
            }
        }
        else
        {
            ShowMessages("symbol path is invalid\n\n");
            CommandSympathHelp();
            return;
        }
    }
}

◆ CommandSyscallAndSysret()

VOID CommandSyscallAndSysret	(	vector< CommandToken >	CommandTokens,
		string	Command )

!syscall, !syscall2 and !sysret, !sysret2 commands handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    UINT64                             SpecialTarget               = DEBUGGER_EVENT_SYSCALL_ALL_SYSRET_OR_SYSCALLS;
    BOOLEAN                            GetSyscallNumber            = FALSE;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
    string                             Cmd;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    Cmd = GetLowerStringFromCommandToken(CommandTokens.at(0));
 
    if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
    {
        if (!InterpretGeneralEventAndActionsFields(
                &CommandTokens,
                SYSCALL_HOOK_EFER_SYSCALL,
                &Event,
                &EventLength,
                &ActionBreakToDebugger,
                &ActionBreakToDebuggerLength,
                &ActionCustomCode,
                &ActionCustomCodeLength,
                &ActionScript,
                &ActionScriptLength,
                &EventParsingErrorCause))
        {
            return;
        }
    }
    else
    {
        if (!InterpretGeneralEventAndActionsFields(
                &CommandTokens,
                SYSCALL_HOOK_EFER_SYSRET,
                &Event,
                &EventLength,
                &ActionBreakToDebugger,
                &ActionBreakToDebuggerLength,
                &ActionCustomCode,
                &ActionCustomCodeLength,
                &ActionScript,
                &ActionScriptLength,
                &EventParsingErrorCause))
        {
            return;
        }
    }
 
    //
    // Interpret command specific details (if any)
    //
 
    //
    // Currently we do not support any extra argument for !sysret command
    // it is because we don't know how to find syscall number in sysret
    // and we don't wanna deal with dynamic mapping of rcx (user stack)
    // in vmx-root
    //
    if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
    {
        for (auto Section : CommandTokens)
        {
            if (CompareLowerCaseStrings(Section, "!syscall") ||
                CompareLowerCaseStrings(Section, "!syscall2") ||
                CompareLowerCaseStrings(Section, "!sysret") ||
                CompareLowerCaseStrings(Section, "!sysret2"))
            {
                continue;
            }
 
            else if (!GetSyscallNumber)
            {
                //
                // It's probably a syscall address
                //
                if (!SymbolConvertNameOrExprToAddress(
                        GetCaseSensitiveStringFromCommandToken(Section),
                        &SpecialTarget))
                {
                    //
                    // Unknown parameter
                    //
                    ShowMessages("unknown parameter '%s'\n\n",
                                 GetCaseSensitiveStringFromCommandToken(Section).c_str());
 
                    if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
                    {
                        CommandSyscallHelp();
                    }
                    else
                    {
                        CommandSysretHelp();
                    }
 
                    FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                    return;
                }
                else
                {
                    GetSyscallNumber = TRUE;
                }
            }
            else
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
 
                if (!Cmd.compare("!syscall") || !Cmd.compare("!syscall2"))
                {
                    CommandSyscallHelp();
                }
                else
                {
                    CommandSysretHelp();
                }
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
        }
 
        //
        // Set the target syscall
        //
        Event->Options.OptionalParam1 = SpecialTarget;
    }
 
    //
    // Set whether it's !syscall or !syscall2 or !sysret or !sysret2
    //
    if (!Cmd.compare("!syscall2") || !Cmd.compare("!sysret2"))
    {
        //
        // It's a !syscall2 or !sysret2
        //
        Event->Options.OptionalParam2 = DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD;
    }
    else
    {
        //
        // It's a !syscall or !sysret
        //
        Event->Options.OptionalParam2 = DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandT()

VOID CommandT	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of t command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32 StepCount;
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() != 1 && CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandTHelp();
        return;
    }
 
    //
    // Check if the command has a counter parameter
    //
    if (CommandTokens.size() == 2)
    {
        if (!ConvertTokenToUInt32(CommandTokens.at(1), &StepCount))
        {
            ShowMessages("please specify a correct hex value for [count]\n\n");
            CommandTHelp();
            return;
        }
    }
    else
    {
        StepCount = 1;
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Check if the thread is paused or not
        //
        if (g_ActiveProcessDebuggingState.IsActive && !g_ActiveProcessDebuggingState.IsPaused)
        {
            ShowMessages("the target process is running, use the "
                         "'pause' command to pause the process\n");
            return;
        }
 
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (SIZE_T i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            //
            // Instrument (regular) the instruction
            //
            SteppingRegularStepIn();
 
            if (CompareLowerCaseStrings(CommandTokens.at(0), "tr"))
            {
                //
                // Show registers
                //
                HyperDbgRegisterShowAll();
 
                if (i != StepCount - 1)
                {
                    ShowMessages("\n");
                }
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, stepping (t) is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandTest()

VOID CommandTest	(	vector< CommandToken >	CommandTokens,
		string	Command )

test command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT64 Context = NULL;
 
    UINT32 CommandSize = (UINT32)CommandTokens.size();
 
    if (CommandSize == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandTestHelp();
    }
    else if (CommandSize == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "query"))
    {
        //
        // Query the state of debuggee in debugger mode
        //
        CommandTestQueryState();
    }
    else if (CommandSize == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "trap-status"))
    {
        //
        // Query the state of trap flag in debugger mode
        //
        CommandTestQueryTrapState();
    }
    else if (CommandSize == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "pool"))
    {
        //
        // Query the state of pre-allocated pools in debugger mode
        //
        CommandTestQueryPreAllocPoolsState();
    }
    else if (CommandSize == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "sync-task"))
    {
        //
        // Send target task to the halted cores in debugger mode (synchronous)
        //
        CommandTestSetTargetTaskToHaltedCores(TRUE);
    }
    else if (CommandSize == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "async-task"))
    {
        //
        // Send target task to the halted cores in debugger mode (asynchronous)
        //
        CommandTestSetTargetTaskToHaltedCores(FALSE);
    }
    else if (CommandSize == 3 && CompareLowerCaseStrings(CommandTokens.at(1), "target-core-task"))
    {
        if (!ConvertTokenToUInt64(CommandTokens.at(2), &Context))
        {
            ShowMessages("err, you should enter a valid hex number as the core id\n\n");
            return;
        }
 
        //
        // Send target task to the specific halted core in debugger mode
        //
        CommandTestSetTargetTaskToTargetCore((UINT32)Context);
    }
    else if (CommandSize == 3 && CompareLowerCaseStrings(CommandTokens.at(1), "breakpoint"))
    {
        //
        // Change breakpoint state
        //
        if (CompareLowerCaseStrings(CommandTokens.at(2), "on"))
        {
            CommandTestSetBreakpointState(TRUE);
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(2), "off"))
        {
            CommandTestSetBreakpointState(FALSE);
        }
        else
        {
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
            return;
        }
    }
    else if (CommandSize == 3 && CompareLowerCaseStrings(CommandTokens.at(1), "trap"))
    {
        //
        // Change debug break state
        //
        if (CompareLowerCaseStrings(CommandTokens.at(2), "on"))
        {
            CommandTestSetDebugBreakState(TRUE);
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(2), "off"))
        {
            CommandTestSetDebugBreakState(FALSE);
        }
        else
        {
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
            return;
        }
    }
    else if (CommandSize == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "all"))
    {
        //
        // For testing functionalities
        //
        CommandTestAllFunctionalities();
    }
    else if (CommandSize == 2 && CompareLowerCaseStrings(CommandTokens.at(1), "hwdbg"))
    {
        //
        // For testing functionalities of hwdbg
        //
        CommandTestAllHwdbg();
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandTestHelp();
        return;
    }
}

◆ CommandThread()

VOID CommandThread	(	vector< CommandToken >	CommandTokens,
		string	Command )

.thread command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32  TargetThreadId = 0;
    UINT64  TargetThread   = 0;
    UINT64  TargetProcess  = 0;
    BOOLEAN CheckByClkIntr = FALSE;
 
    if (CommandTokens.size() >= 5)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandThreadHelp();
        return;
    }
 
    if (CommandTokens.size() == 1)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            ObjectShowProcessesOrThreadDetails(FALSE);
        }
        else
        {
            //
            // Send the packet to get current thread
            //
            KdSendSwitchThreadPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS,
                                               NULL,
                                               NULL,
                                               FALSE,
                                               NULL);
        }
    }
    else if (CommandTokens.size() == 2)
    {
        if (CompareLowerCaseStrings(CommandTokens.at(1), "list"))
        {
            //
            // Sending null as the nt!_EPROCESS indicates that the target process is
            // the current process (Current nt!_EPROCESS)
            //
            if (!CommandThreadListThreads(NULL))
            {
                ShowMessages("err, the need offset to iterate over threads not found, "
                             "make sure to load ntoskrnl.exe's PDB file. use '.help .sym' for "
                             "more information\n");
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
            CommandThreadHelp();
            return;
        }
    }
    else if (CommandTokens.size() == 3)
    {
        //
        // Check if it's connected to a remote debuggee or not
        //
        if (!g_IsSerialConnectedToRemoteDebuggee)
        {
            ShowMessages("err, you're not connected to any debuggee in Debugger Mode, "
                         "you can use the '.attach', or the '.detach' commands if you're "
                         "operating in VMI Mode\n");
            return;
        }
 
        if (CompareLowerCaseStrings(CommandTokens.at(1), "tid"))
        {
            if (!ConvertTokenToUInt32(CommandTokens.at(2), &TargetThreadId))
            {
                ShowMessages(
                    "please specify a correct hex value for the thread id that you "
                    "want to operate on it\n\n");
                CommandThreadHelp();
                return;
            }
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(1), "thread"))
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)), &TargetThread))
            {
                ShowMessages(
                    "please specify a correct hex value for the thread (nt!_ETHREAD) that you "
                    "want to operate on it\n\n");
                CommandThreadHelp();
                return;
            }
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(1), "list") && CompareLowerCaseStrings(CommandTokens.at(2), "process"))
        {
            ShowMessages(
                "please specify a hex value for the process\n\n");
            CommandThreadHelp();
            return;
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
            CommandThreadHelp();
            return;
        }
 
        if (CompareLowerCaseStrings(CommandTokens.at(0), ".thread2"))
        {
            //
            // Check by changes to gs:[188]
            //
            CheckByClkIntr = FALSE;
        }
        else
        {
            //
            // Check on clock interrupt changes
            //
            CheckByClkIntr = TRUE;
        }
 
        //
        // Send the packet to change the thread
        //
        KdSendSwitchThreadPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH,
                                           TargetThreadId,
                                           TargetThread,
                                           CheckByClkIntr,
                                           NULL);
    }
    else if (CommandTokens.size() == 4)
    {
        if (CompareLowerCaseStrings(CommandTokens.at(1), "list"))
        {
            if (CompareLowerCaseStrings(CommandTokens.at(2), "process"))
            {
                if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)), &TargetProcess))
                {
                    ShowMessages(
                        "please specify a correct hex value for the process (nt!_EPROCESS) that you "
                        "want to see its threads\n\n");
                    CommandThreadHelp();
                    return;
                }
 
                //
                // List the target process's threads
                //
                if (!CommandThreadListThreads(TargetProcess))
                {
                    ShowMessages("err, the need offset to iterate over threads not found, "
                                 "make sure to load ntoskrnl.exe's PDB file. use '.help .sym' for "
                                 "more information\n");
                    return;
                }
            }
            else
            {
                ShowMessages(
                    "err, unknown parameter at '%s'\n\n",
                    GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str());
                CommandThreadHelp();
                return;
            }
        }
        else
        {
            ShowMessages(
                "err, unknown parameter at '%s'\n\n",
                GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
            CommandThreadHelp();
            return;
        }
    }
    else
    {
        ShowMessages("invalid parameter\n\n");
        CommandThreadHelp();
        return;
    }
}

