HyperDbg general functions for reading and converting and etc. More...

#include "pch.h"

Functions
string	SeparateTo64BitValue (UINT64 Value)
	add ` between 64 bit values and convert them to string

VOID	PrintBits (const UINT32 Size, const void *Ptr)
	print bits and bytes for d* commands

BOOL	Replace (std::string &str, const std::string &from, const std::string &to)
	general replace all function

VOID	ReplaceAll (string &str, const string &from, const string &to)
	general replace all function

const vector< string >	Split (const string &s, const char &c)
	general split command

BOOLEAN	IsNumber (const string &str)
	check if given string is a numeric string or not

BOOLEAN	IsHexNotation (const string &s)
	check whether the string is hex or not

BOOLEAN	IsDecimalNotation (const string &s)
	check whether the string is decimal or not

vector< char >	HexToBytes (const string &hex)
	converts hex to bytes

BOOLEAN	ConvertStringToUInt64 (string TextToConvert, PUINT64 Result)
	check and convert string to a 64 bit unsigned integer and also check for special notations like 0x, 0n, etc.

BOOLEAN	ConvertStringToUInt32 (string TextToConvert, PUINT32 Result)
	check and convert string to a 32 bit unsigned it and also check for special notations like 0x etc.

BOOLEAN	HasEnding (string const &fullString, string const &ending)
	checks whether the string ends with a special string or not

BOOLEAN	ValidateIP (const string &ip)
	Function to validate an IP address.

BOOLEAN	VmxSupportDetection ()
	Detect whether the VMX is supported or not.

BOOL	SetPrivilege (HANDLE Token, LPCTSTR Privilege, BOOL EnablePrivilege)
	SetPrivilege enables/disables process token privilege.

void	Trim (std::string &s)
	trim from both ends and start of a string (in place)

std::string	RemoveSpaces (std::string str)
	Remove all the spaces in a string.

BOOLEAN	IsFileExistA (const char *FileName)
	check if a file exist or not (ASCII)

BOOLEAN	IsFileExistW (const wchar_t *FileName)
	check if a file exist or not (wide-char)

BOOLEAN	IsEmptyString (char *Text)
	Is empty character.

VOID	GetConfigFilePath (PWCHAR ConfigPath)
	Get config path.

std::vector< std::string >	ListDirectory (const std::string &Directory, const std::string &Extension)
	Create a list of special files in a directory.

VOID	StringToWString (std::wstring &ws, const std::string &s)
	convert std::string to std::wstring

VOID	SplitPathAndArgs (std::vector< std::string > &Qargs, const std::string &Command)
	Split path and arguments and handle strings between quotes.

size_t	FindCaseInsensitive (std::string Input, std::string ToSearch, size_t Pos)
	Find case insensitive sub string in a given substring.

size_t	FindCaseInsensitiveW (std::wstring Input, std::wstring ToSearch, size_t Pos)
	Find case insensitive sub string in a given substring (unicode)

char *	ConvertStringVectorToCharPointerArray (const std::string &s)
	Convert vector<string> to char*.

VOID	CommonCpuidInstruction (UINT32 Func, UINT32 SubFunc, int *CpuInfo)
	Get cpuid results.

UINT32	Getx86VirtualAddressWidth ()
	Get virtual address width for x86 processors.

BOOLEAN	CheckCpuSupportRtm ()
	Check whether the processor supports RTM or not.

BOOLEAN	CheckAddressCanonicality (UINT64 VAddr, PBOOLEAN IsKernelAddress)
	Checks if the address is canonical based on x86 processor's virtual address width or not.

BOOLEAN	CheckAddressValidityUsingTsx (UINT64 Address)
	This function checks whether the address is valid or not using Intel TSX.

BOOLEAN	CheckAccessValidityAndSafety (UINT64 TargetAddress, UINT32 Size)
	Check the safety to access the memory.

UINT32	Log2Ceil (UINT32 n)
	Function to compute log2Ceil.

Variables
BOOLEAN	g_RtmSupport
	check for RTM support

UINT32	g_VirtualAddressWidth
	Virtual address width for x86 processors.

Detailed Description

HyperDbg general functions for reading and converting and etc.

