debugger.cpp File Reference

Interpret general fields. More...

#include "pch.h"

Functions
BOOLEAN	ShowErrorMessage (UINT32 Error)
	shows the error message
UINT64	DebuggerGetNtoskrnlBase ()
	Get ntoskrnl.exe base in the kernel.
UINT64	DebuggerGetKernelBase ()
	Get the base address of the kernel module.
BOOLEAN	DebuggerPauseDebuggee ()
	pauses the debuggee
BOOLEAN	IsConnectedToAnyInstanceOfDebuggerOrDebuggee ()
	Shows whether the debugger is connected to a debugger or debuggee connected to a debugger.
BOOLEAN	IsTagExist (UINT64 Tag)
	Check whether the tag exists or not, if the tag is DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG then if we find just one event, it also means that the tag is found.
BOOLEAN	InterpretScript (vector< CommandToken > *CommandTokens, PBOOLEAN ScriptSyntaxErrors, PUINT64 BufferAddress, PUINT32 BufferLength, PUINT32 Pointer, PUINT64 ScriptCodeBuffer)
	Interpret script (if an event has script).
BOOLEAN	InterpretConditionsAndCodes (vector< CommandToken > *CommandTokens, BOOLEAN IsConditionBuffer, PUINT64 BufferAddress, PUINT32 BufferLength)
	Interpret conditions (if an event has condition) and custom code.
BOOLEAN	InterpretOutput (vector< CommandToken > *CommandTokens, vector< string > &InputSources)
	Interpret output (if an event has special output).
BOOLEAN	SendEventToKernel (PDEBUGGER_GENERAL_EVENT_DETAIL Event, UINT32 EventBufferLength)
	Register the event to the kernel.
BOOLEAN	RegisterActionToEvent (PDEBUGGER_GENERAL_EVENT_DETAIL Event, PDEBUGGER_GENERAL_ACTION ActionBreakToDebugger, UINT32 ActionBreakToDebuggerLength, PDEBUGGER_GENERAL_ACTION ActionCustomCode, UINT32 ActionCustomCodeLength, PDEBUGGER_GENERAL_ACTION ActionScript, UINT32 ActionScriptLength)
	Register the action to the event.
UINT64	GetNewDebuggerEventTag ()
	Get the New Debugger Event Tag object and increase the global variable for tag.
VOID	FreeEventsAndActionsMemory (PDEBUGGER_GENERAL_EVENT_DETAIL Event, PDEBUGGER_GENERAL_ACTION ActionBreakToDebugger, PDEBUGGER_GENERAL_ACTION ActionCustomCode, PDEBUGGER_GENERAL_ACTION ActionScript)
	Deallocate buffers relating to events and actions.
BOOLEAN	InterpretGeneralEventAndActionsFields (vector< CommandToken > *CommandTokens, VMM_EVENT_TYPE_ENUM EventType, PDEBUGGER_GENERAL_EVENT_DETAIL *EventDetailsToFill, PUINT32 EventBufferLength, PDEBUGGER_GENERAL_ACTION *ActionDetailsToFillBreakToDebugger, PUINT32 ActionBufferLengthBreakToDebugger, PDEBUGGER_GENERAL_ACTION *ActionDetailsToFillCustomCode, PUINT32 ActionBufferLengthCustomCode, PDEBUGGER_GENERAL_ACTION *ActionDetailsToFillScript, PUINT32 ActionBufferLengthScript, PDEBUGGER_EVENT_PARSING_ERROR_CAUSE ReasonForErrorInParsing)
	Interpret general event fields.

Variables
UINT64	g_EventTag
	This variable holds the trace and generate numbers for new tags of events.
UINT64	g_KernelBaseAddress
	Shows the kernel base address.
LIST_ENTRY	g_EventTrace
	Holds a list of events in kernel and the state of events and the commands to show the state of each command (disabled/enabled).
BOOLEAN	g_EventTraceInitialized
	it shows whether the debugger started using events or not or in other words, is g_EventTrace initialized with a variable or it is empty
BOOLEAN	g_BreakPrintingOutput
	Shows whether the pause command or CTRL+C or CTRL+Break is executed or not.
BOOLEAN	g_AutoUnpause
	Whether auto-unpause mode is enabled or not enabled.
BOOLEAN	g_OutputSourcesInitialized
	it shows whether the debugger started using output sources or not or in other words, is g_OutputSources initialized with a variable or it is empty
LIST_ENTRY	g_OutputSources
	Holds a list of output sources created by output command.
BOOLEAN	g_IsConnectedToRemoteDebuggee
	Shows whether the current debugger is the host and connected to a remote debuggee (guest).
BOOLEAN	g_IsConnectedToRemoteDebugger
	Shows whether the current system is a guest (debuggee) and a remote debugger is connected to this system.
BOOLEAN	g_IsSerialConnectedToRemoteDebuggee
	Shows if the debugger was connected to remote debuggee over (A remote guest).
BOOLEAN	g_IsSerialConnectedToRemoteDebugger
	Shows if the debugger was connected to remote debugger (A remote host).
BOOLEAN	g_IsKdModuleLoaded
	shows whether the kernel debugger (KD) module is loaded or not
BOOLEAN	g_IsVmmModuleLoaded
	shows whether the VMM module is loaded or not
ACTIVE_DEBUGGING_PROCESS	g_ActiveProcessDebuggingState
	State of active debugging thread.

Detailed Description

Interpret general fields.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-05-27

Copyright

This project is released under the GNU Public License v3.

Function Documentation

DebuggerGetKernelBase()

UINT64 DebuggerGetKernelBase

(

)

Get the base address of the kernel module.

Returns

UINT64

{
    UINT64 KernelBase = NULL;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        KernelBase = g_KernelBaseAddress;
    }
    else
    {
        KernelBase          = DebuggerGetNtoskrnlBase();
        g_KernelBaseAddress = KernelBase;
    }
 
    return KernelBase;
}

DebuggerGetNtoskrnlBase()

UINT64 DebuggerGetNtoskrnlBase

(

)

Get ntoskrnl.exe base in the kernel.

Returns

UINT64 Base address of ntoskrnl.exe

{
#ifdef _WIN32
    UINT64               NtoskrnlBase = NULL;
    PRTL_PROCESS_MODULES Modules      = NULL;
 
    if (SymbolCheckAndAllocateModuleInformation(&Modules) == FALSE)
    {
        ShowMessages("err, unable to get the module list for getting ntoskrnl base address\n");
        return NULL64_ZERO;
    }
 
    for (UINT32 i = 0; i < Modules->NumberOfModules; i++)
    {
        if (!strcmp((const CHAR *)Modules->Modules[i].FullPathName + Modules->Modules[i].OffsetToFileName,
                    "ntoskrnl.exe"))
        {
            NtoskrnlBase = (UINT64)Modules->Modules[i].ImageBase;
            break;
        }
    }
 
    free(Modules);
 
    return NtoskrnlBase;
#else
    //
    // TODO(Linux): NT-style system module enumeration (PRTL_PROCESS_MODULES via
    // NtQuerySystemInformation) has no Linux analog. The kernel-module base lookup
    // will need a Linux-specific mechanism once the kernel side exists.
    //
    return NULL64_ZERO;
#endif
}

DebuggerPauseDebuggee()

BOOLEAN DebuggerPauseDebuggee

(

)

pauses the debuggee

Returns

BOOLEAN shows whether the pause was successful or not, if successful then when it returns true the debuggee is not paused anymore (continued)

{
    BOOLEAN                        StatusIoctl    = 0;
    ULONG                          ReturnedLength = 0;
    DEBUGGER_PAUSE_PACKET_RECEIVED PauseRequest   = {0};
 
    //
    // Send a pause IOCTL
    //
    StatusIoctl = PlatformDeviceIoControl(g_DeviceHandle,                        // Handle to device
                                  IOCTL_PAUSE_PACKET_RECEIVED,           // IO Control Code (IOCTL)
                                  &PauseRequest,                         // Input Buffer to driver.
                                  SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED, // Input buffer
                                                                         // length
                                  &PauseRequest,                         // Output Buffer from driver.
                                  SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED, // Length of output
                                                                         // buffer in bytes.
                                  &ReturnedLength,                       // Bytes placed in buffer.
                                  NULL                                   // synchronous call
    );
 
    if (!StatusIoctl)
    {
        ShowMessages("ioctl failed with code 0x%x\n", PlatformGetLastError());
        return FALSE;
    }
 
    if (PauseRequest.Result == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        //
        // Nothing to show, the request was successfully processed
        //
        return TRUE;
    }
    else
    {
        ShowErrorMessage(PauseRequest.Result);
        return FALSE;
    }
    return FALSE;
}

FreeEventsAndActionsMemory()

VOID FreeEventsAndActionsMemory	(	PDEBUGGER_GENERAL_EVENT_DETAIL	Event,
		PDEBUGGER_GENERAL_ACTION	ActionBreakToDebugger,
		PDEBUGGER_GENERAL_ACTION	ActionCustomCode,
		PDEBUGGER_GENERAL_ACTION	ActionScript )

Deallocate buffers relating to events and actions.