◆ CommandTrace()

VOID CommandTrace	(	vector< CommandToken >	CommandTokens,
		string	Command )

!trace command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
    BOOLEAN                            SetTraceType = FALSE;
    DEBUGGER_EVENT_TRACE_TYPE          TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_INVALID;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            TRAP_EXECUTION_INSTRUCTION_TRACE,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (CommandTokens.size() > 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandTraceHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Interpret command specific details (if any)
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!trace"))
        {
            continue;
        }
        else if ((CompareLowerCaseStrings(Section, "step-in") || CompareLowerCaseStrings(Section, "stepin") || CompareLowerCaseStrings(Section, "step")) && !SetTraceType)
        {
            TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_STEP_IN;
            SetTraceType = TRUE;
        }
        else if ((CompareLowerCaseStrings(Section, "step-out") || CompareLowerCaseStrings(Section, "stepout")) && !SetTraceType)
        {
            TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_STEP_OUT;
            SetTraceType = TRUE;
        }
        else if ((CompareLowerCaseStrings(Section, "step-instrument") || CompareLowerCaseStrings(Section, "instrument-step") ||
                  CompareLowerCaseStrings(Section, "instrumentstep") ||
                  CompareLowerCaseStrings(Section, "instrument-step-in")) &&
                 !SetTraceType)
        {
            TargetTrace  = DEBUGGER_EVENT_TRACE_TYPE_INSTRUMENTATION_STEP_IN;
            SetTraceType = TRUE;
        }
        else
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandTraceHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        }
    }
 
    //
    // Check if user specified the execution mode or not
    //
    if (!SetTraceType)
    {
        ShowMessages("please specify the trace type\n");
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Set the first parameter to the required trace type
    //
    Event->Options.OptionalParam1 = (UINT64)SetTraceType;
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandTrack()

VOID CommandTrack	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of !track command

Parameters

CommandTokens
Command

Returns: VOID

{
    UINT32 StepCount;
    string SymbolServer;
 
    //
    // Validate the commands
    //
    if (CommandTokens.size() >= 4)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandTrackHelp();
        return;
    }
 
    //
    // Check if we're in VMI mode
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ShowMessages("the tracking mechanism is only supported in Debugger Mode\n");
        return;
    }
 
    //
    // Show recommendation
    //
    if (!CommandSettingsGetValueFromConfigFile("SymbolServer", SymbolServer))
    {
        ShowMessages("it is recommended to configure the symbol path '.sympath' and load "
                     "symbols before using the '!track' command command to obtain results with function "
                     "names\n");
    }
 
    //
    // Reset the details of indentation and regs
    //
    NumberOfCallsIdentation  = 0;
    IsCallInstructionVisited = FALSE;
    ShowRegs                 = FALSE;
    RequestShowingRegs       = FALSE;
 
    //
    // Set default of stepping (tracking)
    //
    StepCount = DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING;
 
    //
    // Check parameters
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!track") || CompareLowerCaseStrings(Section, "track"))
        {
            continue;
        }
 
        //
        // check if the second param is a number
        //
        if (ConvertTokenToUInt32(Section, &StepCount))
        {
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "tree"))
        {
            //
            // Default
            //
            ShowRegs = FALSE;
        }
        else if (CompareLowerCaseStrings(Section, "reg"))
        {
            ShowRegs = TRUE;
        }
        else
        {
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            return;
        }
    }
 
    //
    // Check if the remote serial debuggee or user debugger are paused or not
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Indicate that we're instrumenting
        //
        g_IsInstrumentingInstructions = TRUE;
 
        for (SIZE_T i = 0; i < StepCount; i++)
        {
            //
            // For logging purpose
            //
            // ShowMessages("percentage : %f %% (%x)\n", 100.0 * (i /
            //   (float)StepCount), i);
            //
 
            //
            // It's stepping over serial connection in kernel debugger
            //
            SteppingInstrumentationStepInForTracking();
 
            if (ShowRegs && RequestShowingRegs)
            {
                RequestShowingRegs = FALSE;
 
                //
                // Show registers
                //
                HyperDbgRegisterShowAll();
 
                ShowMessages("\n");
            }
 
            //
            // Check if user pressed CTRL+C
            //
            if (!g_IsInstrumentingInstructions)
            {
                break;
            }
        }
 
        //
        // We're not instrumenting instructions anymore
        //
        g_IsInstrumentingInstructions = FALSE;
    }
    else
    {
        ShowMessages("err, tracking is not valid in the current context, you "
                     "should connect to a debuggee\n");
    }
}

◆ CommandTsc()

VOID CommandTsc	(	vector< CommandToken >	CommandTokens,
		string	Command )

handler of !tsc command

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            TSC_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (CommandTokens.size() > 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandTscHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandUnhide()

VOID CommandUnhide	(	vector< CommandToken >	CommandTokens,
		string	Command )

!unhide command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() >= 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandUnhideHelp();
        return;
    }
 
    //
    // Disable transparent mode
    //
    HyperDbgDisableTransparentMode();
}

◆ CommandUnload()

VOID CommandUnload	(	vector< CommandToken >	CommandTokens,
		string	Command )

unload command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 2 && CommandTokens.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandUnloadHelp();
        return;
    }
 
    //
    // Check for the module
    //
    if (CommandTokens.size() == 2 &&
        (CompareLowerCaseStrings(CommandTokens.at(1), "vmm") || CompareLowerCaseStrings(CommandTokens.at(1), "vm")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        if (g_IsVmmModuleLoaded)
        {
            HyperDbgUnloadVmm();
 
            HyperDbgUnloadKd(); // Test: Should be removed
        }
        else
        {
            ShowMessages("the vmm module is not loadedd\n");
        }
    }
    else if (CommandTokens.size() == 2 &&
             (CompareLowerCaseStrings(CommandTokens.at(1), "trace") || CompareLowerCaseStrings(CommandTokens.at(1), "hypertrace")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        if (g_IsHyperTraceModuleLoaded)
        {
            HyperDbgUnloadHyperTrace();
        }
        else
        {
            ShowMessages("the trace (hypertrace) module is not loadedd\n");
        }
    }
    else if (CommandTokens.size() == 2 &&
             (CompareLowerCaseStrings(CommandTokens.at(1), "kd") || CompareLowerCaseStrings(CommandTokens.at(1), "dbg") ||
              CompareLowerCaseStrings(CommandTokens.at(1), "debugger") || CompareLowerCaseStrings(CommandTokens.at(1), "debug") ||
              CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebugger") || CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebug")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        if (g_IsKdModuleLoaded)
        {
            HyperDbgUnloadKd();
        }
        else
        {
            ShowMessages("the kd (kernel debugger) module is not loadedd\n");
        }
    }
    else if (CommandTokens.size() == 2 &&
             (CompareLowerCaseStrings(CommandTokens.at(1), "all") || CompareLowerCaseStrings(CommandTokens.at(1), ".")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        //
        // Check if any module is loaded
        //
        if (!HyperDbgIsAnyModuleLoaded())
        {
            ShowMessages("no module is loaded\n");
            return;
        }
 
        ShowMessages("unloading all modules\n");
 
        //
        // Unload all modules
        //
        if (HyperDbgUnloadAllModules() != 0)
        {
            ShowMessages("err, failed to unload all modules\n");
            return;
        }
        else
        {
            ShowMessages("all modules are unloaded\n");
        }
    }
    else if (CommandTokens.size() == 3 && CompareLowerCaseStrings(CommandTokens.at(1), "remove") &&
             (CompareLowerCaseStrings(CommandTokens.at(2), "all") ||
              CompareLowerCaseStrings(CommandTokens.at(2), ".") ||
              CompareLowerCaseStrings(CommandTokens.at(2), "vmm") ||
              CompareLowerCaseStrings(CommandTokens.at(2), "vm")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        //
        // Unload all modules before removing the driver
        //
        if (HyperDbgUnloadAllModules())
        {
            ShowMessages("err, failed to unload all modules\n");
            return;
        }
 
        //
        // Stop the driver
        //
        if (HyperDbgStopKdDriver())
        {
            ShowMessages("err, failed to stop driver\n");
            return;
        }
 
        //
        // Uninstall the driver
        //
        if (HyperDbgUninstallKdDriver())
        {
            ShowMessages("err, failed to uninstall the driver\n");
            return;
        }
 
        ShowMessages("all drivers are removed\n");
    }
    else
    {
        //
        // Module not found
        //
        ShowMessages("err, module not found\n");
    }
}

◆ CommandVa2pa()

VOID CommandVa2pa	(	vector< CommandToken >	CommandTokens,
		string	Command )

!va2pa command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                              Status;
    ULONG                             ReturnedLength;
    UINT64                            TargetVa;
    UINT32                            Pid            = 0;
    DEBUGGER_VA2PA_AND_PA2VA_COMMANDS AddressDetails = {0};
 
    if (CommandTokens.size() == 1 || CommandTokens.size() >= 5 || CommandTokens.size() == 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandVa2paHelp();
        return;
    }
 
    //
    // By default if the user-debugger is active, we use these commands
    // on the memory layout of the debuggee process
    //
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        Pid = g_ActiveProcessDebuggingState.ProcessId;
    }
 
    if (CommandTokens.size() == 2)
    {
        //
        // It's just an address for current process
        //
        if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)), &TargetVa))
        {
            //
            // Couldn't resolve or unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
            return;
        }
    }
    else
    {
        //
        // It might be address + pid
        //
        if (CompareLowerCaseStrings(CommandTokens.at(1), "pid"))
        {
            if (!ConvertTokenToUInt32(CommandTokens.at(2), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
 
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)).c_str());
                return;
            }
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(2), "pid"))
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)), &TargetVa))
            {
                //
                // Couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
                return;
            }
 
            if (!ConvertTokenToUInt32(CommandTokens.at(3), &Pid))
            {
                ShowMessages("incorrect address, please enter a valid process id\n");
                return;
            }
        }
        else
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandVa2paHelp();
            return;
        }
    }
 
    //
    // Prepare the buffer
    // We use same buffer for input and output
    //
    AddressDetails.VirtualAddress     = TargetVa;
    AddressDetails.ProcessId          = Pid; // null in debugger mode
    AddressDetails.IsVirtual2Physical = TRUE;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Check to prevent using process id in !va2pa command
        //
        if (Pid != 0)
        {
            ShowMessages(ASSERT_MESSAGE_CANNOT_SPECIFY_PID);
            return;
        }
 
        //
        // Send the request over serial kernel debugger
        //
 
        KdSendVa2paAndPa2vaPacketToDebuggee(&AddressDetails);
    }
    else
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
        if (Pid == 0)
        {
            Pid                      = GetCurrentProcessId();
            AddressDetails.ProcessId = Pid;
        }
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,                           // Handle to device
            IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS,  // IO Control Code (IOCTL)
            &AddressDetails,                          // Input Buffer to driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Input buffer length
            &AddressDetails,                          // Output Buffer from driver.
            SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, // Length of output
                                                      // buffer in bytes.
            &ReturnedLength,                          // Bytes placed in buffer.
            NULL                                      // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            return;
        }
 
        if (AddressDetails.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            //
            // Show the results
            //
            ShowMessages("%llx\n", AddressDetails.PhysicalAddress);
        }
        else
        {
            //
            // An err occurred, no results
            //
            ShowErrorMessage(AddressDetails.KernelStatus);
        }
    }
}

◆ CommandVmcall()

VOID CommandVmcall	(	vector< CommandToken >	CommandTokens,
		string	Command )

!vmcall command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    UINT32                             EventLength;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            VMCALL_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Check for size
    //
    if (CommandTokens.size() > 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandVmcallHelp();
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandWrmsr()