Author: Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version: 0.1

Date: 2020-05-27

Copyright: This project is released under the GNU Public License v3.

Function Documentation

◆ CheckAccessValidityAndSafety()

BOOLEAN CheckAccessValidityAndSafety	(	UINT64	TargetAddress,
		UINT32	Size )

Check the safety to access the memory.

Parameters

TargetAddress
Size

Returns: BOOLEAN

{
    BOOLEAN IsKernelAddress;
    BOOLEAN Result = FALSE;
 
    //
    // First, we check if the address is canonical based
    // on Intel processor's virtual address width
    //
    if (!CheckAddressCanonicality(TargetAddress, &IsKernelAddress))
    {
        //
        // No need for further check, address is invalid
        //
        return FALSE;
    }
 
    //
    // We cannot check a kernel-mode address here in user-mode
    //
    if (IsKernelAddress)
    {
        return FALSE;
    }
 
    //
    // We'll check address with TSX if it supports TSX RTM
    //
    if (g_RtmSupport)
    {
        //
        // *** The guest supports Intel TSX ***
        //
 
        UINT64 AddressToCheck =
            (CHAR *)TargetAddress + Size - ((CHAR *)PAGE_ALIGN(TargetAddress));
 
        if (AddressToCheck > PAGE_SIZE)
        {
            //
            // Address should be accessed in more than one page
            //
            UINT32 ReadSize = 0;
 
            while (Size != 0)
            {
                ReadSize = (UINT32)((UINT64)PAGE_ALIGN(TargetAddress + PAGE_SIZE) - TargetAddress);
 
                if (ReadSize == PAGE_SIZE && Size < PAGE_SIZE)
                {
                    ReadSize = Size;
                }
 
                if (!CheckAddressValidityUsingTsx(TargetAddress))
                {
                    //
                    // Address is not valid
                    //
                    return FALSE;
                }
 
                /*
                ShowMessages("Addr From : %llx to Addr To : %llx | ReadSize : %llx\n",
                             TargetAddress,
                             TargetAddress + ReadSize,
                             ReadSize);
                */
 
                //
                // Apply the changes to the next addresses (if any)
                //
                Size          = Size - ReadSize;
                TargetAddress = TargetAddress + ReadSize;
            }
        }
        else
        {
            if (!CheckAddressValidityUsingTsx(TargetAddress))
            {
                //
                // Address is not valid
                //
                return FALSE;
            }
        }
    }
    else
    {
        //
        // *** processor doesn't support RTM ***
        //
 
        //
        // There is no way to perform this check! The below implementation doesn't satisfy
        // our needs for address checks, but we're not trying to ask kernel about it as
        // HyperDbg's script engine is not designed to be ran these functions in user-mode
        // so we left it unimplemented to avoid crashes in the main program
        //
        return FALSE;
 
        //
        // Check if memory is safe and present
        //
 
        UINT64 AddressToCheck =
            (CHAR *)TargetAddress + Size - ((CHAR *)PAGE_ALIGN(TargetAddress));
 
        if (AddressToCheck > PAGE_SIZE)
        {
            //
            // Address should be accessed in more than one page
            //
            UINT32 ReadSize = 0;
 
            while (Size != 0)
            {
                ReadSize = (UINT32)((UINT64)PAGE_ALIGN(TargetAddress + PAGE_SIZE) - TargetAddress);
 
                if (ReadSize == PAGE_SIZE && Size < PAGE_SIZE)
                {
                    ReadSize = Size;
                }
 
                try
                {
                    UINT64 ReadingTest = *((UINT64 *)TargetAddress);
                }
                catch (...)
                {
                    //
                    // Address is not valid
                    //
                    return FALSE;
                }
 
                /*
                ShowMessages("Addr From : %llx to Addr To : %llx | ReadSize : %llx\n",
                             TargetAddress,
                             TargetAddress + ReadSize,
                             ReadSize);
                */
 
                //
                // Apply the changes to the next addresses (if any)
                //
                Size          = Size - ReadSize;
                TargetAddress = TargetAddress + ReadSize;
            }
        }
        else
        {
            try
            {
                UINT64 ReadingTest = *((UINT64 *)TargetAddress);
            }
            catch (...)
            {
                //
                // Address is not valid
                //
                return FALSE;
            }
        }
    }
 
    //
    // If we've reached here, the address was valid
    //
    return TRUE;
}

◆ CheckAddressCanonicality()

BOOLEAN CheckAddressCanonicality	(	UINT64	VAddr,
		PBOOLEAN	IsKernelAddress )

Checks if the address is canonical based on x86 processor's virtual address width or not.