Parameters

return VOID

{
    if (Event != NULL)
    {
        if (Event->CommandStringBuffer != NULL)
        {
            free(Event->CommandStringBuffer);
        }
 
        free(Event);
    }
 
    if (ActionBreakToDebugger != NULL)
    {
        free(ActionBreakToDebugger);
    }
    if (ActionCustomCode != NULL)
    {
        free(ActionCustomCode);
    }
    if (ActionScript != NULL)
    {
        free(ActionScript);
    }
}

GetNewDebuggerEventTag()

UINT64 GetNewDebuggerEventTag

(

)

Get the New Debugger Event Tag object and increase the global variable for tag.

Returns

UINT64

{
    return g_EventTag++;
}

InterpretConditionsAndCodes()

BOOLEAN InterpretConditionsAndCodes	(	vector< CommandToken > *	CommandTokens,
		BOOLEAN	IsConditionBuffer,
		PUINT64	BufferAddress,
		PUINT32	BufferLength )

Interpret conditions (if an event has condition) and custom code.

If this function returns true then it means that there is a condition or code buffer in this command split and the details are returned in the input structure

Parameters

CommandTokens	command tokens
IsConditionBuffer	is it a condition buffer or a custom code buffer
BufferAddress	the address that the allocated buffer will be saved on it
BufferLength	the length of the buffer

Returns

BOOLEAN shows whether the interpret was successful (true) or not successful (false)

{
    BOOLEAN IsAsm               = FALSE;
    BOOLEAN IsTextVisited       = FALSE;
    string  TargetBracketString = "";
 
    string       Temp;
    vector<CHAR> ParsedBytes;
    vector<INT>  IndexesToRemove;
    UCHAR *      FinalBuffer;
    UINT32       AssembledByteCount;
    INT          NewIndexToRemove = 0;
    INT          Index            = 0;
 
    for (auto Section : *CommandTokens)
    {
        Index++;
 
        if (IsTextVisited && IsTokenBracketString(Section))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            //
            // Fill the bracket string
            //
            TargetBracketString = GetCaseSensitiveStringFromCommandToken(Section);
 
            IsTextVisited = FALSE;
            continue;
        }
 
        if (!IsConditionBuffer && CompareLowerCaseStrings(Section, "code"))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            IsTextVisited = TRUE;
            continue;
        }
 
        if (IsConditionBuffer && CompareLowerCaseStrings(Section, "condition"))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            IsTextVisited = TRUE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "asm"))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            IsAsm = TRUE;
            continue;
        }
    }
 
    //
    // Now we have everything in condition/code buffer
    // Check to see if it is empty or not
    //
    if (TargetBracketString.length() == 0)
    {
        //
        // Nothing in condition buffer, return zero
        //
        return FALSE;
    }
 
    //
    // Check if asm code was provided instead of hex
    //
    if (IsAsm)
    {
        AssembleData AssembleData;
        AssembleData.AsmRaw = TargetBracketString; // by now, it should only have one element
        AssembleData.ParseAssemblyData();
 
        //
        // Append a 'ret' at the end of asm code
        //
        AssembleData.AsmFixed += "; ret";
 
        if (AssembleData.Assemble(0)) // we just want the hex bytes, so NULL instead of Start_Address
        {
            ShowMessages("err, assemble error code: '%u'\n\n", AssembleData.KsErr);
            return FALSE;
        }
        else
        {
            //
            // Get the BytesCount; for readability.
            //
            AssembledByteCount = (UINT32)AssembleData.BytesCount;
 
            //
            // * FinalBuffer *
            //
            FinalBuffer = (UCHAR *)malloc(AssembledByteCount);
 
            if (FinalBuffer == NULL)
            {
                return FALSE;
            }
 
            memcpy(FinalBuffer, AssembleData.EncodedBytes, AssembledByteCount);
 
            //
            // Set the buffer and length
            //
            *BufferAddress = (UINT64)FinalBuffer;
            *BufferLength  = AssembledByteCount;
        }
    }
    else
    {
        //
        // Append a 'ret' at the end of the buffer
        //
        TargetBracketString += "c3";
 
        //
        // If we reach here then there is sth in condition buffer
        //
 
        //
        // Check if the TargetBracketString is started with '0x'
        //
        if (TargetBracketString.rfind("0x", 0) == 0 || TargetBracketString.rfind("0X", 0) == 0 || TargetBracketString.rfind("\\x", 0) == 0 || TargetBracketString.rfind("\\X", 0) == 0)
        {
            Temp = TargetBracketString.erase(0, 2);
        }
        else if (TargetBracketString.rfind('x', 0) == 0 || TargetBracketString.rfind('X', 0) == 0)
        {
            Temp = TargetBracketString.erase(0, 1);
        }
        else
        {
            Temp = std::move(TargetBracketString);
        }
 
        //
        // replace \x s
        //
        ReplaceAll(Temp, "\\x", "");
 
        //
        // check if the buffer is aligned to 2
        //
        if (Temp.size() % 2 != 0)
        {
            //
            // Add a zero to the start of the buffer
            //
            Temp.insert(0, 1, '0');
        }
 
        if (!IsHexNotation(Temp))
        {
            ShowMessages("please enter condition code in a hex notation\n");
            return FALSE;
        }
 
        //
        // Convert it to vectored bytes
        //
        ParsedBytes = HexToBytes(Temp);
 
        //
        // Convert to a contigues buffer
        //
        FinalBuffer = (UCHAR *)malloc(ParsedBytes.size());
 
        if (FinalBuffer == NULL)
        {
            return FALSE;
        }
 
        std::copy(ParsedBytes.begin(), ParsedBytes.end(), FinalBuffer);
 
        //
        // Set the buffer and length
        //
        *BufferAddress = (UINT64)FinalBuffer;
        *BufferLength  = (UINT32)ParsedBytes.size();
    }
 
    //
    // Removing the code or condition indexes from the command
    //
    NewIndexToRemove = 0;
    for (auto IndexToRemove : IndexesToRemove)
    {
        NewIndexToRemove++;
 
        CommandTokens->erase(CommandTokens->begin() + (IndexToRemove - NewIndexToRemove));
    }
 
    return TRUE;
}

InterpretGeneralEventAndActionsFields()

BOOLEAN InterpretGeneralEventAndActionsFields	(	vector< CommandToken > *	CommandTokens,
		VMM_EVENT_TYPE_ENUM	EventType,
		PDEBUGGER_GENERAL_EVENT_DETAIL *	EventDetailsToFill,
		PUINT32	EventBufferLength,
		PDEBUGGER_GENERAL_ACTION *	ActionDetailsToFillBreakToDebugger,
		PUINT32	ActionBufferLengthBreakToDebugger,
		PDEBUGGER_GENERAL_ACTION *	ActionDetailsToFillCustomCode,
		PUINT32	ActionBufferLengthCustomCode,
		PDEBUGGER_GENERAL_ACTION *	ActionDetailsToFillScript,
		PUINT32	ActionBufferLengthScript,
		PDEBUGGER_EVENT_PARSING_ERROR_CAUSE	ReasonForErrorInParsing )

Interpret general event fields.