VOID CommandWrmsr	(	vector< CommandToken >	CommandTokens,
		string	Command )

wrmsr command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    BOOL                           Status;
    UINT64                         Msr;
    ULONG                          ReturnedLength;
    DEBUGGER_READ_AND_WRITE_ON_MSR MsrWriteRequest = {0};
    BOOL                           IsNextCoreId    = FALSE;
    BOOL                           SetMsr          = FALSE;
    BOOL                           SetValue        = FALSE;
    UINT64                         Value           = 0;
    UINT32                         CoreNumer       = DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES;
    BOOLEAN                        IsFirstCommand  = TRUE;
 
    if (CommandTokens.size() >= 6)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandWrmsrHelp();
        return;
    }
 
    for (auto Section : CommandTokens)
    {
        if (IsFirstCommand == TRUE)
        {
            IsFirstCommand = FALSE;
            continue;
        }
 
        if (IsNextCoreId)
        {
            if (!ConvertTokenToUInt32(Section, &CoreNumer))
            {
                ShowMessages("please specify a correct hex value for core id\n\n");
                CommandWrmsrHelp();
                return;
            }
 
            IsNextCoreId = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "core"))
        {
            IsNextCoreId = TRUE;
            continue;
        }
 
        if (!SetMsr)
        {
            if (!ConvertTokenToUInt64(Section, &Msr))
            {
                ShowMessages("please specify a correct hex value to be read\n\n");
                CommandWrmsrHelp();
                return;
            }
            else
            {
                //
                // Means that the MSR is set, next we should read value
                //
                SetMsr = TRUE;
                continue;
            }
        }
 
        if (SetMsr)
        {
            if (!SymbolConvertNameOrExprToAddress(GetCaseSensitiveStringFromCommandToken(Section), &Value))
            {
                ShowMessages(
                    "please specify a correct hex value or an expression to put on the msr\n\n");
                CommandWrmsrHelp();
                return;
            }
            else
            {
                SetValue = TRUE;
                continue;
            }
        }
    }
 
    //
    // Check if msr is set or not
    //
    if (!SetMsr)
    {
        ShowMessages("please specify a correct hex value to write\n\n");
        CommandWrmsrHelp();
        return;
    }
 
    if (!SetValue)
    {
        ShowMessages("please specify a correct hex value to put on msr\n\n");
        CommandWrmsrHelp();
        return;
    }
 
    if (IsNextCoreId)
    {
        ShowMessages("please specify a correct hex value for core\n\n");
        CommandWrmsrHelp();
        return;
    }
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturn);
 
    MsrWriteRequest.ActionType = DEBUGGER_MSR_WRITE;
    MsrWriteRequest.Msr        = Msr;
    MsrWriteRequest.CoreNumber = CoreNumer;
    MsrWriteRequest.Value      = Value;
 
    Status = DeviceIoControl(
        g_DeviceHandle,                        // Handle to device
        IOCTL_DEBUGGER_READ_OR_WRITE_MSR,      // IO Control Code (IOCTL)
        &MsrWriteRequest,                      // Input Buffer to driver.
        SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR, // Input buffer length
        &MsrWriteRequest,                      // Output Buffer from driver.
        SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR, // Length of output buffer in bytes.
        &ReturnedLength,                       // Bytes placed in buffer.
        NULL                                   // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code (%x), either msr index or core id is invalid\n",
                     GetLastError());
        return;
    }
 
    ShowMessages("\n");
}

◆ CommandX()

VOID CommandX	(	vector< CommandToken >	CommandTokens,
		string	Command )

x command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandXHelp();
        return;
    }
 
    //
    // Search for mask
    //
    ScriptEngineSearchSymbolForMaskWrapper(GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
}

◆ CommandXsetbv()

VOID CommandXsetbv	(	vector< CommandToken >	CommandTokens,
		string	Command )

!xsetbv command handler

Parameters

CommandTokens
Command

Returns: VOID

{
    PDEBUGGER_GENERAL_EVENT_DETAIL     Event                 = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionBreakToDebugger = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionCustomCode      = NULL;
    PDEBUGGER_GENERAL_ACTION           ActionScript          = NULL;
    BOOLEAN                            GetXcr                = FALSE;
    UINT32                             EventLength;
    UINT64                             SpecialTarget               = 0;
    UINT32                             ActionBreakToDebuggerLength = 0;
    UINT32                             ActionCustomCodeLength      = 0;
    UINT32                             ActionScriptLength          = 0;
    DEBUGGER_EVENT_PARSING_ERROR_CAUSE EventParsingErrorCause;
 
    //
    // Interpret and fill the general event and action fields
    //
    if (!InterpretGeneralEventAndActionsFields(
            &CommandTokens,
            XSETBV_INSTRUCTION_EXECUTION,
            &Event,
            &EventLength,
            &ActionBreakToDebugger,
            &ActionBreakToDebuggerLength,
            &ActionCustomCode,
            &ActionCustomCodeLength,
            &ActionScript,
            &ActionScriptLength,
            &EventParsingErrorCause))
    {
        return;
    }
 
    //
    // Interpret command specific details (if any), of XCR index
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!xsetbv"))
        {
            continue;
        }
        else if (!GetXcr)
        {
            //
            // It's probably an XCR index
            //
            if (!ConvertTokenToUInt64(Section, &SpecialTarget))
            {
                //
                // Unknown parameter
                //
                ShowMessages("unknown parameter '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandXsetbvHelp();
 
                FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
                return;
            }
            else
            {
                //
                // A special XCR is set
                //
                GetXcr = TRUE;
            }
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("unknown parameter '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
 
            CommandXsetbvHelp();
 
            FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
            return;
        }
    }
 
    //
    // Set the target XCR (if not specific then it means all XCRs)
    //
    Event->Options.OptionalParam1 = GetXcr;
 
    if (GetXcr)
    {
        Event->Options.OptionalParam2 = SpecialTarget;
    }
 
    //
    // Send the ioctl to the kernel for event registration
    //
    if (!SendEventToKernel(Event, EventLength))
    {
        //
        // There was an error, probably the handle was not initialized
        // we have to free the Action before exit, it is because, we
        // already freed the Event and string buffers
        //
 
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
 
    //
    // Add the event to the kernel
    //
    if (!RegisterActionToEvent(Event,
                               ActionBreakToDebugger,
                               ActionBreakToDebuggerLength,
                               ActionCustomCode,
                               ActionCustomCodeLength,
                               ActionScript,
                               ActionScriptLength))
    {
        //
        // There was an error
        //
        FreeEventsAndActionsMemory(Event, ActionBreakToDebugger, ActionCustomCode, ActionScript);
        return;
    }
}

◆ CommandXsetbvHelp()

VOID CommandXsetbvHelp ( )

help of the !xsetbv command

Returns: VOID

{
    ShowMessages("!xsetbv : monitors execution of xsetbv instructions.\n\n");
 
    ShowMessages("syntax : \t!xsetbv [Xcr (hex)] [pid ProcessId (hex)] [core CoreId (hex)] "
                 "[imm IsImmediate (yesno)] [sc EnableShortCircuiting (onoff)] [stage CallingStage (prepostall)] "
                 "[buffer PreAllocatedBuffer (hex)] [script { Script (string) }] [asm condition { Condition (assembly/hex) }] "
                 "[asm code { Code (assembly/hex) }] [output {OutputName (string)}]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : !xsetbv\n");
    ShowMessages("\t\te.g : !xsetbv 0\n");
    ShowMessages("\t\te.g : !xsetbv pid 400\n");
    ShowMessages("\t\te.g : !xsetbv core 2 pid 400\n");
    ShowMessages("\t\te.g : !xsetbv script { printf(\"XSETBV instruction is executed with XCR index: %%llx\\n\", @rcx); }\n");
    ShowMessages("\t\te.g : !xsetbv asm code { nop; nop; nop }\n");
}

◆ ContinuePreviousCommand()

BOOLEAN ContinuePreviousCommand ( )

Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.

Returns: TRUE means the command should be continued, FALSE means command should be ignored

{
    BOOLEAN Result = g_ShouldPreviousCommandBeContinued;
 
    //
    // We should keep it FALSE for the next command
    //
    g_ShouldPreviousCommandBeContinued = FALSE;
 
    if (Result)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

◆ CpuReadVendorString()

VOID CpuReadVendorString ( CHAR * Result )

Reads the CPU vendor string.

Returns: VOID

{
    std::string VendorString = InstructionSet::Vendor();
    strcpy(Result, VendorString.c_str());
}

◆ HyperDbgCheckWhetherTheCurrentInstructionIsCall()

BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsCall	(	UCHAR *	BufferToDisassemble,
		UINT64	BuffLength,
		BOOLEAN	Isx86_64,
		PUINT32	CallLength )

Check whether the current instruction is a 'call' or not.

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64
CallLength	Length of call (if return value is TRUE)

Returns: BOOLEAN

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip   = 0;
    INT                     InstrDecoded = 0;
    ZydisDecodedInstruction instruction;
    CHAR                    buffer[256];
    UINT32                  MaximumInstrDecoded = 1;
 
    //
    // Default length
    //
    *CallLength = 0;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
 
        ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_CALL)
        {
            //
            // It's a call
            //
 
            //
            // Log call
            //
            // ShowMessages("call length : 0x%x\n", instruction.length);
 
            //
            // Set the length
            //
            *CallLength = instruction.length;
 
            return TRUE;
        }
        else
        {
            //
            // It's not call
            //
            return FALSE;
        }
    }
 
    //
    // Should not reach here
    //
    return FALSE;
}

◆ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet()

BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet	(	UCHAR *	BufferToDisassemble,
		UINT64	CurrentRip,
		UINT32	BuffLength,
		BOOLEAN	Isx86_64,
		PBOOLEAN	IsRet )

Check whether the current instruction is a 'call' or 'ret' or not.

Parameters

BufferToDisassemble	Current Bytes of assembly
CurrentRip	Address of current RIP
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64
IsRet	Whether it's a 'ret' or not

Returns: BOOLEAN

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    INT                     InstrDecoded = 0;
    ZydisDecodedInstruction instruction;
    CHAR                    buffer[256];
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (!Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsoluteForTrackingInstructions;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_CALL)
        {
            //
            // It's a 'call' instruction
            //
 
            //
            // Log call
            //
            // ShowMessages("call length : 0x%x\n", instruction.length);
 
            //
            // We have to pass a `runtime_address` different to
            // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
            //
 
            ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
            *IsRet = FALSE;
 
            return TRUE;
        }
        else if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_RET)
        {
            //
            // It's a 'ret' instruction
            //
 
            //
            // Log ret
            //
            // ShowMessages("ret length : 0x%x\n", instruction.length);
 
            //
            // Call the tracker callback
            //
            CommandTrackHandleReceivedRetInstructions(CurrentRip);
 
            *IsRet = TRUE;
 
            return TRUE;
        }
        else
        {
            //
            // It's not call
            //
            return FALSE;
        }
    }
 
    //
    // Should not reach here
    //
    return FALSE;
}

◆ HyperDbgCheckWhetherTheCurrentInstructionIsRet()

BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsRet	(	UCHAR *	BufferToDisassemble,
		UINT64	BuffLength,
		BOOLEAN	Isx86_64 )

Check whether the current instruction is a 'ret' or not.

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64

Returns: BOOLEAN

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip   = 0;
    INT                     InstrDecoded = 0;
    ZydisDecodedInstruction instruction;
    CHAR                    buffer[256];
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
 
        ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_RET)
        {
            //
            // It's a ret
            //
 
            //
            // Log ret
            //
            // ShowMessages("ret length : 0x%x\n", instruction.length);
 
            return TRUE;
        }
        else
        {
            //
            // It's not ret
            //
            return FALSE;
        }
    }
 
    //
    // Should not reach here
    //
    return FALSE;
}

◆ HyperDbgDisassembler32()

INT HyperDbgDisassembler32	(	UCHAR *	BufferToDisassemble,
		UINT64	BaseAddress,
		UINT64	Size,
		UINT32	MaximumInstrDecoded,
		BOOLEAN	ShowBranchIsTakenOrNot,
		PRFLAGS	Rflags )

Disassemble 32 bit assemblies.