Parameters

VAddr	virtual address to check
IsKernelAddress	Filled to show whether the address is a kernel address or user-address

IsKernelAddress wouldn't check for page attributes, it just checks the address convention in Windows

Returns: BOOLEAN

{
    UINT64 Addr = (UINT64)VAddr;
    UINT64 MaxVirtualAddrLowHalf, MinVirtualAddressHighHalf;
 
    //
    // Get processor's address width for VA
    //
    UINT32 AddrWidth = g_VirtualAddressWidth;
 
    //
    // get max address in lower-half canonical addr space
    // e.g. if width is 48, then 0x00007FFF_FFFFFFFF
    //
    MaxVirtualAddrLowHalf = ((UINT64)1ull << (AddrWidth - 1)) - 1;
 
    //
    // get min address in higher-half canonical addr space
    // e.g., if width is 48, then 0xFFFF8000_00000000
    //
    MinVirtualAddressHighHalf = ~MaxVirtualAddrLowHalf;
 
    //
    // Check to see if the address in a canonical address
    //
    if ((Addr > MaxVirtualAddrLowHalf) && (Addr < MinVirtualAddressHighHalf))
    {
        *IsKernelAddress = FALSE;
        return FALSE;
    }
 
    //
    // Set whether it's a kernel address or not
    //
    if (MinVirtualAddressHighHalf < Addr)
    {
        *IsKernelAddress = TRUE;
    }
    else
    {
        *IsKernelAddress = FALSE;
    }
 
    return TRUE;
}

◆ CheckAddressValidityUsingTsx()

BOOLEAN CheckAddressValidityUsingTsx ( UINT64 Address )

This function checks whether the address is valid or not using Intel TSX.

Parameters

Address	Address to check
UINT32	ProcId

Returns: BOOLEAN Returns true if the address is valid; otherwise, false

{
    UINT32  Status = 0;
    BOOLEAN Result = FALSE;
    CHAR    TempContent;
 
    if ((Status = _xbegin()) == _XBEGIN_STARTED)
    {
        //
        // Try to read the memory
        //
        TempContent = *(CHAR *)Address;
        _xend();
 
        //
        // No error, address is valid
        //
        Result = TRUE;
    }
    else
    {
        //
        // Address is not valid, it aborts the tsx rtm
        //
        Result = FALSE;
    }
 
    return Result;
}

◆ CheckCpuSupportRtm()

BOOLEAN CheckCpuSupportRtm ( )

Check whether the processor supports RTM or not.

Returns: BOOLEAN

{
    int     Regs1[4];
    int     Regs2[4];
    BOOLEAN Result;
 
    //
    // TSX is controlled via MSR_IA32_TSX_CTRL.  However, support for this
    // MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
    //
    // TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
    // microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
    // bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
    // MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
    // tsx= cmdline requests will do nothing on CPUs without
    // MSR_IA32_TSX_CTRL support.
    //
 
    CommonCpuidInstruction(0, 0, Regs1);
    CommonCpuidInstruction(7, 0, Regs2);
 
    //
    // Check RTM and MPX extensions in order to filter out TSX on Haswell CPUs
    //
    Result = Regs1[0] >= 0x7 && (Regs2[1] & 0x4800) == 0x4800;
 
    return Result;
}

◆ CommonCpuidInstruction()

VOID CommonCpuidInstruction	(	UINT32	Func,
		UINT32	SubFunc,
		int *	CpuInfo )

Get cpuid results.

Parameters

UINT32	Func
UINT32	SubFunc
int	* CpuInfo

Returns: VOID

{
    __cpuidex(CpuInfo, Func, SubFunc);
}

◆ ConvertStringToUInt32()

BOOLEAN ConvertStringToUInt32	(	string	TextToConvert,
		PUINT32	Result )

check and convert string to a 32 bit unsigned it and also check for special notations like 0x etc.