Parameters

CommandTokens	the command tokens
EventType	type of event
EventDetailsToFill	a pointer address that will be filled by event detail buffer
EventBufferLength	a pointer the receives the buffer length of the event
ActionDetailsToFill	a pointer address that will be filled by action detail buffer
ActionBufferLength	a pointer the receives the buffer length of the action
ReasonForErrorInParsing	reason that interpretation failed, null if the returns true

Returns

BOOLEAN If this function returns true then it means that there was no error in parsing the general event details

{
    BOOLEAN                               Result                         = FALSE;
    PDEBUGGER_GENERAL_EVENT_DETAIL        TempEvent                      = NULL;
    PDEBUGGER_GENERAL_ACTION              TempActionBreak                = NULL;
    PDEBUGGER_GENERAL_ACTION              TempActionScript               = NULL;
    PDEBUGGER_GENERAL_ACTION              TempActionCustomCode           = NULL;
    VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE CallingStage                   = VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION; // by default 'pre' event
    UINT32                                LengthOfCustomCodeActionBuffer = 0;
    UINT32                                LengthOfScriptActionBuffer     = 0;
    UINT32                                LengthOfBreakActionBuffer      = 0;
    UINT64                                ConditionBufferAddress;
    UINT32                                ConditionBufferLength = 0;
    vector<string>                        ListOfOutputSources;
    UINT64                                CodeBufferAddress;
    UINT32                                CodeBufferLength = 0;
    UINT64                                ScriptBufferAddress;
    UINT64                                ScriptCodeBuffer     = 0;
    BOOLEAN                               HasScriptSyntaxError = 0;
    UINT32                                ScriptBufferLength   = 0;
    UINT32                                ScriptBufferPointer  = 0;
    UINT32                                LengthOfEventBuffer  = 0;
    string                                CommandString;
    BOOLEAN                               IsAShortCircuitingEventByDefault = FALSE;
    BOOLEAN                               HasConditionBuffer               = FALSE;
    BOOLEAN                               HasOutputPath                    = FALSE;
    BOOLEAN                               HasCodeBuffer                    = FALSE;
    BOOLEAN                               HasScript                        = FALSE;
    BOOLEAN                               IsNextCommandPid                 = FALSE;
    BOOLEAN                               IsNextCommandCoreId              = FALSE;
    BOOLEAN                               IsNextCommandBufferSize          = FALSE;
    BOOLEAN                               IsNextCommandImmediateMessaging  = FALSE;
    BOOLEAN                               IsNextCommandExecutionStage      = FALSE;
    BOOLEAN                               IsNextCommandSc                  = FALSE;
    BOOLEAN                               ImmediateMessagePassing          = UseImmediateMessagingByDefaultOnEvents;
    UINT32                                CoreId;
    UINT32                                ProcessId;
    UINT32                                IndexOfValidSourceTags;
    UINT32                                RequestBuffer = 0;
    PLIST_ENTRY                           TempList;
    BOOLEAN                               OutputSourceFound;
    vector<INT>                           IndexesToRemove;
    vector<UINT64>                        ListOfValidSourceTags;
    INT                                   NewIndexToRemove = 0;
    INT                                   Index            = 0;
 
    //
    // Create a command string to show in the history
    //
    for (auto Section : *CommandTokens)
    {
        CommandString.append(GetCaseSensitiveStringFromCommandToken(Section));
        CommandString.append(" ");
    }
 
    //
    // Compute the size of buffer + 1 null for the end of buffer
    //
    UINT64 BufferOfCommandStringLength = CommandString.size() + 1;
 
    //
    // Allocate Buffer and zero for command to the buffer
    //
    PVOID BufferOfCommandString = malloc(BufferOfCommandStringLength);
 
    PlatformZeroMemory(BufferOfCommandString, BufferOfCommandStringLength);
 
    //
    // Copy the string to the buffer
    //
    memcpy(BufferOfCommandString, CommandString.c_str(), CommandString.size());
 
    //
    // Check if there is a condition buffer in the command
    //
    if (!InterpretConditionsAndCodes(CommandTokens, TRUE, &ConditionBufferAddress, &ConditionBufferLength))
    {
        //
        // Indicate condition is not available
        //
        HasConditionBuffer = FALSE;
 
        /* ShowMessages("\nNo condition!\n"); */
    }
    else
    {
        //
        // Indicate condition is available
        //
        HasConditionBuffer = TRUE;
 
        /*
    ShowMessages(
        "\n========================= Condition =========================\n");
 
    ShowMessages(
        "\nUINT64  DebuggerCheckForCondition(PGUEST_REGS Regs_RCX, PVOID "
        "Context_RDX)\n{\n");
 
    //
    // Disassemble the buffer
    //
    HyperDbgDisassembler64((UCHAR *)ConditionBufferAddress, 0x0,
                           ConditionBufferLength);
 
    ShowMessages("}\n\n");
 
    ShowMessages(
        "=============================================================\n");
      */
    }
 
    //
    // Check if there is a code buffer in the command
    //
    if (!InterpretConditionsAndCodes(CommandTokens, FALSE, &CodeBufferAddress, &CodeBufferLength))
    {
        //
        // Indicate code is not available
        //
        HasCodeBuffer = FALSE;
        //
        // ShowMessages("\nNo custom code!\n");
        //
    }
    else
    {
        //
        // Indicate code is available
        //
        HasCodeBuffer = TRUE;
 
        /*
    ShowMessages(
        "\n=========================    Code    =========================\n");
    ShowMessages("\nPVOID DebuggerRunCustomCodeFunc(PVOID "
                 "PreAllocatedBufferAddress_RCX, "
                 "PGUEST_REGS Regs_RDX, PVOID Context_R8)\n{\n");
 
    //
    // Disassemble the buffer
    //
    HyperDbgDisassembler64((UCHAR *)CodeBufferAddress, 0x0,
                           CodeBufferLength);
 
    ShowMessages("}\n\n");
 
    ShowMessages(
        "=============================================================\n");
        */
    }
 
    //
    // Check if there is a Script block in the command
    //
    if (!InterpretScript(CommandTokens,
                         &HasScriptSyntaxError,
                         &ScriptBufferAddress,
                         &ScriptBufferLength,
                         &ScriptBufferPointer,
                         &ScriptCodeBuffer))
    {
        //
        // Indicate code is not available
        //
        HasScript = FALSE;
        //
        // ShowMessages("\nNo script!\n");
        //
    }
    else
    {
        //
        // Check if there is a syntax error
        //
        if (HasScriptSyntaxError)
        {
            free(BufferOfCommandString);
 
            *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_SCRIPT_SYNTAX_ERROR;
            return FALSE;
        }
 
        //
        // Indicate code is available
        //
        HasScript = TRUE;
    }
 
    //
    // Check if there is a output path in the command
    //
    if (!InterpretOutput(CommandTokens, ListOfOutputSources))
    {
        //
        // Indicate output is not available
        //
        HasOutputPath = FALSE;
 
        //
        // ShowMessages("\nNo condition!\n");
        //
    }
    else
    {
        //
        // Check for empty input
        //
        if (ListOfOutputSources.size() == 0)
        {
            //
            // No input !
            //
            free(BufferOfCommandString);
 
            ShowMessages("err, no input found\n");
            *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_NO_INPUT;
            return FALSE;
        }
 
        //
        // Check whether the size exceed maximum size or not
        //
        if (ListOfOutputSources.size() > DebuggerOutputSourceMaximumRemoteSourceForSingleEvent)
        {
            free(BufferOfCommandString);
 
            ShowMessages(
                "err, based on this build of HyperDbg, the maximum input sources for "
                "a single event is 0x%x sources but you entered 0x%x sources\n",
                DebuggerOutputSourceMaximumRemoteSourceForSingleEvent,
                ListOfOutputSources.size());
            *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_MAXIMUM_INPUT_REACHED;
            return FALSE;
        }
 
        //
        // Check whether the output source initialized or not
        //
        if (!g_OutputSourcesInitialized)
        {
            free(BufferOfCommandString);
 
            ShowMessages("err, the name you entered, not found. Did you use "
                         "'output' command to create it?\n");
            *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_OUTPUT_NAME_NOT_FOUND;
            return FALSE;
        }
 
        //
        // Convert output sources to the corresponding tags
        //
        for (auto item : ListOfOutputSources)
        {
            TempList          = 0;
            OutputSourceFound = FALSE;
 
            //
            // Now we should find the corresponding object in the list
            // of output sources and save its tags
            //
            TempList = &g_OutputSources;
 
            while (&g_OutputSources != TempList->Flink)
            {
                TempList = TempList->Flink;
 