Parameters

BufferToDisassemble	buffer to disassemble
BaseAddress	the base address of assembly
Size	size of buffer
MaximumInstrDecoded	maximum instructions to decode, 0 means all possible
ShowBranchIsTakenOrNot	on conditional jumps shows whether jumps is taken or not
Rflags	in the case ShowBranchIsTakenOrNot is true, we use this variable to show the result of jump

Returns: INT

{
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        fputs("Invalid Zydis version\n", ZYAN_STDERR);
        return EXIT_FAILURE;
    }
 
    ZydisDecoder decoder;
    ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
 
    //
    // Disassembling buffer
    //
    DisassembleBuffer(&decoder, (UINT32)BaseAddress, &BufferToDisassemble[0], Size, MaximumInstrDecoded, FALSE, ShowBranchIsTakenOrNot, Rflags);
 
    return 0;
}

◆ HyperDbgDisassembler64()

INT HyperDbgDisassembler64	(	UCHAR *	BufferToDisassemble,
		UINT64	BaseAddress,
		UINT64	Size,
		UINT32	MaximumInstrDecoded,
		BOOLEAN	ShowBranchIsTakenOrNot,
		PRFLAGS	Rflags )

Disassemble x64 assemblies.

Parameters

BufferToDisassemble	buffer to disassemble
BaseAddress	the base address of assembly
Size	size of buffer
MaximumInstrDecoded	maximum instructions to decode, 0 means all possible
ShowBranchIsTakenOrNot	on conditional jumps shows whether jumps is taken or not
Rflags	in the case ShowBranchIsTakenOrNot is true, we use this variable to show the result of jump

Returns: INT

{
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        fputs("Invalid Zydis version\n", ZYAN_STDERR);
        return EXIT_FAILURE;
    }
 
    ZydisDecoder decoder;
    ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
 
    //
    // Disassembling buffer
    //
    DisassembleBuffer(&decoder, BaseAddress, &BufferToDisassemble[0], Size, MaximumInstrDecoded, TRUE, ShowBranchIsTakenOrNot, Rflags);
 
    return 0;
}

◆ HyperDbgGetImmediateValueOnEaxForSyscallNumber()

UINT32 HyperDbgGetImmediateValueOnEaxForSyscallNumber	(	UCHAR *	BufferToDisassemble,
		UINT64	BuffLength,
		BOOLEAN	Isx86_64 )

Get immediate value on EAX register.

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64

Returns: UINT32

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip   = 0;
    INT                     InstrDecoded = 0;
    ZydisDecodedInstruction instruction;
    CHAR                    buffer[256];
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
 
        ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_SYSCALL)
        {
            //
            // It's a SYSCALL instruction, we couldn't find the syscall number
            //
            return NULL;
        }
 
        if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_MOV &&
            instruction.operand_count == 2 &&
            (operands[0].reg.value == ZYDIS_REGISTER_RAX || operands[0].reg.value == ZYDIS_REGISTER_EAX))
        {
            //
            // It's a MOV
            // Log syscall number
            //
            // ShowMessages("Syscall number : 0x%x\n", operands[1].imm.value.u);
 
            return (UINT32)operands[1].imm.value.u;
        }
 
        BufferToDisassemble += instruction.length;
        BuffLength -= instruction.length;
    }
 
    //
    // Reaching here means that we didn't find any MOV instruction
    //
    return NULL;
}

◆ HyperDbgIsConditionalJumpTaken()

DEBUGGER_CONDITIONAL_JUMP_STATUS HyperDbgIsConditionalJumpTaken	(	UCHAR *	BufferToDisassemble,
		UINT64	BuffLength,
		RFLAGS	Rflags,
		BOOLEAN	Isx86_64 )

Check whether the jump is taken or not taken (in debugger).

the implementation of this function derived from the table in this site : http://www.unixwiz.net/techtips/x86-jumps.html

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Rflags	The kernel's current RFLAG
Isx86_64	Whether it's an x86 or x64

Returns: DEBUGGER_NEXT_INSTRUCTION_FINDER_STATUS

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip   = 0;
    INT                     InstrDecoded = 0;
    ZydisDecodedInstruction instruction;
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid Zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute = (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
 
        // ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        switch (instruction.mnemonic)
        {
        case ZydisMnemonic::ZYDIS_MNEMONIC_JO:
 
            //
            // Jump if overflow (jo)
            //
            if (Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNO:
 
            //
            // Jump if not overflow (jno)
            //
            if (!Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JS:
 
            //
            // Jump if sign
            //
            if (Rflags.SignFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNS:
 
            //
            // Jump if not sign
            //
            if (!Rflags.SignFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JZ:
 
            //
            // Jump if equal (je),
            // Jump if zero (jz)
            //
            if (Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNZ:
 
            //
            // Jump if not equal (jne),
            // Jump if not zero (jnz)
            //
            if (!Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JB:
 
            //
            // Jump if below (jb),
            // Jump if not above or equal (jnae),
            // Jump if carry (jc)
            //
 
            //
            // This jump is unsigned
            //
 
            if (Rflags.CarryFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNB:
 
            //
            // Jump if not below (jnb),
            // Jump if above or equal (jae),
            // Jump if not carry (jnc)
            //
 
            //
            // This jump is unsigned
            //
 
            if (!Rflags.CarryFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JBE:
 
            //
            // Jump if below or equal (jbe),
            // Jump if not above (jna)
            //
 
            //
            // This jump is unsigned
            //
 
            if (Rflags.CarryFlag || Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNBE:
 
            //
            // Jump if above (ja),
            // Jump if not below or equal (jnbe)
            //
 
            //
            // This jump is unsigned
            //
 
            if (!Rflags.CarryFlag && !Rflags.ZeroFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JL:
 
            //
            // Jump if less (jl),
            // Jump if not greater or equal (jnge)
            //
 
            //
            // This jump is signed
            //
 
            if (Rflags.SignFlag != Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNL:
 
            //
            // Jump if greater or equal (jge),
            // Jump if not less (jnl)
            //
 
            //
            // This jump is signed
            //
 
            if (Rflags.SignFlag == Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JLE:
 
            //
            // Jump if less or equal (jle),
            // Jump if not greater (jng)
            //
 
            //
            // This jump is signed
            //
 
            if (Rflags.ZeroFlag || Rflags.SignFlag != Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNLE:
 
            //
            // Jump if greater (jg),
            // Jump if not less or equal (jnle)
            //
 
            //
            // This jump is signed
            //
 
            if (!Rflags.ZeroFlag && Rflags.SignFlag == Rflags.OverflowFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JP:
 
            //
            // Jump if parity (jp),
            // Jump if parity even (jpe)
            //
 
            if (Rflags.ParityFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JNP:
 
            //
            // Jump if not parity (jnp),
            // Jump if parity odd (jpo)
            //
 
            if (!Rflags.ParityFlag)
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN;
            else
                return DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN;
 
            break;
 
        case ZydisMnemonic::ZYDIS_MNEMONIC_JCXZ:
        case ZydisMnemonic::ZYDIS_MNEMONIC_JECXZ:
 
            //
            // Jump if %CX register is 0 (jcxz),
            // Jump if% ECX register is 0 (jecxz)
            //
 
            //
            // Actually this instruction are rarely used
            // but if we want to support these instructions then we
            // should read ecx and cx each time in the debuggee,
            // so it's better to just ignore it as a non-conditional
            // jump
            //
            return DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP;
 
        default:
 
            //
            // It's not a jump
            //
            return DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP;
            break;
        }
 
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    //
    // Should not reach here
    //
    return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
}

◆ HyperDbgLengthDisassemblerEngine()

UINT32 HyperDbgLengthDisassemblerEngine	(	UCHAR *	BufferToDisassemble,
		UINT64	BuffLength,
		BOOLEAN	Isx86_64 )

Length Disassembler engine based on Zydis.

Parameters

BufferToDisassemble	Current Bytes of assembly
BuffLength	Length of buffer
Isx86_64	Whether it's an x86 or x64
Length	of call (if return value is TRUE)

Returns: UINT32

{
    ZydisDecoder            decoder;
    ZydisFormatter          formatter;
    ZydisDecodedOperand     operands[ZYDIS_MAX_OPERAND_COUNT];
    UINT64                  CurrentRip   = 0;
    INT                     InstrDecoded = 0;
    ZydisDecodedInstruction instruction;
    UINT32                  MaximumInstrDecoded = 1;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        ShowMessages("invalid Zydis version\n");
        return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
    }
 
    if (Isx86_64)
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
    }
    else
    {
        ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32);
    }
 
    ZydisFormatterInit(&formatter, ZYDIS_FORMATTER_STYLE_INTEL);
 
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SEGMENT, ZYAN_TRUE);
    ZydisFormatterSetProperty(&formatter, ZYDIS_FORMATTER_PROP_FORCE_SIZE, ZYAN_TRUE);
 
    //
    // Replace the `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function that
    // formats the absolute addresses
    //
    default_print_address_absolute =
        (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
    ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
 
    while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
    {
        //
        // We have to pass a `runtime_address` different to
        // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
        //
        // ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
 
        //
        // Return len of buffer
        //
        return instruction.length;
    }
 
    //
    // Error in disassembling buffer
    //
    return 0;
}

◆ HyperDbgReadMemory()

BOOLEAN HyperDbgReadMemory	(	UINT64	TargetAddress,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		DEBUGGER_READ_READING_TYPE	ReadingType,
		UINT32	Pid,
		UINT32	Size,
		BOOLEAN	GetAddressMode,
		DEBUGGER_READ_MEMORY_ADDRESS_MODE *	AddressMode,
		BYTE *	TargetBufferToStore,
		UINT32 *	ReturnLength )

Read memory and disassembler.

Parameters

TargetAddress	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
ReadingType	read from kernel or vmx-root
Pid	The target process id
Size	size of memory to read
GetAddressMode	check for address mode
AddressMode	Address mode (32 or 64)
TargetBufferToStore	The buffer to store the read memory
ReturnLength	The length of the read memory

Returns: BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    BOOL                 Status;
    ULONG                ReturnedLength;
    DEBUGGER_READ_MEMORY ReadMem = {0};
    UINT32               SizeOfTargetBuffer;
 
    //
    // Check if driver is loaded if it's in local debugging mode
    //
    if (!g_IsSerialConnectedToRemoteDebuggee)
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
    }
 
    //
    // Fill the read memory structure
    //
    ReadMem.Address        = TargetAddress;
    ReadMem.Pid            = Pid;
    ReadMem.Size           = Size;
    ReadMem.MemoryType     = MemoryType;
    ReadMem.ReadingType    = ReadingType;
    ReadMem.GetAddressMode = GetAddressMode;
 
    //
    // allocate buffer for transferring messages
    //
    SizeOfTargetBuffer                    = sizeof(DEBUGGER_READ_MEMORY) + (Size * sizeof(CHAR));
    DEBUGGER_READ_MEMORY * MemReadRequest = (DEBUGGER_READ_MEMORY *)malloc(SizeOfTargetBuffer);
 
    //
    // Check if the buffer is allocated successfully
    //
    if (MemReadRequest == NULL)
    {
        return FALSE;
    }
 
    ZeroMemory(MemReadRequest, SizeOfTargetBuffer);
 
    //
    // Copy the buffer to send
    //
    memcpy(MemReadRequest, &ReadMem, sizeof(DEBUGGER_READ_MEMORY));
 
    //
    // Check if this is used for Debugger Mode or VMI mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // It's on Debugger mode
        //
        if (!KdSendReadMemoryPacketToDebuggee(MemReadRequest, SizeOfTargetBuffer))
        {
            std::free(MemReadRequest);
            return FALSE;
        }
    }
    else
    {
        //
        // It's on local debugging mode
        //
        Status = DeviceIoControl(g_DeviceHandle,              // Handle to device
                                 IOCTL_DEBUGGER_READ_MEMORY,  // IO Control Code (IOCTL)
                                 MemReadRequest,              // Input Buffer to driver.
                                 SIZEOF_DEBUGGER_READ_MEMORY, // Input buffer length
                                 MemReadRequest,              // Output Buffer from driver.
                                 SizeOfTargetBuffer,          // Length of output buffer in bytes.
                                 &ReturnedLength,             // Bytes placed in buffer.
                                 NULL                         // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
            std::free(MemReadRequest);
            return FALSE;
        }
    }
 