Parameters

TextToConvert	the target string
Result	result will be save to the pointer

Returns: BOOLEAN shows whether the conversion was successful or not

{
    BOOLEAN IsDecimal = FALSE; // By default everything is hex
 
    if (TextToConvert.rfind("0x", 0) == 0 || TextToConvert.rfind("0X", 0) == 0 ||
        TextToConvert.rfind("\\x", 0) == 0 ||
        TextToConvert.rfind("\\X", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
    }
    else if (TextToConvert.rfind('x', 0) == 0 ||
             TextToConvert.rfind('X', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
    }
    else if (TextToConvert.rfind("0n", 0) == 0 || TextToConvert.rfind("0N", 0) == 0 ||
             TextToConvert.rfind("\\n", 0) == 0 ||
             TextToConvert.rfind("\\N", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
        IsDecimal     = TRUE;
    }
    else if (TextToConvert.rfind('n', 0) == 0 ||
             TextToConvert.rfind('N', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
        IsDecimal     = TRUE;
    }
 
    TextToConvert.erase(remove(TextToConvert.begin(), TextToConvert.end(), '`'),
                        TextToConvert.end());
 
    if (IsDecimal)
    {
        if (!IsDecimalNotation(TextToConvert))
        {
            return FALSE;
        }
        else
        {
            try
            {
                int i   = std::stoi(TextToConvert);
                *Result = i;
                return TRUE;
            }
            catch (std::invalid_argument const &)
            {
                //
                // Bad input: std::invalid_argument thrown
                //
                return FALSE;
            }
            catch (std::out_of_range const &)
            {
                //
                // Integer overflow: std::out_of_range thrown
                //
                return FALSE;
            }
 
            return FALSE;
        }
    }
    else
    {
        //
        // It's not decimal
        //
        if (!IsHexNotation(TextToConvert))
        {
            return FALSE;
        }
        else
        {
            //
            // It's hex number
            //
            UINT32 TempResult;
            TempResult = stoi(TextToConvert, nullptr, 16);
 
            //
            // Apply the results
            //
            *Result = TempResult;
 
            return TRUE;
        }
    }
}

◆ ConvertStringToUInt64()

BOOLEAN ConvertStringToUInt64	(	string	TextToConvert,
		PUINT64	Result )

check and convert string to a 64 bit unsigned integer and also check for special notations like 0x, 0n, etc.

Parameters

TextToConvert	the target string
Result	result will be save to the pointer

Returns: BOOLEAN shows whether the conversion was successful or not

{
    BOOLEAN IsDecimal = FALSE; // By default everything is hex
 
    if (TextToConvert.rfind("0x", 0) == 0 || TextToConvert.rfind("0X", 0) == 0 ||
        TextToConvert.rfind("\\x", 0) == 0 ||
        TextToConvert.rfind("\\X", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
    }
    else if (TextToConvert.rfind('x', 0) == 0 ||
             TextToConvert.rfind('X', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
    }
    else if (TextToConvert.rfind("0n", 0) == 0 || TextToConvert.rfind("0N", 0) == 0 ||
             TextToConvert.rfind("\\n", 0) == 0 ||
             TextToConvert.rfind("\\N", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
        IsDecimal     = TRUE;
    }
    else if (TextToConvert.rfind('n', 0) == 0 ||
             TextToConvert.rfind('N', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
        IsDecimal     = TRUE;
    }
 
    //
    // Remove '`' (if any)
    //
    TextToConvert.erase(remove(TextToConvert.begin(), TextToConvert.end(), '`'),
                        TextToConvert.end());
 
    if (IsDecimal)
    {
        if (!IsDecimalNotation(TextToConvert))
        {
            //
            // Not decimal
            //
            return FALSE;
        }
        else
        {
            errno                                 = 0;
            char *                       unparsed = NULL;
            const char *                 s        = TextToConvert.c_str();
            const unsigned long long int n        = strtoull(s, &unparsed, 10);
 
            if (errno || (!n && s == unparsed))
            {
                // fflush(stdout);
                // perror(s);
                return FALSE;
            }
 