                PDEBUGGER_EVENT_FORWARDING CurrentOutputSourceDetails = CONTAINING_RECORD(TempList, DEBUGGER_EVENT_FORWARDING, OutputSourcesList);
 
                if (strcmp(CurrentOutputSourceDetails->Name,
                           RemoveSpaces(item).c_str()) == 0)
                {
                    //
                    // Check to see the source state, whether it is closed or not
                    //
                    if (CurrentOutputSourceDetails->State == EVENT_FORWARDING_CLOSED)
                    {
                        free(BufferOfCommandString);
 
                        ShowMessages("err, output source already closed\n");
                        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_OUTPUT_SOURCE_ALREADY_CLOSED;
                        return FALSE;
                    }
 
                    //
                    // Check to see the source state, whether it is opened or not
                    //
                    if (CurrentOutputSourceDetails->State == EVENT_FORWARDING_STATE_NOT_OPENED)
                    {
                        //
                        // Just show a message
                        //
                        ShowMessages("some of the output(s) are not opened, it's not an error, but please ensure "
                                     "to open the output using the 'output' command to forward the results to the "
                                     "target resource\n");
                    }
 
                    //
                    // Indicate that we found this item
                    //
                    OutputSourceFound = TRUE;
 
                    //
                    // Save the tag into a list which will be used later
                    //
                    ListOfValidSourceTags.push_back(
                        CurrentOutputSourceDetails->OutputUniqueTag);
 
                    //
                    // No need to search through the list anymore
                    //
                    break;
                }
            }
 
            if (!OutputSourceFound)
            {
                free(BufferOfCommandString);
 
                ShowMessages("err, the name you entered, not found. Did you use "
                             "'output' command to create it?\n");
                *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_OUTPUT_NAME_NOT_FOUND;
                return FALSE;
            }
        }
        //
        // Indicate output is available
        //
        HasOutputPath = TRUE;
    }
 
    //
    // Create action and event based on previously parsed buffers
    // (DEBUGGER_GENERAL_ACTION)
    //
    // Allocate the buffer (with ConditionBufferLength and CodeBufferLength)
    //
 
    /*
 
  Layout of Buffer :
 
   ________________________________
  |                                |
  |  DEBUGGER_GENERAL_EVENT_DETAIL |
  |                                |
  |________________________________|
  |                                |
  |       Condition Buffer         |
  |                                |
  |________________________________|
 
   */
 
    /*
   ________________________________
  |                                |
  |     DEBUGGER_GENERAL_ACTION    |
  |                                |
  |________________________________|
  |                                |
  |     Condition Custom Code      |
  |       or Script Buffer         |
  |________________________________|
 
  */
 
    LengthOfEventBuffer = sizeof(DEBUGGER_GENERAL_EVENT_DETAIL) + ConditionBufferLength;
 
    TempEvent = (PDEBUGGER_GENERAL_EVENT_DETAIL)malloc(LengthOfEventBuffer);
    PlatformZeroMemory(TempEvent, LengthOfEventBuffer);
 
    //
    // Check if buffer is available
    //
    if (TempEvent == NULL)
    {
        ShowMessages("err, allocation error\n");
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_ALLOCATION_ERROR;
        goto ReturnWithError;
    }
 
    //
    // Event is enabled by default when created
    //
    TempEvent->IsEnabled = TRUE;
 
    //
    // Get a new tag for it
    //
    TempEvent->Tag = GetNewDebuggerEventTag();
 
    //
    // Set the core Id and Process Id to all cores and all
    // processes, next time we check whether the user needs
    // a special core or a special process then we change it
    //
    TempEvent->CoreId = DEBUGGER_EVENT_APPLY_TO_ALL_CORES;
 
    if (g_ActiveProcessDebuggingState.IsActive)
    {
        ShowMessages("notice: as you're debugging a user-mode application, "
                     "this event will only trigger on your current debugging process "
                     "(pid:%x). If you want the event from the entire system, "
                     "add 'pid all' to the event\n\n",
                     g_ActiveProcessDebuggingState.ProcessId);
 
        TempEvent->ProcessId = g_ActiveProcessDebuggingState.ProcessId;
    }
    else
    {
        TempEvent->ProcessId = DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES;
    }
 
    //
    // Set the event type
    //
    TempEvent->EventType = EventType;
 
    //
    // Set buffer string command
    //
    TempEvent->CommandStringBuffer = BufferOfCommandString;
 
    //
    // Fill the buffer of condition for event
    //
    if (HasConditionBuffer)
    {
        memcpy((PVOID)((UINT64)TempEvent + sizeof(DEBUGGER_GENERAL_EVENT_DETAIL)),
               (PVOID)ConditionBufferAddress,
               ConditionBufferLength);
 
        //
        // Set the size of the buffer for event condition
        //
        TempEvent->ConditionBufferSize = ConditionBufferLength;
    }
 
    //
    // Fill the buffer of custom code for action
    //
    if (HasCodeBuffer)
    {
        //
        // Allocate the Action (THIS ACTION BUFFER WILL BE FREED WHEN WE SENT IT TO
        // THE KERNEL AND RETURNED FROM THE KERNEL AS WE DON'T NEED IT ANYMORE)
        //
        LengthOfCustomCodeActionBuffer = sizeof(DEBUGGER_GENERAL_ACTION) + CodeBufferLength;
 
        TempActionCustomCode = (PDEBUGGER_GENERAL_ACTION)malloc(LengthOfCustomCodeActionBuffer);
 
        PlatformZeroMemory(TempActionCustomCode, LengthOfCustomCodeActionBuffer);
 
        memcpy(
            (PVOID)((UINT64)TempActionCustomCode + sizeof(DEBUGGER_GENERAL_ACTION)),
            (PVOID)CodeBufferAddress,
            CodeBufferLength);
        //
        // Set the action Tag
        //
        TempActionCustomCode->EventTag = TempEvent->Tag;
 
        //
        // Set the action type
        //
        TempActionCustomCode->ActionType = RUN_CUSTOM_CODE;
 
        //
        // Set the action buffer size
        //
        TempActionCustomCode->CustomCodeBufferSize = CodeBufferLength;
 
        //
        // Increase the count of actions
        //
        TempEvent->CountOfActions = TempEvent->CountOfActions + 1;
    }
 
    //
    // Fill the buffer of script for action
    //
    if (HasScript)
    {
        //
        // Allocate the Action (THIS ACTION BUFFER WILL BE FREED WHEN WE SENT IT TO
        // THE KERNEL AND RETURNED FROM THE KERNEL AS WE DON'T NEED IT ANYMORE)
        //
        LengthOfScriptActionBuffer = sizeof(DEBUGGER_GENERAL_ACTION) + ScriptBufferLength;
        TempActionScript           = (PDEBUGGER_GENERAL_ACTION)malloc(LengthOfScriptActionBuffer);
 
        PlatformZeroMemory(TempActionScript, LengthOfScriptActionBuffer);
 
        memcpy((PVOID)((UINT64)TempActionScript + sizeof(DEBUGGER_GENERAL_ACTION)),
               (PVOID)ScriptBufferAddress,
               ScriptBufferLength);
        //
        // Set the action Tag
        //
        TempActionScript->EventTag = TempEvent->Tag;
 
        //
        // Set the action type
        //
        TempActionScript->ActionType = RUN_SCRIPT;
 
        //
        // Set the action buffer size and pointer
        //
        TempActionScript->ScriptBufferSize    = ScriptBufferLength;
        TempActionScript->ScriptBufferPointer = ScriptBufferPointer;
 
        //
        // Increase the count of actions
        //
        TempEvent->CountOfActions = TempEvent->CountOfActions + 1;
 
        //
        // Free the buffer of script related functions
        //
        ScriptEngineWrapperRemoveSymbolBuffer((PVOID)ScriptCodeBuffer);
    }
 
    //
    // If this action didn't contain a buffer for custom code and
    // a buffer for script then it's a break to debugger
    //
    if (!HasCodeBuffer && !HasScript)
    {
        //
        // Allocate the Action (THIS ACTION BUFFER WILL BE FREED WHEN WE SENT IT TO
        // THE KERNEL AND RETURNED FROM THE KERNEL AS WE DON'T NEED IT ANYMORE)
        //
        LengthOfBreakActionBuffer = sizeof(DEBUGGER_GENERAL_ACTION);
 
        TempActionBreak = (PDEBUGGER_GENERAL_ACTION)malloc(LengthOfBreakActionBuffer);
 
        PlatformZeroMemory(TempActionBreak, LengthOfBreakActionBuffer);
 