    //
    // Check if reading memory was successful or not
    //
    if (MemReadRequest->KernelStatus != DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowErrorMessage(MemReadRequest->KernelStatus);
        std::free(MemReadRequest);
        return FALSE;
    }
    else
    {
        if (g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Change the ReturnedLength as it contains the headers
            //
            *ReturnLength = MemReadRequest->ReturnLength;
        }
        else
        {
            //
            // Change the ReturnedLength as it contains the headers
            //
            ReturnedLength -= SIZEOF_DEBUGGER_READ_MEMORY;
            *ReturnLength = ReturnedLength;
        }
 
        //
        // Set address mode (if requested)
        //
        if (GetAddressMode)
        {
            *AddressMode = MemReadRequest->AddressMode;
        }
 
        //
        // Copy the buffer
        //
        memcpy(TargetBufferToStore,
               ((UCHAR *)MemReadRequest) + sizeof(DEBUGGER_READ_MEMORY),
               *ReturnLength);
 
        //
        // free the buffer
        //
        std::free(MemReadRequest);
 
        return TRUE;
    }
}

◆ HyperDbgShowMemoryOrDisassemble()

VOID HyperDbgShowMemoryOrDisassemble	(	DEBUGGER_SHOW_MEMORY_STYLE	Style,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		DEBUGGER_READ_READING_TYPE	ReadingType,
		UINT32	Pid,
		UINT32	Size,
		PDEBUGGER_DT_COMMAND_OPTIONS	DtDetails )

Show memory or disassembler.

Parameters

Style	style of show memory (as byte, dwrod, qword)
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
ReadingType	read from kernel or vmx-root
Pid	The target process id
Size	size of memory to read
DtDetails	Options for dt structure show details

Returns: VOID

{
    UINT32                            ReturnedLength;
    UCHAR *                           Buffer;
    DEBUGGER_READ_MEMORY_ADDRESS_MODE AddressMode;
    BOOLEAN                           CheckForAddressMode = FALSE;
    BOOLEAN                           Status              = FALSE;
 
    //
    // Check if this is used for disassembler or not
    //
    if (Style == DEBUGGER_SHOW_COMMAND_DISASSEMBLE64 ||
        Style == DEBUGGER_SHOW_COMMAND_DISASSEMBLE32)
    {
        CheckForAddressMode = TRUE;
    }
    else
    {
        CheckForAddressMode = FALSE;
    }
 
    //
    // Allocate buffer for output
    //
    Buffer = (UCHAR *)malloc(Size);
 
    //
    // Perform reading memory
    //
    Status = HyperDbgReadMemory(Address,
                                MemoryType,
                                ReadingType,
                                Pid,
                                Size,
                                CheckForAddressMode,
                                &AddressMode,
                                (BYTE *)Buffer,
                                &ReturnedLength);
 
    //
    // Check if reading memory was successful or not
    //
    if (!Status)
    {
        //
        // Check for extra message for the dump command
        //
        if (Style == DEBUGGER_SHOW_COMMAND_DUMP)
        {
            ShowMessages("HyperDbg attempted to access an invalid target address: 0x%llx\n"
                         "if you are confident that the address is valid, it may be paged out "
                         "or not yet available in the current CR3 page table\n"
                         "you can use the '.pagein' command to load this page table into memory and "
                         "trigger a page fault (#PF), please refer to the documentation for further details\n\n",
                         Address);
        }
 
        //
        // free the buffer
        //
        std::free(Buffer);
        return;
    }
 
    switch (Style)
    {
    case DEBUGGER_SHOW_COMMAND_DT:
 
        //
        // Show the 'dt' command view
        //
        if (Size == ReturnedLength)
        {
            ScriptEngineShowDataBasedOnSymbolTypesWrapper(DtDetails->TypeName,
                                                          Address,
                                                          FALSE,
                                                          Buffer,
                                                          DtDetails->AdditionalParameters);
        }
        else if (ReturnedLength == 0)
        {
            ShowMessages("err, invalid address");
        }
        else
        {
            ShowMessages("err, invalid address or memory is smaller than the structure size");
        }
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DB:
 
        ShowMemoryCommandDB(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DC:
 
        ShowMemoryCommandDC(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DD:
 
        ShowMemoryCommandDD(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DQ:
 
        ShowMemoryCommandDQ(
            Buffer,
            Size,
            Address,
            MemoryType,
            ReturnedLength);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DUMP:
 
        CommandDumpSaveIntoFile(Buffer, Size);
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DISASSEMBLE64:
 
        //
        // Check if assembly mismatch occurred with the target address
        //
        if (AddressMode == DEBUGGER_READ_ADDRESS_MODE_32_BIT && MemoryType == DEBUGGER_READ_VIRTUAL_ADDRESS)
        {
            ShowMessages("the target address seems to be located in a 32-bit program, if so, "
                         "please consider using the 'u32' instead to utilize the 32-bit disassembler\n");
        }
 
        //
        // Show diassembles
        //
        if (ReturnedLength != 0)
        {
            HyperDbgDisassembler64(
                Buffer,
                Address,
                ReturnedLength,
                0,
                FALSE,
                NULL);
        }
        else
        {
            ShowMessages("err, invalid address\n");
        }
 
        break;
 
    case DEBUGGER_SHOW_COMMAND_DISASSEMBLE32:
 
        //
        // Check if assembly mismatch occurred with the target address
        //
        if (AddressMode == DEBUGGER_READ_ADDRESS_MODE_64_BIT && MemoryType == DEBUGGER_READ_VIRTUAL_ADDRESS)
        {
            ShowMessages("the target address seems to be located in a 64-bit program, if so, "
                         "please consider using the 'u' instead to utilize the 64-bit disassembler\n");
        }
 
        //
        // Show diassembles
        //
        if (ReturnedLength != 0)
        {
            HyperDbgDisassembler32(
                Buffer,
                Address,
                ReturnedLength,
                0,
                FALSE,
                NULL);
        }
        else
        {
            ShowMessages("err, invalid address\n");
        }
 
        break;
    }
 
    //
    // free the buffer
    //
    std::free(Buffer);
}

◆ InitializeCommandsDictionary()

VOID InitializeCommandsDictionary ( )

Initialize commands and attributes.

Returns: VOID

{
    g_CommandsList[".help"] = {NULL, &CommandHelpHelp, DEBUGGER_COMMAND_HELP_ATTRIBUTES};
    g_CommandsList[".hh"]   = {NULL, &CommandHelpHelp, DEBUGGER_COMMAND_HELP_ATTRIBUTES};
    g_CommandsList["help"]  = {NULL, &CommandHelpHelp, DEBUGGER_COMMAND_HELP_ATTRIBUTES};
    g_CommandsList["!help"] = {NULL, &CommandHelpHelp, DEBUGGER_COMMAND_HELP_ATTRIBUTES};
 
    g_CommandsList["clear"] = {&CommandCls, &CommandClsHelp, DEBUGGER_COMMAND_CLEAR_ATTRIBUTES};
    g_CommandsList[".cls"]  = {&CommandCls, &CommandClsHelp, DEBUGGER_COMMAND_CLEAR_ATTRIBUTES};
    g_CommandsList["cls"]   = {&CommandCls, &CommandClsHelp, DEBUGGER_COMMAND_CLEAR_ATTRIBUTES};
 
    g_CommandsList[".connect"] = {&CommandConnect, &CommandConnectHelp, DEBUGGER_COMMAND_CONNECT_ATTRIBUTES};
    g_CommandsList["connect"]  = {&CommandConnect, &CommandConnectHelp, DEBUGGER_COMMAND_CONNECT_ATTRIBUTES};
 
    g_CommandsList[".listen"] = {&CommandListen, &CommandListenHelp, DEBUGGER_COMMAND_LISTEN_ATTRIBUTES};
    g_CommandsList["listen"]  = {&CommandListen, &CommandListenHelp, DEBUGGER_COMMAND_LISTEN_ATTRIBUTES};
 
    g_CommandsList["g"]  = {&CommandG, &CommandGHelp, DEBUGGER_COMMAND_G_ATTRIBUTES};
    g_CommandsList["go"] = {&CommandG, &CommandGHelp, DEBUGGER_COMMAND_G_ATTRIBUTES};
 
    g_CommandsList["cont"]     = {&CommandContinue, &CommandContinueHelp, DEBUGGER_COMMAND_CONTINUE_ATTRIBUTES};
    g_CommandsList["continue"] = {&CommandContinue, &CommandContinueHelp, DEBUGGER_COMMAND_CONTINUE_ATTRIBUTES};
 
    g_CommandsList["gg"] = {&CommandGg, &CommandGgHelp, DEBUGGER_COMMAND_GG_ATTRIBUTES};
 
    g_CommandsList[".attach"] = {&CommandAttach, &CommandAttachHelp, DEBUGGER_COMMAND_ATTACH_ATTRIBUTES};
    g_CommandsList["attach"]  = {&CommandAttach, &CommandAttachHelp, DEBUGGER_COMMAND_ATTACH_ATTRIBUTES};
 
    g_CommandsList[".detach"] = {&CommandDetach, &CommandDetachHelp, DEBUGGER_COMMAND_DETACH_ATTRIBUTES};
    g_CommandsList["detach"]  = {&CommandDetach, &CommandDetachHelp, DEBUGGER_COMMAND_DETACH_ATTRIBUTES};
 
    g_CommandsList[".start"] = {&CommandStart, &CommandStartHelp, DEBUGGER_COMMAND_START_ATTRIBUTES};
    g_CommandsList["start"]  = {&CommandStart, &CommandStartHelp, DEBUGGER_COMMAND_START_ATTRIBUTES};
 
    g_CommandsList[".restart"] = {&CommandRestart, &CommandRestartHelp, DEBUGGER_COMMAND_RESTART_ATTRIBUTES};
    g_CommandsList["restart"]  = {&CommandRestart, &CommandRestartHelp, DEBUGGER_COMMAND_RESTART_ATTRIBUTES};
 
    g_CommandsList[".switch"] = {&CommandSwitch, &CommandSwitchHelp, DEBUGGER_COMMAND_SWITCH_ATTRIBUTES};
    g_CommandsList["switch"]  = {&CommandSwitch, &CommandSwitchHelp, DEBUGGER_COMMAND_SWITCH_ATTRIBUTES};
 
    g_CommandsList[".kill"] = {&CommandKill, &CommandKillHelp, DEBUGGER_COMMAND_KILL_ATTRIBUTES};
    g_CommandsList["kill"]  = {&CommandKill, &CommandKillHelp, DEBUGGER_COMMAND_KILL_ATTRIBUTES};
 
    g_CommandsList[".process"]  = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
    g_CommandsList[".process2"] = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
    g_CommandsList["process"]   = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
    g_CommandsList["process2"]  = {&CommandProcess, &CommandProcessHelp, DEBUGGER_COMMAND_PROCESS_ATTRIBUTES};
 
    g_CommandsList[".thread"]  = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
    g_CommandsList[".thread2"] = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
    g_CommandsList["thread"]   = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
    g_CommandsList["thread2"]  = {&CommandThread, &CommandThreadHelp, DEBUGGER_COMMAND_THREAD_ATTRIBUTES};
 
    g_CommandsList["sleep"] = {&CommandSleep, &CommandSleepHelp, DEBUGGER_COMMAND_SLEEP_ATTRIBUTES};
 
    g_CommandsList["event"]  = {&CommandEvents, &CommandEventsHelp, DEBUGGER_COMMAND_EVENTS_ATTRIBUTES};
    g_CommandsList["events"] = {&CommandEvents, &CommandEventsHelp, DEBUGGER_COMMAND_EVENTS_ATTRIBUTES};
 