            *Result = n;
            return TRUE;
        }
    }
    else
    {
        //
        // It's not decimal
        //
        if (!IsHexNotation(TextToConvert))
        {
            //
            // Not decimal and not hex!
            //
            return FALSE;
        }
        else
        {
            //
            // It's a hex number
            //
            const char * Text         = TextToConvert.c_str();
            errno                     = 0;
            unsigned long long result = strtoull(Text, NULL, 16);
 
            *Result = result;
 
            if (errno == EINVAL)
            {
                return FALSE;
            }
            else if (errno == ERANGE)
            {
                return TRUE;
            }
 
            return TRUE;
        }
    }
}

◆ ConvertStringVectorToCharPointerArray()

char * ConvertStringVectorToCharPointerArray ( const std::string & s )

Convert vector<string> to char*.

use it like : std::transform(vs.begin(), vs.end(), std::back_inserter(vc), ConvertStringVectorToCharPointerArray); from: https://stackoverflow.com/questions/7048888/stdvectorstdstring-to-char-array

Parameters

Input
ToSearch
Pos

Returns: size_t

{
    char * pc = new char[s.size() + 1];
    std::strcpy(pc, s.c_str());
    return pc;
}

◆ FindCaseInsensitive()

size_t FindCaseInsensitive	(	std::string	Input,
		std::string	ToSearch,
		size_t	Pos )

Find case insensitive sub string in a given substring.

Parameters

Input
ToSearch
Pos

Returns: size_t

{
    // Convert complete given String to lower case
    std::transform(Input.begin(), Input.end(), Input.begin(), ::tolower);
    // Convert complete given Sub String to lower case
    std::transform(ToSearch.begin(), ToSearch.end(), ToSearch.begin(), ::tolower);
    // Find sub string in given string
    return Input.find(ToSearch, Pos);
}

◆ FindCaseInsensitiveW()

size_t FindCaseInsensitiveW	(	std::wstring	Input,
		std::wstring	ToSearch,
		size_t	Pos )

Find case insensitive sub string in a given substring (unicode)

Parameters

Input
ToSearch
Pos

Returns: size_t

{
    // Convert complete given String to lower case
    std::transform(Input.begin(), Input.end(), Input.begin(), ::tolower);
    // Convert complete given Sub String to lower case
    std::transform(ToSearch.begin(), ToSearch.end(), ToSearch.begin(), ::tolower);
    // Find sub string in given string
    return Input.find(ToSearch, Pos);
}

◆ GetConfigFilePath()

VOID GetConfigFilePath ( PWCHAR ConfigPath )

Get config path.

Parameters

ConfigPath

{
    WCHAR CurrentPath[MAX_PATH] = {0};
 
    //
    // Get path file of current exe
    //
    GetModuleFileNameW(NULL, CurrentPath, MAX_PATH);
 
    //
    // Remove exe file name
    //
    PathRemoveFileSpecW(CurrentPath);
 
    //
    // Combine current exe path with config file name
    //
    PathCombineW(ConfigPath, CurrentPath, CONFIG_FILE_NAME);
}

◆ Getx86VirtualAddressWidth()

UINT32 Getx86VirtualAddressWidth ( )

Get virtual address width for x86 processors.

Returns: UINT32

{
    int Regs[4];
 
    CommonCpuidInstruction(CPUID_ADDR_WIDTH, 0, Regs);
 
    //
    // Extracting bit 15:8 from eax register
    //
    return ((Regs[0] >> 8) & 0x0ff);
}

◆ HasEnding()

BOOLEAN HasEnding	(	string const &	fullString,
		string const &	ending )

checks whether the string ends with a special string or not

Parameters

fullString
ending

Returns: BOOLEAN if true then it shows that string ends with another string and if false then it shows that this string is not ended with the target string

{
    if (fullString.length() >= ending.length())
    {
        return (0 == fullString.compare(fullString.length() - ending.length(),
                                        ending.length(),
                                        ending));
    }
    else
    {
        return FALSE;
    }
}