        //
        // Set the action Tag
        //
        TempActionBreak->EventTag = TempEvent->Tag;
 
        //
        // Set the action type
        //
        TempActionBreak->ActionType = BREAK_TO_DEBUGGER;
 
        //
        // Increase the count of actions
        //
        TempEvent->CountOfActions = TempEvent->CountOfActions + 1;
    }
 
    //
    // Interpret rest of the command
    //
    for (auto Section : *CommandTokens)
    {
        Index++;
 
        if (IsNextCommandBufferSize)
        {
            if (!ConvertTokenToUInt32(Section, &RequestBuffer))
            {
                ShowMessages("err, buffer size is invalid\n");
                *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
                goto ReturnWithError;
            }
            else
            {
                //
                // Set the specific requested buffer size
                //
                if (TempActionBreak != NULL)
                {
                    TempActionBreak->PreAllocatedBuffer = RequestBuffer;
                }
                if (TempActionScript != NULL)
                {
                    TempActionScript->PreAllocatedBuffer = RequestBuffer;
                }
                if (TempActionCustomCode != NULL)
                {
                    TempActionCustomCode->PreAllocatedBuffer = RequestBuffer;
                }
            }
            IsNextCommandBufferSize = FALSE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (IsNextCommandImmediateMessaging)
        {
            if (CompareLowerCaseStrings(Section, "yes"))
            {
                ImmediateMessagePassing = TRUE;
            }
            else if (CompareLowerCaseStrings(Section, "no"))
            {
                ImmediateMessagePassing = FALSE;
            }
            else
            {
                //
                // err, not token recognized error
                //
 
                ShowMessages("err, immediate messaging token is invalid\n");
                *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
                goto ReturnWithError;
            }
 
            IsNextCommandImmediateMessaging = FALSE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (IsNextCommandExecutionStage)
        {
            if (CompareLowerCaseStrings(Section, "pre"))
            {
                CallingStage = VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION;
            }
            else if (CompareLowerCaseStrings(Section, "post"))
            {
                CallingStage = VMM_CALLBACK_CALLING_STAGE_POST_EVENT_EMULATION;
            }
            else if (CompareLowerCaseStrings(Section, "all"))
            {
                CallingStage = VMM_CALLBACK_CALLING_STAGE_ALL_EVENT_EMULATION;
            }
            else
            {
                //
                // err, not token recognized error
                //
 
                ShowMessages("err, the specified execution mode is invalid; you can either choose 'pre' or 'post'\n");
                *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
                goto ReturnWithError;
            }
 
            IsNextCommandExecutionStage = FALSE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (IsNextCommandSc)
        {
            if (CompareLowerCaseStrings(Section, "on"))
            {
                IsAShortCircuitingEventByDefault = TRUE;
            }
            else if (CompareLowerCaseStrings(Section, "off"))
            {
                IsAShortCircuitingEventByDefault = FALSE;
            }
            else
            {
                //
                // err, not token recognized error
                //
 
                ShowMessages("err, the specified short-circuiting state is invalid; you can either choose 'on' or 'off'\n");
                *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
                goto ReturnWithError;
            }
 
            IsNextCommandSc = FALSE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (IsNextCommandPid)
        {
            if (CompareLowerCaseStrings(Section, "all"))
            {
                TempEvent->ProcessId = DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES;
            }
            else if (!ConvertTokenToUInt32(Section, &ProcessId))
            {
                ShowMessages("err, pid is invalid\n");
                *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
 
                goto ReturnWithError;
            }
            else
            {
                //
                // Set the specific process id
                //
                TempEvent->ProcessId = ProcessId;
            }
 
            IsNextCommandPid = FALSE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (IsNextCommandCoreId)
        {
            if (!ConvertTokenToUInt32(Section, &CoreId))
            {
                ShowMessages("err, core id is invalid\n");
                *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
                goto ReturnWithError;
            }
            else
            {
                //
                // Set the specific core id
                //
                TempEvent->CoreId = CoreId;
            }
            IsNextCommandCoreId = FALSE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "pid"))
        {
            IsNextCommandPid = TRUE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
        if (CompareLowerCaseStrings(Section, "core"))
        {
            IsNextCommandCoreId = TRUE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "imm"))
        {
            //
            // the next command is immediate messaging indicator
            //
            IsNextCommandImmediateMessaging = TRUE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "stage"))
        {
            //
            // the next command is execution mode (pre- and post-events)
            //
            IsNextCommandExecutionStage = TRUE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "sc"))
        {
            //
            // the next command is the default short-circuiting state
            //
            IsNextCommandSc = TRUE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "buffer"))
        {
            IsNextCommandBufferSize = TRUE;
 
            //
            // Add index to remove it from the command
            //
            IndexesToRemove.push_back(Index);
 
            continue;
        }
    }
 
    //
    // Additional validation
    //
    if (IsNextCommandCoreId)
    {
        ShowMessages("err, please specify a value for 'core'\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
 
        goto ReturnWithError;
    }
 
    if (IsNextCommandPid)
    {
        ShowMessages("err, please specify a value for 'pid'\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
 
        goto ReturnWithError;
    }
 
    if (IsNextCommandBufferSize)
    {
        ShowMessages("err, please specify a value for 'buffer'\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
 
        goto ReturnWithError;
    }
 
    if (IsNextCommandImmediateMessaging)
    {
        ShowMessages("err, please specify a value for 'imm'\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
 
        goto ReturnWithError;
    }
 
    if (IsNextCommandExecutionStage)
    {
        ShowMessages("err, please specify a value for 'stage'\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
 
        goto ReturnWithError;
    }
 
    if (IsNextCommandSc)
    {
        ShowMessages("err, please specify a value for 'sc'\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_FORMAT_ERROR;
 
        goto ReturnWithError;
    }
 
    //
    // Check to make sure that short-circuiting is not used in post-events
    //
    if ((CallingStage == VMM_CALLBACK_CALLING_STAGE_POST_EVENT_EMULATION ||
         CallingStage == VMM_CALLBACK_CALLING_STAGE_ALL_EVENT_EMULATION) &&
        IsAShortCircuitingEventByDefault)
    {
        ShowMessages(
            "err, using the short-circuiting mechanism with 'post' or 'all' stage events "
            "doesn't make sense; it's not supported!\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_USING_SHORT_CIRCUITING_IN_POST_EVENTS;
 
        goto ReturnWithError;
    }
 
    //
    // It's not possible to break to debugger in VMI-mode
    //
    if (!g_IsSerialConnectedToRemoteDebuggee && TempActionBreak != NULL)
    {
        ShowMessages(
            "err, the script or assembly code is either not found or invalid. "
            "As a result, the default action is to break. "
            "However, breaking to the debugger is not possible in the VMI Mode. "
            "To achieve full control of the system, you can switch to the Debugger Mode. "
            "In the VMI Mode, you can still use scripts and run custom code for local debugging."
            "For more information, please check: https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_ATTEMPT_TO_BREAK_ON_VMI_MODE;
 
        goto ReturnWithError;
    }
 
    //
    // We do not support non-immediate message passing if the user
    // specified a special output
    //
    if (!ImmediateMessagePassing && HasOutputPath)
    {
        ShowMessages("err, non-immediate message passing is not supported in "
                     "'output-forwarding mode'\n");
 
        *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_IMMEDIATE_MESSAGING_IN_EVENT_FORWARDING_MODE;
 
        goto ReturnWithError;
    }
 
    //
    // Set the specific requested immediate message passing
    //
    if (TempActionBreak != NULL)
    {
        TempActionBreak->ImmediateMessagePassing = ImmediateMessagePassing;
    }
    if (TempActionScript != NULL)
    {
        TempActionScript->ImmediateMessagePassing = ImmediateMessagePassing;
    }
    if (TempActionCustomCode != NULL)
    {
        TempActionCustomCode->ImmediateMessagePassing = ImmediateMessagePassing;
    }
 
    //
    // Set the tags into the event list
    //
    IndexOfValidSourceTags = 0;
    for (auto item : ListOfValidSourceTags)
    {
        TempEvent->OutputSourceTags[IndexOfValidSourceTags] = item;
 
        //
        // Increase index
        //
        IndexOfValidSourceTags++;
    }
 
    //
    // If it has output then we should indicate it in event's object
    //
    if (HasOutputPath)
    {
        TempEvent->HasCustomOutput = TRUE;
    }
 