    g_CommandsList["setting"]   = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
    g_CommandsList["settings"]  = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
    g_CommandsList[".setting"]  = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
    g_CommandsList[".settings"] = {&CommandSettings, &CommandSettingsHelp, DEBUGGER_COMMAND_SETTINGS_ATTRIBUTES};
 
    g_CommandsList[".disconnect"] = {&CommandDisconnect, &CommandDisconnectHelp, DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES};
    g_CommandsList["disconnect"]  = {&CommandDisconnect, &CommandDisconnectHelp, DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES};
 
    g_CommandsList[".debug"] = {&CommandDebug, &CommandDebugHelp, DEBUGGER_COMMAND_DEBUG_ATTRIBUTES};
    g_CommandsList["debug"]  = {&CommandDebug, &CommandDebugHelp, DEBUGGER_COMMAND_DEBUG_ATTRIBUTES};
 
    g_CommandsList[".status"] = {&CommandStatus, &CommandStatusHelp, DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES};
    g_CommandsList["status"]  = {&CommandStatus, &CommandStatusHelp, DEBUGGER_COMMAND_STATUS_ATTRIBUTES};
 
    g_CommandsList["load"]  = {&CommandLoad, &CommandLoadHelp, DEBUGGER_COMMAND_LOAD_ATTRIBUTES};
    g_CommandsList[".load"] = {&CommandLoad, &CommandLoadHelp, DEBUGGER_COMMAND_LOAD_ATTRIBUTES};
 
    g_CommandsList["exit"]  = {&CommandExit, &CommandExitHelp, DEBUGGER_COMMAND_EXIT_ATTRIBUTES};
    g_CommandsList[".exit"] = {&CommandExit, &CommandExitHelp, DEBUGGER_COMMAND_EXIT_ATTRIBUTES};
 
    g_CommandsList["flush"] = {&CommandFlush, &CommandFlushHelp, DEBUGGER_COMMAND_FLUSH_ATTRIBUTES};
 
    g_CommandsList["pause"]  = {&CommandPause, &CommandPauseHelp, DEBUGGER_COMMAND_PAUSE_ATTRIBUTES};
    g_CommandsList[".pause"] = {&CommandPause, &CommandPauseHelp, DEBUGGER_COMMAND_PAUSE_ATTRIBUTES};
 
    g_CommandsList["unload"] = {&CommandUnload, &CommandUnloadHelp, DEBUGGER_COMMAND_UNLOAD_ATTRIBUTES};
 
    g_CommandsList[".script"] = {&CommandScript, &CommandScriptHelp, DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES};
    g_CommandsList["script"]  = {&CommandScript, &CommandScriptHelp, DEBUGGER_COMMAND_SCRIPT_ATTRIBUTES};
 
    g_CommandsList["output"] = {&CommandOutput, &CommandOutputHelp, DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES};
 
    g_CommandsList["print"] = {&CommandPrint, &CommandPrintHelp, DEBUGGER_COMMAND_PRINT_ATTRIBUTES};
 
    g_CommandsList["?"]        = {&CommandEval, &CommandEvalHelp, DEBUGGER_COMMAND_EVAL_ATTRIBUTES};
    g_CommandsList["eval"]     = {&CommandEval, &CommandEvalHelp, DEBUGGER_COMMAND_EVAL_ATTRIBUTES};
    g_CommandsList["evaluate"] = {&CommandEval, &CommandEvalHelp, DEBUGGER_COMMAND_EVAL_ATTRIBUTES};
 
    g_CommandsList[".logopen"] = {&CommandLogopen, &CommandLogopenHelp, DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES};
 
    g_CommandsList[".logclose"] = {&CommandLogclose, &CommandLogcloseHelp, DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES};
 
    g_CommandsList[".pagein"] = {&CommandPagein, &CommandPageinHelp, DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES};
    g_CommandsList["pagein"]  = {&CommandPagein, &CommandPageinHelp, DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES};
 
    g_CommandsList["test"]  = {&CommandTest, &CommandTestHelp, DEBUGGER_COMMAND_TEST_ATTRIBUTES};
    g_CommandsList[".test"] = {&CommandTest, &CommandTestHelp, DEBUGGER_COMMAND_TEST_ATTRIBUTES};
 
    g_CommandsList["cpu"] = {&CommandCpu, &CommandCpuHelp, DEBUGGER_COMMAND_CPU_ATTRIBUTES};
 
    g_CommandsList["wrmsr"] = {&CommandWrmsr, &CommandWrmsrHelp, DEBUGGER_COMMAND_WRMSR_ATTRIBUTES};
 
    g_CommandsList["rdmsr"] = {&CommandRdmsr, &CommandRdmsrHelp, DEBUGGER_COMMAND_RDMSR_ATTRIBUTES};
 
    g_CommandsList["!va2pa"] = {&CommandVa2pa, &CommandVa2paHelp, DEBUGGER_COMMAND_VA2PA_ATTRIBUTES};
 
    g_CommandsList["!pa2va"] = {&CommandPa2va, &CommandPa2vaHelp, DEBUGGER_COMMAND_PA2VA_ATTRIBUTES};
 
    g_CommandsList[".formats"] = {&CommandFormats, &CommandFormatsHelp, DEBUGGER_COMMAND_FORMATS_ATTRIBUTES};
    g_CommandsList[".format"]  = {&CommandFormats, &CommandFormatsHelp, DEBUGGER_COMMAND_FORMATS_ATTRIBUTES};
 
    g_CommandsList["!pte"] = {&CommandPte, &CommandPteHelp, DEBUGGER_COMMAND_PTE_ATTRIBUTES};
 
    g_CommandsList["~"]    = {&CommandCore, &CommandCoreHelp, DEBUGGER_COMMAND_CORE_ATTRIBUTES};
    g_CommandsList["core"] = {&CommandCore, &CommandCoreHelp, DEBUGGER_COMMAND_CORE_ATTRIBUTES};
 
    g_CommandsList["!apic"]      = {&CommandApic, &CommandApicHelp, DEBUGGER_COMMAND_APIC_ATTRIBUTES};
    g_CommandsList["!lapic"]     = {&CommandApic, &CommandApicHelp, DEBUGGER_COMMAND_APIC_ATTRIBUTES};
    g_CommandsList["!localapic"] = {&CommandApic, &CommandApicHelp, DEBUGGER_COMMAND_APIC_ATTRIBUTES};
 
    g_CommandsList["!ioapic"] = {&CommandIoapic, &CommandIoapicHelp, DEBUGGER_COMMAND_IOAPIC_ATTRIBUTES};
 
    g_CommandsList["!monitor"] = {&CommandMonitor, &CommandMonitorHelp, DEBUGGER_COMMAND_MONITOR_ATTRIBUTES};
 
    g_CommandsList["!vmcall"] = {&CommandVmcall, &CommandVmcallHelp, DEBUGGER_COMMAND_VMCALL_ATTRIBUTES};
 
    g_CommandsList["!epthook"] = {&CommandEptHook, &CommandEptHookHelp, DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES};
 
    g_CommandsList["bp"] = {&CommandBp, &CommandBpHelp, DEBUGGER_COMMAND_BP_ATTRIBUTES};
 
    g_CommandsList["bl"] = {&CommandBl, &CommandBlHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["be"] = {&CommandBe, &CommandBeHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["bd"] = {&CommandBd, &CommandBdHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["bc"] = {&CommandBc, &CommandBcHelp, DEBUGGER_COMMAND_BD_ATTRIBUTES};
 
    g_CommandsList["!epthook2"] = {&CommandEptHook2, &CommandEptHook2Help, DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES};
 
    g_CommandsList["!cpuid"] = {&CommandCpuid, &CommandCpuidHelp, DEBUGGER_COMMAND_CPUID_ATTRIBUTES};
 
    g_CommandsList["!msrread"] = {&CommandMsrread, &CommandMsrreadHelp, DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES};
    g_CommandsList["!msread"]  = {&CommandMsrread, &CommandMsrreadHelp, DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES};
 
    g_CommandsList["!msrwrite"] = {&CommandMsrwrite, &CommandMsrwriteHelp, DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES};
 
    g_CommandsList["!tsc"] = {&CommandTsc, &CommandTscHelp, DEBUGGER_COMMAND_TSC_ATTRIBUTES};
 
    g_CommandsList["!pmc"] = {&CommandPmc, &CommandPmcHelp, DEBUGGER_COMMAND_PMC_ATTRIBUTES};
 
    g_CommandsList["!crwrite"] = {&CommandCrwrite, &CommandCrwriteHelp, DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES};
 
    g_CommandsList["!dr"] = {&CommandDr, &CommandDrHelp, DEBUGGER_COMMAND_DR_ATTRIBUTES};
 
    g_CommandsList["!ioin"] = {&CommandIoin, &CommandIoinHelp, DEBUGGER_COMMAND_IOIN_ATTRIBUTES};
 
    g_CommandsList["!ioout"] = {&CommandIoout, &CommandIooutHelp, DEBUGGER_COMMAND_IOOUT_ATTRIBUTES};
    g_CommandsList["!iout"]  = {&CommandIoout, &CommandIooutHelp, DEBUGGER_COMMAND_IOOUT_ATTRIBUTES};
 
    g_CommandsList["!exception"] = {&CommandException, &CommandExceptionHelp, DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES};
 
    g_CommandsList["!interrupt"] = {&CommandInterrupt, &CommandInterruptHelp, DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES};
 
    g_CommandsList["!syscall"]  = {&CommandSyscallAndSysret, &CommandSyscallHelp, DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES};
    g_CommandsList["!syscall2"] = {&CommandSyscallAndSysret, &CommandSyscallHelp, DEBUGGER_COMMAND_SYSCALL_ATTRIBUTES};
 
    g_CommandsList["!sysret"]  = {&CommandSyscallAndSysret, &CommandSysretHelp, DEBUGGER_COMMAND_SYSRET_ATTRIBUTES};
    g_CommandsList["!sysret2"] = {&CommandSyscallAndSysret, &CommandSysretHelp, DEBUGGER_COMMAND_SYSRET_ATTRIBUTES};
 
    g_CommandsList["!mode"] = {&CommandMode, &CommandModeHelp, DEBUGGER_COMMAND_MODE_ATTRIBUTES};
 
    g_CommandsList["!trace"] = {&CommandTrace, &CommandTraceHelp, DEBUGGER_COMMAND_TRACE_ATTRIBUTES};
 
    g_CommandsList["!hide"] = {&CommandHide, &CommandHideHelp, DEBUGGER_COMMAND_HIDE_ATTRIBUTES};
 
    g_CommandsList["!unhide"] = {&CommandUnhide, &CommandUnhideHelp, DEBUGGER_COMMAND_UNHIDE_ATTRIBUTES};
 
    g_CommandsList["!measure"] = {&CommandMeasure, &CommandMeasureHelp, DEBUGGER_COMMAND_MEASURE_ATTRIBUTES};
 
    g_CommandsList["lm"] = {&CommandLm, &CommandLmHelp, DEBUGGER_COMMAND_LM_ATTRIBUTES};
 
    g_CommandsList["p"]  = {&CommandP, &CommandPHelp, DEBUGGER_COMMAND_P_ATTRIBUTES};
    g_CommandsList["pr"] = {&CommandP, &CommandPHelp, DEBUGGER_COMMAND_P_ATTRIBUTES};
 
    g_CommandsList["t"]  = {&CommandT, &CommandTHelp, DEBUGGER_COMMAND_T_ATTRIBUTES};
    g_CommandsList["tr"] = {&CommandT, &CommandTHelp, DEBUGGER_COMMAND_T_ATTRIBUTES};
 
    g_CommandsList["i"]  = {&CommandI, &CommandIHelp, DEBUGGER_COMMAND_I_ATTRIBUTES};
    g_CommandsList["ir"] = {&CommandI, &CommandIHelp, DEBUGGER_COMMAND_I_ATTRIBUTES};
 