◆ HexToBytes()

vector< char > HexToBytes ( const string & hex )

converts hex to bytes

Parameters

hex

Returns: vector<char>

{
    vector<char> Bytes;
 
    for (unsigned int i = 0; i < hex.length(); i += 2)
    {
        std::string byteString = hex.substr(i, 2);
        char        byte       = (char)strtol(byteString.c_str(), NULL, 16);
        Bytes.push_back(byte);
    }
 
    return Bytes;
}

◆ IsDecimalNotation()

BOOLEAN IsDecimalNotation ( const string & s )

check whether the string is decimal or not

Parameters

s

Returns: BOOLEAN

{
    BOOLEAN IsAnyThing = FALSE;
 
    for (auto & CptrChar : s)
    {
        IsAnyThing = TRUE;
 
        if (!isdigit(CptrChar))
        {
            return FALSE;
        }
    }
    if (IsAnyThing)
    {
        return TRUE;
    }
    return FALSE;
}

◆ IsEmptyString()

BOOLEAN IsEmptyString ( char * Text )

Is empty character.

Parameters

Text

{
    size_t Len;
 
    if (Text == NULL || Text[0] == '\0')
    {
        return TRUE;
    }
 
    Len = strlen(Text);
    for (size_t i = 0; i < Len; i++)
    {
        if (Text[i] != ' ' && Text[i] != '\t' && Text[i] != '\n')
        {
            return FALSE;
        }
    }
 
    return TRUE;
}

◆ IsFileExistA()

BOOLEAN IsFileExistA ( const char * FileName )

check if a file exist or not (ASCII)

Parameters

FileName path of file

Returns: BOOLEAN shows whether the file exist or not

{
    struct stat buffer;
    return (stat(FileName, &buffer) == 0);
}

◆ IsFileExistW()

BOOLEAN IsFileExistW ( const wchar_t * FileName )

check if a file exist or not (wide-char)

Parameters

FileName path of file

Returns: BOOLEAN shows whether the file exist or not

{
    struct _stat64i32 buffer;
    return (_wstat(FileName, &buffer) == 0);
}

◆ IsHexNotation()

BOOLEAN IsHexNotation ( const string & s )

check whether the string is hex or not

Parameters

s

Returns: BOOLEAN

{
    BOOLEAN IsAnyThing = FALSE;
 
    for (auto & CptrChar : s)
    {
        IsAnyThing = TRUE;
 
        if (!isxdigit(CptrChar))
        {
            return FALSE;
        }
    }
    if (IsAnyThing)
    {
        return TRUE;
    }
    return FALSE;
}

◆ IsNumber()

BOOLEAN IsNumber ( const string & str )

check if given string is a numeric string or not

Parameters

str

Returns: BOOLEAN

{
    //
    // std::find_first_not_of searches the string for the first character
    // that does not match any of the characters specified in its arguments
    //
    return !str.empty() &&
           (str.find_first_not_of("[0123456789]") == std::string::npos);
}

◆ ListDirectory()

std::vector< std::string > ListDirectory	(	const std::string &	Directory,
		const std::string &	Extension )

Create a list of special files in a directory.

Parameters

Directory
Extension

Returns: std::vector<std::string>

{
    WIN32_FIND_DATAA         FindData;
    HANDLE                   Find     = INVALID_HANDLE_VALUE;
    std::string              FullPath = Directory + "\\" + Extension;
    std::vector<std::string> DirList;
 
    Find = FindFirstFileA(FullPath.c_str(), &FindData);
 
    if (Find == INVALID_HANDLE_VALUE)
        throw std::runtime_error("invalid handle value! please check your path...");
 
    while (FindNextFileA(Find, &FindData) != 0)
    {
        DirList.push_back(Directory + "\\" + std::string(FindData.cFileName));
    }
 
    FindClose(Find);
 
    return DirList;
}

◆ Log2Ceil()

UINT32 Log2Ceil ( UINT32 n )

Function to compute log2Ceil.