    //
    // Set the specific requested short-circuiting state
    //
    if (IsAShortCircuitingEventByDefault)
    {
        TempEvent->EnableShortCircuiting = TRUE;
    }
 
    //
    // Set the specific event mode (calling stage)
    //
    TempEvent->EventStage = CallingStage;
 
    //
    // Fill the address and length of event before release
    //
    *EventDetailsToFill = TempEvent;
    *EventBufferLength  = LengthOfEventBuffer;
 
    //
    // Fill the address and length of action before release
    //
    if (TempActionBreak != NULL)
    {
        *ActionDetailsToFillBreakToDebugger = TempActionBreak;
        *ActionBufferLengthBreakToDebugger  = LengthOfBreakActionBuffer;
    }
    if (TempActionScript != NULL)
    {
        *ActionDetailsToFillScript = TempActionScript;
        *ActionBufferLengthScript  = LengthOfScriptActionBuffer;
    }
    if (TempActionCustomCode != NULL)
    {
        *ActionDetailsToFillCustomCode = TempActionCustomCode;
        *ActionBufferLengthCustomCode  = LengthOfCustomCodeActionBuffer;
    }
 
    //
    // Remove the command that we interpreted above from the command
    //
    for (auto IndexToRemove : IndexesToRemove)
    {
        NewIndexToRemove++;
        CommandTokens->erase(CommandTokens->begin() + (IndexToRemove - NewIndexToRemove));
    }
 
    //
    // Check if list is initialized or not
    //
    if (!g_EventTraceInitialized)
    {
        InitializeListHead(&g_EventTrace);
        g_EventTraceInitialized = TRUE;
    }
 
    //
    // Add the event to the trace list
    // UPDATE : if we add it here, then if the event was not
    // successful then still the event shows this event, so
    // we have to add it lated
    //
    // InsertHeadList(&g_EventTrace, &(TempEvent->CommandsEventList));
 
    //
    // Everything is ok, let's return TRUE
    //
    *ReasonForErrorInParsing = DEBUGGER_EVENT_PARSING_ERROR_CAUSE_SUCCESSFUL_NO_ERROR;
    return TRUE;
 
ReturnWithError:
 
    if (BufferOfCommandString)
    {
        free(BufferOfCommandString);
    }
 
    if (TempEvent)
    {
        free(TempEvent);
    }
 
    if (TempActionBreak != NULL)
    {
        free(TempActionBreak);
    }
    if (TempActionScript != NULL)
    {
        free(TempActionScript);
    }
    if (TempActionCustomCode != NULL)
    {
        free(TempActionCustomCode);
    }
 
    return FALSE;
}

InterpretOutput()

BOOLEAN InterpretOutput	(	vector< CommandToken > *	CommandTokens,
		vector< string > &	InputSources )

Interpret output (if an event has special output).

If this function returns true then it means that there is a special input that needs to be considered for this event (other than just printing) like sending over network, save to file, and send over a namedpipe

Parameters

CommandTokens	command tokens
BufferAddress	the address that the allocated buffer will be saved on it
BufferLength	the length of the buffer

Returns

BOOLEAN shows whether the interpret was successful (true) or not successful (false)

{
    BOOLEAN IsTextVisited       = FALSE;
    string  TargetBracketString = "";
 
    vector<INT> IndexesToRemove;
    string      Token;
    INT         NewIndexToRemove = 0;
    INT         Index            = 0;
    CHAR        Delimiter        = ',';
    SIZE_T      Pos              = 0;
 
    for (auto Section : *CommandTokens)
    {
        Index++;
 
        if (IsTextVisited && IsTokenBracketString(Section))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            //
            // Fill the bracket string
            //
            TargetBracketString = GetCaseSensitiveStringFromCommandToken(Section);
 
            IsTextVisited = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "output"))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            IsTextVisited = TRUE;
            continue;
        }
    }
 
    //
    // Now we have everything in buffer
    // Check to see if it is empty or not
    //
    if (TargetBracketString.length() == 0)
    {
        //
        // Nothing in output buffer, return zero
        //
        return FALSE;
    }
 
    //
    // Check if we see multiple sources or it's just one single output
    //
    if (TargetBracketString.find(Delimiter) != std::string::npos)
    {
        //
        // Delimiter found !
        //
        while ((Pos = TargetBracketString.find(Delimiter)) != string::npos)
        {
            Token = TargetBracketString.substr(0, Pos);
            Trim(Token);
 
            if (!Token.empty())
            {
                InputSources.push_back(Token);
            }
 
            TargetBracketString.erase(0, Pos + sizeof(Delimiter) / sizeof(char));
        }
 
        if (!TargetBracketString.empty())
        {
            InputSources.push_back(TargetBracketString);
        }
    }
    else
    {
        //
        // Delimiter not found !
        //
        InputSources.push_back(TargetBracketString);
    }
 
    //
    // Removing indexes from the command
    //
    NewIndexToRemove = 0;
    for (auto IndexToRemove : IndexesToRemove)
    {
        NewIndexToRemove++;
        CommandTokens->erase(CommandTokens->begin() + (IndexToRemove - NewIndexToRemove));
    }
 
    return TRUE;
}

InterpretScript()

BOOLEAN InterpretScript	(	vector< CommandToken > *	CommandTokens,
		PBOOLEAN	ScriptSyntaxErrors,
		PUINT64	BufferAddress,
		PUINT32	BufferLength,
		PUINT32	Pointer,
		PUINT64	ScriptCodeBuffer )

Interpret script (if an event has script).

If this function returns true then it means that there is a script in this command split and the details are returned in the input structure

Parameters

CommandTokens	command tokens
BufferAddress	the address that the allocated buffer will be saved on it
BufferLength	the length of the buffer

Returns

BOOLEAN shows whether the interpret was successful (true) or not successful (false)

{
    BOOLEAN IsTextVisited       = FALSE;
    string  TargetBracketString = "";
 
    vector<int> IndexesToRemove;
    UINT32      Index            = 0;
    UINT32      NewIndexToRemove = 0;
 
    //
    // Indicate that there is an error at first
    //
    *ScriptSyntaxErrors = TRUE;
 
    for (auto Section : *CommandTokens)
    {
        Index++;
 
        if (IsTextVisited && IsTokenBracketString(Section))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            //
            // Fill the bracket string
            //
            TargetBracketString = GetCaseSensitiveStringFromCommandToken(Section);
 
            IsTextVisited = FALSE;
            continue;
        }
 
        if (CompareLowerCaseStrings(Section, "script"))
        {
            //
            // Save to remove this string from the command
            //
            IndexesToRemove.push_back(Index);
 
            IsTextVisited = TRUE;
            continue;
        }
    }
 
    //
    // Now we have everything in buffer
    // Check to see if it is empty or not
    //
    if (TargetBracketString.length() == 0)
    {
        //
        // Nothing in output buffer, return zero
        //
        return FALSE;
    }
 
    if (TargetBracketString.rfind("file:", 0) == 0)
    {
        //
        // It's a file script
        //
        std::ifstream     t(TargetBracketString.erase(0, 5).c_str());
        std::stringstream buffer;
        buffer << t.rdbuf();
        TargetBracketString = buffer.str();
        if (TargetBracketString.empty())
        {
            ShowMessages("err, either script file is not found or it's empty\n");
 
            //
            // There was an error
            //
            *ScriptSyntaxErrors = TRUE;
 
            //
            // return TRUE to show that this item contains an script
            //
            return TRUE;
        }
    }
 
    // ShowMessages("script : %s\n", TargetBracketString.c_str());
 
    //
    // Run script engine handler
    //
    PVOID CodeBuffer = ScriptEngineParseWrapper((CHAR *)TargetBracketString.c_str(), TRUE);
 
    if (CodeBuffer == NULL)
    {
        //
        // There was an error
        //
        *ScriptSyntaxErrors = TRUE;
 
        //
        // return TRUE to show that this item contains an script
        //
        return TRUE;
    }
    else
    {
        //
        // There is no syntax error
        //
        *ScriptSyntaxErrors = FALSE;
    }
 
    //
    // Print symbols (test)
    //
    // PrintSymbolBufferWrapper(CodeBuffer);
 