    g_CommandsList["gu"] = {&CommandGu, &CommandGuHelp, DEBUGGER_COMMAND_GU_ATTRIBUTES};
 
    g_CommandsList["db"]   = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["dc"]   = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["dd"]   = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["dq"]   = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!db"]  = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!dc"]  = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!dd"]  = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!dq"]  = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u"]   = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u"]    = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u64"] = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u64"]  = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u2"]  = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u2"]   = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["!u32"] = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
    g_CommandsList["u32"]  = {&CommandReadMemoryAndDisassembler, &CommandReadMemoryAndDisassemblerHelp, DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES};
 
    g_CommandsList["eb"]  = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["ed"]  = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["eq"]  = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["!eb"] = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["!ed"] = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
    g_CommandsList["!eq"] = {&CommandEditMemory, &CommandEditMemoryHelp, DEBUGGER_COMMAND_E_ATTRIBUTES};
 
    g_CommandsList["sb"]  = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["sd"]  = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["sq"]  = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["!sb"] = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["!sd"] = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
    g_CommandsList["!sq"] = {&CommandSearchMemory, &CommandSearchMemoryHelp, DEBUGGER_COMMAND_S_ATTRIBUTES};
 
    g_CommandsList["r"] = {&CommandR, &CommandRHelp, DEBUGGER_COMMAND_R_ATTRIBUTES};
 
    g_CommandsList[".sympath"] = {&CommandSympath, &CommandSympathHelp, DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES};
    g_CommandsList["sympath"]  = {&CommandSympath, &CommandSympathHelp, DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES};
 
    g_CommandsList[".sym"] = {&CommandSym, &CommandSymHelp, DEBUGGER_COMMAND_SYM_ATTRIBUTES};
    g_CommandsList["sym"]  = {&CommandSym, &CommandSymHelp, DEBUGGER_COMMAND_SYM_ATTRIBUTES};
 
    g_CommandsList["x"] = {&CommandX, &CommandXHelp, DEBUGGER_COMMAND_X_ATTRIBUTES};
 
    g_CommandsList["prealloc"]      = {&CommandPrealloc, &CommandPreallocHelp, DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES};
    g_CommandsList["preallocate"]   = {&CommandPrealloc, &CommandPreallocHelp, DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES};
    g_CommandsList["preallocation"] = {&CommandPrealloc, &CommandPreallocHelp, DEBUGGER_COMMAND_PREALLOC_ATTRIBUTES};
 
    g_CommandsList["preactivate"]   = {&CommandPreactivate, &CommandPreactivateHelp, DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES};
    g_CommandsList["preactive"]     = {&CommandPreactivate, &CommandPreactivateHelp, DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES};
    g_CommandsList["preactivation"] = {&CommandPreactivate, &CommandPreactivateHelp, DEBUGGER_COMMAND_PREACTIVATE_ATTRIBUTES};
 
    g_CommandsList["k"]  = {&CommandK, &CommandKHelp, DEBUGGER_COMMAND_K_ATTRIBUTES};
    g_CommandsList["kd"] = {&CommandK, &CommandKHelp, DEBUGGER_COMMAND_K_ATTRIBUTES};
    g_CommandsList["kq"] = {&CommandK, &CommandKHelp, DEBUGGER_COMMAND_K_ATTRIBUTES};
 
    g_CommandsList["dt"]  = {&CommandDtAndStruct, &CommandDtHelp, DEBUGGER_COMMAND_DT_ATTRIBUTES};
    g_CommandsList["!dt"] = {&CommandDtAndStruct, &CommandDtHelp, DEBUGGER_COMMAND_DT_ATTRIBUTES};
 
    g_CommandsList["struct"]    = {&CommandDtAndStruct, &CommandStructHelp, DEBUGGER_COMMAND_STRUCT_ATTRIBUTES};
    g_CommandsList["structure"] = {&CommandDtAndStruct, &CommandStructHelp, DEBUGGER_COMMAND_STRUCT_ATTRIBUTES};
 
    g_CommandsList[".pe"] = {&CommandPe, &CommandPeHelp, DEBUGGER_COMMAND_PE_ATTRIBUTES};
 
    g_CommandsList["!rev"] = {&CommandRev, &CommandRevHelp, DEBUGGER_COMMAND_REV_ATTRIBUTES};
    g_CommandsList["rev"]  = {&CommandRev, &CommandRevHelp, DEBUGGER_COMMAND_REV_ATTRIBUTES};
 
    g_CommandsList["!track"] = {&CommandTrack, &CommandTrackHelp, DEBUGGER_COMMAND_TRACK_ATTRIBUTES};
    g_CommandsList["track"]  = {&CommandTrack, &CommandTrackHelp, DEBUGGER_COMMAND_TRACK_ATTRIBUTES};
 
    g_CommandsList[".dump"] = {&CommandDump, &CommandDumpHelp, DEBUGGER_COMMAND_DUMP_ATTRIBUTES};
    g_CommandsList["dump"]  = {&CommandDump, &CommandDumpHelp, DEBUGGER_COMMAND_DUMP_ATTRIBUTES};
    g_CommandsList["!dump"] = {&CommandDump, &CommandDumpHelp, DEBUGGER_COMMAND_DUMP_ATTRIBUTES};
 
    g_CommandsList["a"]         = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["asm"]       = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["assemble"]  = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["assembly"]  = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!a"]        = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!asm"]      = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!assemble"] = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
    g_CommandsList["!assembly"] = {&CommandAssemble, &CommandAssembleHelp, DEBUGGER_COMMAND_A_ATTRIBUTES};
 
    g_CommandsList["!pcitree"]  = {&CommandPcitree, &CommandPcitreeHelp, DEBUGGER_COMMAND_PCITREE_ATTRIBUTES};
    g_CommandsList["!pcietree"] = {&CommandPcitree, &CommandPcitreeHelp, DEBUGGER_COMMAND_PCITREE_ATTRIBUTES};
 
    g_CommandsList["!pcicam"] = {&CommandPcicam, &CommandPcicamHelp, DEBUGGER_COMMAND_PCICAM_ATTRIBUTES};
 
    g_CommandsList["!idt"] = {&CommandIdt, &CommandIdtHelp, DEBUGGER_COMMAND_IDT_ATTRIBUTES};
 
    g_CommandsList["!smi"] = {&CommandSmi, &CommandSmiHelp, DEBUGGER_COMMAND_SMI_ATTRIBUTES};
 
    g_CommandsList["!lbr"] = {&CommandLbr, &CommandLbrHelp, DEBUGGER_COMMAND_LBR_ATTRIBUTES};
 
    g_CommandsList["!lbrdump"]  = {&CommandLbrdump, &CommandLbrdumpHelp, DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES};
    g_CommandsList["!lbrdmp"]   = {&CommandLbrdump, &CommandLbrdumpHelp, DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES};
    g_CommandsList["!lbrprint"] = {&CommandLbrdump, &CommandLbrdumpHelp, DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES};
 
    g_CommandsList["!pt"] = {&CommandPt, &CommandPtHelp, DEBUGGER_COMMAND_PT_ATTRIBUTES};
 
    //
    // hwdbg commands
    //
    g_CommandsList["!hw_clk"]      = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
    g_CommandsList["!hw_clock"]    = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
    g_CommandsList["!hwdbg_clock"] = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
    g_CommandsList["!hwdbg_clock"] = {&CommandHwClk, &CommandHwClkHelp, DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES};
 
    g_CommandsList["!hw"] = {&CommandHw, &CommandHwHelp, DEBUGGER_COMMAND_HWDBG_HW_ATTRIBUTES};
 
    g_CommandsList["!xsetbv"] = {&CommandXsetbv, &CommandXsetbvHelp, DEBUGGER_COMMAND_XSETBV_ATTRIBUTES};
}

◆ InitializeDebugger()

VOID InitializeDebugger ( )

Initialize the debugger and adjust commands for the first run.

Returns: VOID

{
    //
    // Initialize the mapping of functions
    //
    InitializeCommandsDictionary();
 
    //
    // Set the callback for symbol message handler
    //
    //
    // ShowMessages is passed as PVOID (the callback API stores it in a PVOID and
    // casts to the concrete fn-ptr type at the invocation site); g++ requires the
    // explicit function-pointer -> void* cast that MSVC performs implicitly.
    //
    ScriptEngineSetTextMessageCallbackWrapper((PVOID)ShowMessages);
 
    //
    // Register the CTRL+C and CTRL+BREAK Signals handler
    //
    if (!PlatformInstallCtrlHandler(BreakController))
    {
        ShowMessages("err, when registering CTRL+C and CTRL+BREAK Signals "
                     "handler\n");
        //
        // prefer to continue
        //
    }
 
    //
    // *** Check for feature indicators ***
    //
 
    //
    // Get x86 processor width for virtual address
    //
    g_VirtualAddressWidth = Getx86VirtualAddressWidth();
 
    //
    // Check if processor supports TSX (RTM)
    //
    g_RtmSupport = CheckCpuSupportRtm();
 
    //
    // Load default settings
    //
    CommandSettingsLoadDefaultValuesFromConfigFile();
}

◆ ReadCpuDetails()

INT ReadCpuDetails ( )

Print out supported instruction set extensions.

Returns: int

{
    auto & outstream = std::cout;
 
    auto support_message = [&outstream](std::string isa_feature,
                                        bool        is_supported) {
        ShowMessages("%s %s\n", isa_feature.c_str(), (is_supported ? "supported" : "not supported"));
    };
 
    ShowMessages("\nvendor : %s\n", InstructionSet::Vendor().c_str());
    ShowMessages("brand : %s\n\n", InstructionSet::Brand().c_str());
 
    support_message("3DNOW", InstructionSet::_3DNOW());
    support_message("3DNOWEXT", InstructionSet::_3DNOWEXT());
    support_message("ABM", InstructionSet::ABM());
    support_message("ADX", InstructionSet::ADX());
    support_message("AES", InstructionSet::AES());
    support_message("AVX", InstructionSet::AVX());
    support_message("AVX2", InstructionSet::AVX2());
    support_message("AVX512CD", InstructionSet::AVX512CD());
    support_message("AVX512ER", InstructionSet::AVX512ER());
    support_message("AVX512F", InstructionSet::AVX512F());
    support_message("AVX512PF", InstructionSet::AVX512PF());
    support_message("BMI1", InstructionSet::BMI1());
    support_message("BMI2", InstructionSet::BMI2());
    support_message("CLFSH", InstructionSet::CLFSH());
    support_message("CMPXCHG16B", InstructionSet::CMPXCHG16B());
    support_message("CX8", InstructionSet::CX8());
    support_message("ERMS", InstructionSet::ERMS());
    support_message("F16C", InstructionSet::F16C());
    support_message("FMA", InstructionSet::FMA());
    support_message("FSGSBASE", InstructionSet::FSGSBASE());
    support_message("FXSR", InstructionSet::FXSR());
    support_message("HLE", InstructionSet::HLE());
    support_message("INVPCID", InstructionSet::INVPCID());
    support_message("LAHF", InstructionSet::LAHF());
    support_message("LZCNT", InstructionSet::LZCNT());
    support_message("MMX", InstructionSet::MMX());
    support_message("MMXEXT", InstructionSet::MMXEXT());
    support_message("MONITOR", InstructionSet::MONITOR());
    support_message("MOVBE", InstructionSet::MOVBE());
    support_message("MSR", InstructionSet::MSR());
    support_message("OSXSAVE", InstructionSet::OSXSAVE());
    support_message("PCLMULQDQ", InstructionSet::PCLMULQDQ());
    support_message("POPCNT", InstructionSet::POPCNT());
    support_message("PREFETCHWT1", InstructionSet::PREFETCHWT1());
    support_message("RDRAND", InstructionSet::RDRAND());
    support_message("RDSEED", InstructionSet::RDSEED());
    support_message("RDTSCP", InstructionSet::RDTSCP());
    support_message("RTM", InstructionSet::RTM());
    support_message("SEP", InstructionSet::SEP());
    support_message("SHA", InstructionSet::SHA());
    support_message("SSE", InstructionSet::SSE());
    support_message("SSE2", InstructionSet::SSE2());
    support_message("SSE3", InstructionSet::SSE3());
    support_message("SSE4.1", InstructionSet::SSE41());
    support_message("SSE4.2", InstructionSet::SSE42());
    support_message("SSE4a", InstructionSet::SSE4a());
    support_message("SSSE3", InstructionSet::SSSE3());
    support_message("SYSCALL", InstructionSet::SYSCALL());
    support_message("TBM", InstructionSet::TBM());
    support_message("XOP", InstructionSet::XOP());
    support_message("XSAVE", InstructionSet::XSAVE());
 
    return 0;
}

◆ SeparateTo64BitValue()

string SeparateTo64BitValue ( UINT64 Value )

◆ ShowMemoryCommandDB()

VOID ShowMemoryCommandDB	(	UCHAR *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in bytes (DB).