Parameters

n

Returns: UINT32

{
    if (n == 0)
        return 0; // log2Ceil(0) is undefined, returning 0 for safety.
 
    n--; // Decrease by 1 to check if it is a power of 2
    UINT32 log2Floor = 0;
    while (n >>= 1)
    {
        log2Floor++;
    }
    return log2Floor + 1;
}

◆ PrintBits()

VOID PrintBits	(	const UINT32	Size,
		const void *	Ptr )

print bits and bytes for d* commands

Parameters

Size
Ptr

Returns: VOID

{
    unsigned char * Buf = (unsigned char *)Ptr;
    unsigned char   Byte;
    int             i, j;
 
    for (i = Size - 1; i >= 0; i--)
    {
        for (j = 7; j >= 0; j--)
        {
            Byte = (Buf[i] >> j) & 1;
            ShowMessages("%u", Byte);
        }
        ShowMessages(" ", Byte);
    }
}

◆ RemoveSpaces()

std::string RemoveSpaces ( std::string str )

Remove all the spaces in a string.

Parameters

str

{
    str.erase(remove(str.begin(), str.end(), ' '), str.end());
    return str;
}

◆ Replace()

BOOL Replace	(	std::string &	str,
		const std::string &	from,
		const std::string &	to )

general replace all function

Parameters

str
from
to

Returns: VOID

{
    size_t start_pos = str.find(from);
    if (start_pos == std::string::npos)
        return FALSE;
    str.replace(start_pos, from.size(), to);
    return TRUE;
}

◆ ReplaceAll()

VOID ReplaceAll	(	string &	str,
		const string &	from,
		const string &	to )

general replace all function

Parameters

str
from
to

Returns: VOID

{
    size_t SartPos = 0;
 
    if (from.empty())
        return;
 
    while ((SartPos = str.find(from, SartPos)) != std::string::npos)
    {
        str.replace(SartPos, from.length(), to);
        //
        // In case 'to' contains 'from', like replacing
        // 'x' with 'yx'
        //
        SartPos += to.length();
    }
}

◆ SeparateTo64BitValue()

string SeparateTo64BitValue ( UINT64 Value )

add ` between 64 bit values and convert them to string

Parameters

Value

Returns: string

{
    ostringstream OstringStream;
    string        Temp;
 
    OstringStream << setw(16) << setfill('0') << hex << Value;
    Temp = OstringStream.str();
 
    Temp.insert(8, 1, '`');
    return Temp;
}

◆ SetPrivilege()

BOOL SetPrivilege	(	HANDLE	Token,
		LPCTSTR	Privilege,
		BOOL	EnablePrivilege )

SetPrivilege enables/disables process token privilege.

Parameters

Token
Privilege
EnablePrivilege

Returns: BOOL

{
    TOKEN_PRIVILEGES Tp;
    LUID             Luid;
 
    if (!LookupPrivilegeValue(NULL,      // lookup privilege on local system
                              Privilege, // privilege to lookup
                              &Luid))    // receives LUID of privilege
    {
        ShowMessages("err, in LookupPrivilegeValue (%x)\n", GetLastError());
        return FALSE;
    }
 
    Tp.PrivilegeCount     = 1;
    Tp.Privileges[0].Luid = Luid;
    if (EnablePrivilege)
        Tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        Tp.Privileges[0].Attributes = 0;
 
    //
    // Enable the privilege or disable all privileges.
    //
    if (!AdjustTokenPrivileges(Token, FALSE, &Tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL))
    {
        ShowMessages("err, in AdjustTokenPrivileges (%x)\n", GetLastError());
        return FALSE;
    }
 
    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
    {
        ShowMessages("err, the token does not have the specified privilege (ACCESS DENIED!)\n");
        ShowMessages("make sure to run it with administrator privileges\n");
        return FALSE;
    }
 
    return TRUE;
}

◆ Split()

const vector< string > Split	(	const string &	s,
		const char &	c )

general split command

Parameters

s	target string
c	splitter (delimiter)

Returns: const vector<string>

{
    string         buff {""};
    vector<string> v;
 
    for (auto n : s)
    {
        if (n != c)
            buff += n;
        else if (n == c && !buff.empty())
        {
            v.push_back(buff);
            buff.clear();
        }
    }
    if (!buff.empty())
        v.push_back(buff);
 
    return v;
}

◆ SplitPathAndArgs()

VOID SplitPathAndArgs	(	std::vector< std::string > &	Qargs,
		const std::string &	Command )

Split path and arguments and handle strings between quotes.