    //
    // Set the buffer and length
    //
    *BufferAddress    = ScriptEngineWrapperGetHead(CodeBuffer);
    *BufferLength     = ScriptEngineWrapperGetSize(CodeBuffer);
    *Pointer          = ScriptEngineWrapperGetPointer(CodeBuffer);
    *ScriptCodeBuffer = (UINT64)CodeBuffer;
 
    //
    // Removing the script indexes from the command
    //
    NewIndexToRemove = 0;
 
    for (auto IndexToRemove : IndexesToRemove)
    {
        NewIndexToRemove++;
 
        CommandTokens->erase(CommandTokens->begin() + (IndexToRemove - NewIndexToRemove));
    }
 
    return TRUE;
}

IsConnectedToAnyInstanceOfDebuggerOrDebuggee()

BOOLEAN IsConnectedToAnyInstanceOfDebuggerOrDebuggee

(

)

Shows whether the debugger is connected to a debugger or debuggee connected to a debugger.

we use this function to avoid connecting to a remote machine when debuggee or debugger is already connected to an instance

Returns

BOOLEAN

{
    if (g_DeviceHandle)
    {
        ShowMessages("err, the current system is already connected to the local "
                     "debugging, use '.disconnect' to disconnect\n");
        return TRUE;
    }
    else if (g_IsConnectedToRemoteDebuggee)
    {
        ShowMessages("err, the current system is already connected to remote "
                     "machine (debuggee), use '.disconnect' to disconnect from the "
                     "remote machine\n");
        return TRUE;
    }
    else if (g_IsConnectedToRemoteDebugger)
    {
        ShowMessages("err, the current system is already connected to remote "
                     "machine (debugger), use '.disconnect' to disconnect from the "
                     "remote machine from debugger\n");
        return TRUE;
    }
    else if (g_IsSerialConnectedToRemoteDebuggee)
    {
        ShowMessages(
            "err, the current system is already connected to remote "
            "machine (debuggee), use '.debug close' to disconnect from the "
            "remote machine\n");
        return TRUE;
    }
    else if (g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages(
            "err, the current system is already connected to remote "
            "machine (debugger), use '.debug close' to disconnect from the "
            "remote machine from debugger\n");
        return TRUE;
    }
 
    return FALSE;
}

IsTagExist()

BOOLEAN IsTagExist

(

UINT64

Tag

)

Check whether the tag exists or not, if the tag is DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG then if we find just one event, it also means that the tag is found.

Parameters

Tag

Returns

BOOLEAN

{
    PLIST_ENTRY                    TempList      = 0;
    PDEBUGGER_GENERAL_EVENT_DETAIL CommandDetail = {0};
 
    if (!g_EventTraceInitialized)
    {
        return FALSE;
    }
 
    TempList = &g_EventTrace;
    while (&g_EventTrace != TempList->Blink)
    {
        TempList = TempList->Blink;
 
        CommandDetail = CONTAINING_RECORD(TempList, DEBUGGER_GENERAL_EVENT_DETAIL, CommandsEventList);
 
        if (CommandDetail->Tag == Tag || Tag == DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG)
        {
            return TRUE;
        }
    }
 
    //
    // Not found
    //
    return FALSE;
}

RegisterActionToEvent()

BOOLEAN RegisterActionToEvent	(	PDEBUGGER_GENERAL_EVENT_DETAIL	Event,
		PDEBUGGER_GENERAL_ACTION	ActionBreakToDebugger,
		UINT32	ActionBreakToDebuggerLength,
		PDEBUGGER_GENERAL_ACTION	ActionCustomCode,
		UINT32	ActionCustomCodeLength,
		PDEBUGGER_GENERAL_ACTION	ActionScript,
		UINT32	ActionScriptLength )

Register the action to the event.

Parameters

Event	the event instance buffer
ActionBreakToDebugger	the action of breaking into the debugger
ActionBreakToDebuggerLength	the action of breaking into the debugger (length)
ActionCustomCode	the action of custom code
ActionCustomCodeLength	the action of custom code (length)
ActionScript	the action of script buffer
ActionScriptLength	the action of script buffer (length)

Returns

BOOLEAN BOOLEAN if the request was successful then true if the request was not successful then false

{
    BOOL                              Status;
    ULONG                             ReturnedLength;
    DEBUGGER_EVENT_AND_ACTION_RESULT  ReturnedBuffer = {0};
    PDEBUGGER_EVENT_AND_ACTION_RESULT TempAddingResult;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // It's action(s) in debugger mode
        //
 
        //
        // Send Break to debugger packet to debuggee
        //
        if (ActionBreakToDebugger != NULL)
        {
            //
            // Send the add action to event from here
            //
            TempAddingResult = KdSendAddActionToEventPacketToDebuggee(
                ActionBreakToDebugger,
                ActionBreakToDebuggerLength);
 
            //
            // Move the buffer to local buffer
            //
            memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT));
        }
 
        //
        // Send custom code packet to debuggee
        //
        if (ActionCustomCode != NULL)
        {
            //
            // Send the add action to event from here
            //
            TempAddingResult = KdSendAddActionToEventPacketToDebuggee(
                ActionCustomCode,
                ActionCustomCodeLength);
 
            //
            // Move the buffer to local buffer
            //
            memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT));
        }
 
        //
        // Send custom code packet to debuggee
        //
        if (ActionScript != NULL)
        {
            //
            // Send the add action to event from here
            //
            TempAddingResult = KdSendAddActionToEventPacketToDebuggee(
                ActionScript,
                ActionScriptLength);
 
            //
            // Move the buffer to local buffer
            //
            memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT));
        }
    }
    else
    {
        //
        // It's either a local debugger to in vmi-mode remote connection
        //
        AssertShowMessageReturnStmt(g_IsVmmModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_VMM_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
 
        //
        // Send IOCTLs
        //
 
        //
        // Send Break to debugger ioctl
        //
        if (ActionBreakToDebugger != NULL)
        {
            Status = PlatformDeviceIoControl(
                g_DeviceHandle,                           // Handle to device
                IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT,       // IO Control Code (IOCTL)
                ActionBreakToDebugger,                    // Input Buffer to driver.
                ActionBreakToDebuggerLength,              // Input buffer length
                &ReturnedBuffer,                          // Output Buffer from driver.
                sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length
                                                          // of
                                                          // output
                                                          // buffer
                                                          // in
                                                          // bytes.
                &ReturnedLength,                          // Bytes placed in buffer.
                NULL                                      // synchronous call
            );
 
            if (!Status)
            {
                ShowMessages("ioctl failed with code 0x%x\n", PlatformGetLastError());
                return FALSE;
            }
        }
 
        //
        // Send custom code ioctl
        //
        if (ActionCustomCode != NULL)
        {
            Status = PlatformDeviceIoControl(
                g_DeviceHandle,                           // Handle to device
                IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT,       // IO Control Code (IOCTL)
                ActionCustomCode,                         // Input Buffer to driver.
                ActionCustomCodeLength,                   // Input buffer length
                &ReturnedBuffer,                          // Output Buffer from driver.
                sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length
                                                          // of
                                                          // output
                                                          // buffer
                                                          // in
                                                          // bytes.
                &ReturnedLength,                          // Bytes placed in buffer.
                NULL                                      // synchronous call
            );
 
            if (!Status)
            {
                ShowMessages("ioctl failed with code 0x%x\n", PlatformGetLastError());
                return FALSE;
            }
        }
 
        //
        // Send custom code ioctl
        //
        if (ActionScript != NULL)
        {
            Status = PlatformDeviceIoControl(
                g_DeviceHandle,                           // Handle to device
                IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT,       // IO Control Code (IOCTL)
                ActionScript,                             // Input Buffer to driver.
                ActionScriptLength,                       // Input buffer length
                &ReturnedBuffer,                          // Output Buffer from driver.
                sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length
                                                          // of
                                                          // output
                                                          // buffer
                                                          // in
                                                          // bytes.
                &ReturnedLength,                          // Bytes placed in buffer.
                NULL                                      // synchronous call
            );
 
            if (!Status)
            {
                ShowMessages("ioctl failed with code 0x%x\n", PlatformGetLastError());
                return FALSE;
            }
        }
    }
 
    //
    // As we're not needing any of action buffer, we'll free all of the
    // here in the case of a successful registration of action, however
    // event detail is needed for the 'event' command's list
    //
    FreeEventsAndActionsMemory(NULL, ActionBreakToDebugger, ActionCustomCode, ActionScript);
 
    //
    // Now, we'll register the command as returned buffer shows that
    // this event was successful and now we can add it to the list of
    // events
    //
    InsertHeadList(&g_EventTrace, &(Event->CommandsEventList));
 
    return TRUE;
}

SendEventToKernel()

BOOLEAN SendEventToKernel	(	PDEBUGGER_GENERAL_EVENT_DETAIL	Event,
		UINT32	EventBufferLength )

Register the event to the kernel.