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

Returns: VOID

{
    UINT32 Character;
 
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (SIZE_T j = 0; j < 16; j++)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("?? ");
            }
            else
            {
                ShowMessages("%02X ", OutputBuffer[i + j]);
            }
        }
 
        //
        // Print the character
        //
        ShowMessages(" ");
        for (SIZE_T j = 0; j < 16; j++)
        {
            Character = (OutputBuffer[i + j]);
            if (isprint(Character))
            {
                ShowMessages("%c", Character);
            }
            else
            {
                ShowMessages(".");
            }
        }
 
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMemoryCommandDC()

VOID ShowMemoryCommandDC	(	UCHAR *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in dword format (DC).

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

Returns: VOID

{
    UINT32 Character;
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (SIZE_T j = 0; j < 16; j += 4)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("???????? ");
            }
            else
            {
                UINT32 OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j]);
                ShowMessages("%08X ", OutputBufferVar);
            }
        }
 
        //
        // Print the character
        //
 
        ShowMessages(" ");
        for (SIZE_T j = 0; j < 16; j++)
        {
            Character = (OutputBuffer[i + j]);
            if (isprint(Character))
            {
                ShowMessages("%c", Character);
            }
            else
            {
                ShowMessages(".");
            }
        }
 
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMemoryCommandDD()

VOID ShowMemoryCommandDD	(	UCHAR *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in dword format (DD).

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

Returns: VOID

{
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (SIZE_T j = 0; j < 16; j += 4)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("???????? ");
            }
            else
            {
                UINT32 OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j]);
                ShowMessages("%08X ", OutputBufferVar);
            }
        }
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMemoryCommandDQ()

VOID ShowMemoryCommandDQ	(	UCHAR *	OutputBuffer,
		UINT32	Size,
		UINT64	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemoryType,
		UINT64	Length )

Show memory in qword format (DQ).

Parameters

OutputBuffer	the buffer to show
Size	size of memory to read
Address	location of where to read the memory
MemoryType	type of memory (phyical or virtual)
Length	Length of memory to show

Returns: VOID

{
    for (UINT32 i = 0; i < Size; i += 16)
    {
        if (MemoryType == DEBUGGER_READ_PHYSICAL_ADDRESS)
        {
            ShowMessages("#\t");
        }
 
        //
        // Print address
        //
        ShowMessages("%s  ", SeparateTo64BitValue((UINT64)(Address + i)).c_str());
 
        //
        // Print the hex code
        //
        for (SIZE_T j = 0; j < 16; j += 8)
        {
            //
            // check to see if the address is valid or not
            //
            if (i + j >= Length)
            {
                ShowMessages("???????? ");
            }
            else
            {
                UINT32 OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j + 4]);
                ShowMessages("%08X`", OutputBufferVar);
 
                OutputBufferVar = *((UINT32 *)&OutputBuffer[i + j]);
                ShowMessages("%08X ", OutputBufferVar);
            }
        }
 
        //
        // Go to new line
        //
        ShowMessages("\n");
    }
}

◆ ShowMessages()

VOID ShowMessages	(	const CHAR *	Fmt,
			... )

Show messages.

Parameters

Fmt	format string message
...	arguments

Returns: VOID

{
    va_list ArgList;
    va_list Args;
    CHAR    TempMessage[COMMUNICATION_BUFFER_SIZE + TCP_END_OF_BUFFER_CHARS_COUNT] = {0};
 
    if (g_MessageHandler == NULL && !g_IsConnectedToRemoteDebugger && !g_IsSerialConnectedToRemoteDebugger)
    {
        va_start(Args, Fmt);
 
        vprintf(Fmt, Args);
 
        va_end(Args);
 
        if (!g_LogOpened)
        {
            return;
        }
    }
 
    va_start(ArgList, Fmt);
 
    INT SprintfResult = PlatformVsnprintf(TempMessage, sizeof(TempMessage), Fmt, ArgList);
 
    va_end(ArgList);
 
    if (SprintfResult != -1)
    {
        if (g_IsConnectedToRemoteDebugger)
        {
            //
            // vsprintf_s and vswprintf_s return the number of characters written,
            // not including the terminating null character, or a negative value
            // if an output error occurs.
            //
            RemoteConnectionSendResultsToHost(TempMessage, SprintfResult);
        }
        else if (g_IsSerialConnectedToRemoteDebugger)
        {
            KdSendUsermodePrints(TempMessage, SprintfResult);
        }
 
        if (g_LogOpened)
        {
            //
            // .logopen command executed
            //
            LogopenSaveToFile(TempMessage);
        }
        if (g_MessageHandler != NULL)
        {
            //
            // There is another handler
            //
            if (g_MessageHandlerSharedBuffer == NULL)
            {
                ((SendMessageWithParamCallback)g_MessageHandler)(TempMessage);
            }
            else
            {
                memcpy(g_MessageHandlerSharedBuffer, TempMessage, strlen(TempMessage) + 1);
                ((SendMessageWithSharedBufferCallback)g_MessageHandler)();
            }
        }
    }
}

Variable Documentation

◆ g_DeviceHandle

HANDLE g_DeviceHandle

extern

Holds the global handle of device which is used to send the request to the kernel by IOCTL, this handle is not used for IRP Pending of message tracing this handle is used in KD VMM.

Classes

Macros

Typedefs

Enumerations

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ DEBUGGER_COMMAND_A_ATTRIBUTES

◆ DEBUGGER_COMMAND_APIC_ATTRIBUTES

◆ DEBUGGER_COMMAND_ATTACH_ATTRIBUTES

◆ DEBUGGER_COMMAND_ATTRIBUTE_ABSOLUTE_LOCAL

◆ DEBUGGER_COMMAND_ATTRIBUTE_EVENT

◆ DEBUGGER_COMMAND_ATTRIBUTE_HWDBG

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE

◆ DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION

◆ DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER

◆ DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN

◆ DEBUGGER_COMMAND_BC_ATTRIBUTES

◆ DEBUGGER_COMMAND_BD_ATTRIBUTES

◆ DEBUGGER_COMMAND_BE_ATTRIBUTES

◆ DEBUGGER_COMMAND_BL_ATTRIBUTES

◆ DEBUGGER_COMMAND_BP_ATTRIBUTES

◆ DEBUGGER_COMMAND_CLEAR_ATTRIBUTES

◆ DEBUGGER_COMMAND_CONNECT_ATTRIBUTES

◆ DEBUGGER_COMMAND_CONTINUE_ATTRIBUTES

◆ DEBUGGER_COMMAND_CORE_ATTRIBUTES

◆ DEBUGGER_COMMAND_CPU_ATTRIBUTES

◆ DEBUGGER_COMMAND_CPUID_ATTRIBUTES

◆ DEBUGGER_COMMAND_CRWRITE_ATTRIBUTES

◆ DEBUGGER_COMMAND_D_AND_U_ATTRIBUTES

◆ DEBUGGER_COMMAND_DEBUG_ATTRIBUTES

◆ DEBUGGER_COMMAND_DETACH_ATTRIBUTES

◆ DEBUGGER_COMMAND_DISCONNECT_ATTRIBUTES

◆ DEBUGGER_COMMAND_DOT_STATUS_ATTRIBUTES

◆ DEBUGGER_COMMAND_DR_ATTRIBUTES

◆ DEBUGGER_COMMAND_DT_ATTRIBUTES

◆ DEBUGGER_COMMAND_DUMP_ATTRIBUTES

◆ DEBUGGER_COMMAND_E_ATTRIBUTES

◆ DEBUGGER_COMMAND_EPTHOOK2_ATTRIBUTES

◆ DEBUGGER_COMMAND_EPTHOOK_ATTRIBUTES

◆ DEBUGGER_COMMAND_EVAL_ATTRIBUTES

◆ DEBUGGER_COMMAND_EVENTS_ATTRIBUTES

◆ DEBUGGER_COMMAND_EXCEPTION_ATTRIBUTES

◆ DEBUGGER_COMMAND_EXIT_ATTRIBUTES

◆ DEBUGGER_COMMAND_FLUSH_ATTRIBUTES

◆ DEBUGGER_COMMAND_FORMATS_ATTRIBUTES

◆ DEBUGGER_COMMAND_G_ATTRIBUTES

◆ DEBUGGER_COMMAND_GG_ATTRIBUTES

◆ DEBUGGER_COMMAND_GU_ATTRIBUTES

◆ DEBUGGER_COMMAND_HELP_ATTRIBUTES

◆ DEBUGGER_COMMAND_HIDE_ATTRIBUTES

◆ DEBUGGER_COMMAND_HWDBG_HW_ATTRIBUTES

◆ DEBUGGER_COMMAND_HWDBG_HW_CLK_ATTRIBUTES

◆ DEBUGGER_COMMAND_I_ATTRIBUTES

◆ DEBUGGER_COMMAND_IDT_ATTRIBUTES

◆ DEBUGGER_COMMAND_INTERRUPT_ATTRIBUTES

◆ DEBUGGER_COMMAND_IOAPIC_ATTRIBUTES

◆ DEBUGGER_COMMAND_IOIN_ATTRIBUTES

◆ DEBUGGER_COMMAND_IOOUT_ATTRIBUTES

◆ DEBUGGER_COMMAND_K_ATTRIBUTES

◆ DEBUGGER_COMMAND_KILL_ATTRIBUTES

◆ DEBUGGER_COMMAND_LBR_ATTRIBUTES

◆ DEBUGGER_COMMAND_LBRDUMP_ATTRIBUTES

◆ DEBUGGER_COMMAND_LISTEN_ATTRIBUTES

◆ DEBUGGER_COMMAND_LM_ATTRIBUTES

◆ DEBUGGER_COMMAND_LOAD_ATTRIBUTES

◆ DEBUGGER_COMMAND_LOGCLOSE_ATTRIBUTES

◆ DEBUGGER_COMMAND_LOGOPEN_ATTRIBUTES

◆ DEBUGGER_COMMAND_MEASURE_ATTRIBUTES

◆ DEBUGGER_COMMAND_MODE_ATTRIBUTES

◆ DEBUGGER_COMMAND_MONITOR_ATTRIBUTES

◆ DEBUGGER_COMMAND_MSRREAD_ATTRIBUTES

◆ DEBUGGER_COMMAND_MSRWRITE_ATTRIBUTES

◆ DEBUGGER_COMMAND_OUTPUT_ATTRIBUTES

◆ DEBUGGER_COMMAND_P_ATTRIBUTES

◆ DEBUGGER_COMMAND_PA2VA_ATTRIBUTES

◆ DEBUGGER_COMMAND_PAGEIN_ATTRIBUTES

◆ DEBUGGER_COMMAND_PAUSE_ATTRIBUTES

◆ DEBUGGER_COMMAND_PCICAM_ATTRIBUTES