Parameters

Qargs
Command

Returns: VOID

{
    int  Len = (int)Command.length();
    bool Qot = false, Sqot = false;
    int  ArgLen;
 
    for (int i = 0; i < Len; i++)
    {
        int start = i;
        if (Command[i] == '\"')
        {
            Qot = true;
        }
        else if (Command[i] == '\'')
            Sqot = true;
 
        if (Qot)
        {
            i++;
            start++;
            while (i < Len && Command[i] != '\"')
                i++;
            if (i < Len)
                Qot = false;
            ArgLen = i - start;
            i++;
        }
        else if (Sqot)
        {
            i++;
            while (i < Len && Command[i] != '\'')
                i++;
            if (i < Len)
                Sqot = false;
            ArgLen = i - start;
            i++;
        }
        else
        {
            while (i < Len && Command[i] != ' ')
                i++;
            ArgLen = i - start;
        }
 
        string Temp = Command.substr(start, ArgLen);
        if (!Temp.empty() && Temp != " ")
        {
            Qargs.push_back(Temp);
        }
    }
 
    /*
    for (int i = 0; i < Qargs.size(); i++)
    {
        std::cout << Qargs[i] << std::endl;
    }
 
    std::cout << Qargs.size();
 
    if (Qot || Sqot)
        std::cout << "One of the quotes is open\n";
    */
}

◆ StringToWString()

VOID StringToWString	(	std::wstring &	ws,
		const std::string &	s )

convert std::string to std::wstring

Parameters

ws
s

Returns: VOID

{
    std::wstring WsTmp(s.begin(), s.end());
 
    ws = WsTmp;
}

◆ Trim()

void Trim ( std::string & s )

trim from both ends and start of a string (in place)

Parameters

s

{
    ltrim(s);
    rtrim(s);
}

◆ ValidateIP()

BOOLEAN ValidateIP ( const string & ip )

Function to validate an IP address.

Parameters

ip

Returns: BOOLEAN

{
    //
    // split the string into tokens
    //
    vector<string> list = Split(ip, '.');
 
    //
    // if token size is not equal to four
    //
    if (list.size() != 4)
        return FALSE;
 
    //
    // validate each token
    //
    for (string str : list)
    {
        //
        // verify that string is number or not and the numbers
        // are in the valid range
        //
        if (!IsNumber(str) || stoi(str) > 255 || stoi(str) < 0)
            return FALSE;
    }
 
    return TRUE;
}

◆ VmxSupportDetection()

BOOLEAN VmxSupportDetection ( )

Detect whether the VMX is supported or not.

Returns: true if vmx is supported; false if vmx is not supported

{
    //
    // Call assembly function
    //
    return AsmVmxSupportDetection();
}

Variable Documentation

◆ g_RtmSupport

BOOLEAN g_RtmSupport

extern

check for RTM support

◆ g_VirtualAddressWidth

UINT32 g_VirtualAddressWidth

extern

Virtual address width for x86 processors.

Functions

Variables

Detailed Description

Function Documentation

◆ CheckAccessValidityAndSafety()

◆ CheckAddressCanonicality()

◆ CheckAddressValidityUsingTsx()

◆ CheckCpuSupportRtm()

◆ CommonCpuidInstruction()

◆ ConvertStringToUInt32()

◆ ConvertStringToUInt64()

◆ ConvertStringVectorToCharPointerArray()

◆ FindCaseInsensitive()

◆ FindCaseInsensitiveW()

◆ GetConfigFilePath()

◆ Getx86VirtualAddressWidth()

◆ HasEnding()

◆ HexToBytes()

◆ IsDecimalNotation()

◆ IsEmptyString()

◆ IsFileExistA()

◆ IsFileExistW()

◆ IsHexNotation()

◆ IsNumber()

◆ ListDirectory()

◆ Log2Ceil()

◆ PrintBits()

◆ RemoveSpaces()

◆ Replace()

◆ ReplaceAll()

◆ SeparateTo64BitValue()

◆ SetPrivilege()

◆ Split()

◆ SplitPathAndArgs()

◆ StringToWString()

◆ Trim()

◆ ValidateIP()

◆ VmxSupportDetection()

Variable Documentation

◆ g_RtmSupport

◆ g_VirtualAddressWidth