Parameters

Event	the event structure to send
EventBufferLength	the buffer length of event

Returns

BOOLEAN if the request was successful then true if the request was not successful then false

{
    BOOL                              Status;
    ULONG                             ReturnedLength;
    DEBUGGER_EVENT_AND_ACTION_RESULT  ReturnedBuffer = {0};
    PDEBUGGER_EVENT_AND_ACTION_RESULT TempRegResult;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // It's a debugger, we should send the events buffer directly
        // from here
        //
 
        //
        // Send the buffer from here
        //
        TempRegResult = KdSendRegisterEventPacketToDebuggee(Event, EventBufferLength);
 
        //
        // Move the buffer to local buffer
        //
        memcpy(&ReturnedBuffer, TempRegResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT));
    }
    else
    {
        //
        // It's either a debuggee or a local debugging instance
        //
        AssertShowMessageReturnStmt(g_IsVmmModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_VMM_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
 
        //
        // Send IOCTL
        //
 
        Status = PlatformDeviceIoControl(g_DeviceHandle,                           // Handle to device
                                 IOCTL_DEBUGGER_REGISTER_EVENT,            // IO Control Code (IOCTL)
                                 Event,                                    // Input Buffer to driver.
                                 EventBufferLength,                        // Input buffer length
                                 &ReturnedBuffer,                          // Output Buffer from driver.
                                 sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length
                                                                           // of
                                                                           // output
                                                                           // buffer
                                                                           // in
                                                                           // bytes.
                                 &ReturnedLength,                          // Bytes placed in buffer.
                                 NULL                                      // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", PlatformGetLastError());
            return FALSE;
        }
    }
 
    if (ReturnedBuffer.IsSuccessful && ReturnedBuffer.Error == 0)
    {
        //
        // Check for auto-unpause mode
        //
        if (!g_IsSerialConnectedToRemoteDebuggee && !g_IsSerialConnectedToRemoteDebugger && g_BreakPrintingOutput && g_AutoUnpause)
        {
            //
            // Allow debugger to show its contents
            //
 
            //
            // Set the g_BreakPrintingOutput to FALSE
            //
            g_BreakPrintingOutput = FALSE;
 
            //
            // If it's a remote debugger then we send the remote debuggee a 'g'
            //
            if (g_IsConnectedToRemoteDebuggee)
            {
                RemoteConnectionSendCommand("g", (UINT32)strlen("g") + 1);
            }
 
            ShowMessages("\n");
        }
    }
    else
    {
        //
        // Show the error
        //
        if (ReturnedBuffer.Error != 0)
        {
            ShowErrorMessage(ReturnedBuffer.Error);
        }
 
        return FALSE;
    }
 
    return TRUE;
}

ShowErrorMessage()

BOOLEAN ShowErrorMessage

(

UINT32

Error

)

shows the error message

Parameters

Error

Returns

BOOLEAN

{
    switch (Error)
    {
    case DEBUGGER_ERROR_TAG_NOT_EXISTS:
        ShowMessages("err, tag not found (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_ACTION_TYPE:
        ShowMessages("err, invalid action type (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_ACTION_BUFFER_SIZE_IS_ZERO:
        ShowMessages("err, action buffer size is zero (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EVENT_TYPE_IS_INVALID:
        ShowMessages("err, the event type is invalid (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_CREATE_EVENT:
        ShowMessages("err, unable to create event (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_ADDRESS:
 
        ShowMessages("err, invalid address (%x)\n"
                     "address may be paged-out or unavailable on the page table due to 'demand paging'\n"
                     "please refer to https://docs.hyperdbg.org/tips-and-tricks/considerations/accessing-invalid-address for further information\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_CORE_ID:
        ShowMessages("err, invalid core id (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EXCEPTION_INDEX_EXCEED_FIRST_32_ENTRIES:
        ShowMessages("err, exception index exceed first 32 entries (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INTERRUPT_INDEX_IS_NOT_VALID:
        ShowMessages("err, interrupt index is not valid (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER:
        ShowMessages("err, unable to hide or unhide debugger and entr the transparent mode (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_DEBUGGER_ALREADY_HIDE:
        ShowMessages("err, debugger already hidden in the transparent mode (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_PARAMETER:
        ShowMessages("err, edit memory request has invalid parameters (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_CURRENT_PROCESS:
        ShowMessages("err, edit memory request has invalid address based on "
                     "current process layout, the address might be valid but not "
                     "present in the ram (%x)\n"
                     "address may be paged-out or unavailable on the page table due to 'demand paging'\n"
                     "please refer to https://docs.hyperdbg.org/tips-and-tricks/considerations/accessing-invalid-address for further information\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_OTHER_PROCESS:
        ShowMessages("err, edit memory request has invalid address based on other "
                     "process layout (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TAG:
        ShowMessages("err, modify event with invalid tag (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TYPE_OF_ACTION:
        ShowMessages("err, modify event with invalid type of action (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_STEPPING_INVALID_PARAMETER:
        ShowMessages("err, invalid parameter passed to stepping core. (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_STEPPINGS_EITHER_THREAD_NOT_FOUND_OR_DISABLED:
        ShowMessages(
            "err, the target thread not found or the thread is disabled (%x)\n",
            Error);
        break;
 
    case DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_BAUDRATE:
        ShowMessages("err, invalid baud rate (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_SERIAL_PORT:
        ShowMessages("err, invalid serial port (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_CORE_IN_REMOTE_DEBUGGE:
        ShowMessages("err, invalid core selected in switching cores (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PREPARING_DEBUGGEE_UNABLE_TO_SWITCH_TO_NEW_PROCESS:
        ShowMessages("err, unable to switch to the new process (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT:
        ShowMessages("err, unable to run the script on remote debuggee (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_REGISTER_NUMBER:
        ShowMessages("err, invalid register number (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_WITHOUT_CONTINUE:
        ShowMessages("err, maximum number of breakpoints are used, you need to "
                     "send an ioctl to re-allocate new pre-allocated buffers or "
                     "configure HyperDbg to pre-allocated more buffers by "
                     "configuring MAXIMUM_BREAKPOINTS_WITHOUT_CONTINUE (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_BREAKPOINT_ALREADY_EXISTS_ON_THE_ADDRESS:
        ShowMessages("err, breakpoint already exists on target address, you can "
                     "use 'bl' command to view a list of breakpoints (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND:
        ShowMessages("err, breakpoint id is invalid (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_BREAKPOINT_ALREADY_DISABLED:
        ShowMessages("err, breakpoint already disabled (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_BREAKPOINT_ALREADY_ENABLED:
        ShowMessages("err, breakpoint already enabled (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_MEMORY_TYPE_INVALID:
        ShowMessages("err, the memory type is invalid (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_PROCESS_ID:
        ShowMessages("err, the process id is invalid, make sure to enter the "
                     "process id in hex format, or if you want to use it in decimal "
                     "format, add '0n' prefix to the number (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EVENT_IS_NOT_APPLIED:
        ShowMessages("err, the event is not applied (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_DETAILS_OR_SWITCH_PROCESS_INVALID_PARAMETER:
        ShowMessages("err, either the process id or the _EPROCESS is invalid or "
                     "cannot get the details based on the provided parameters (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER:
        ShowMessages("err, either the thread id, _ETHREAD, or _EPROCESS is invalid or "
                     "cannot get the details based on the provided parameters (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_FOR_A_SINGLE_PAGE_IS_HIT:
        ShowMessages("err, the maximum breakpoint for a single page is hit, "
                     "you cannot apply more breakpoints in this page (%x)\n"
                     "please refer to https://docs.hyperdbg.org/tips-and-tricks/misc/customize-build/number-of-ept-hooks-in-one-page"
                     " for further information\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PRE_ALLOCATED_BUFFER_IS_EMPTY:
        ShowMessages("err, the pre-allocated buffer is empty, usually this buffer will be "
                     "filled at the next IOCTL when the debugger is continued (%x)\n"
                     "please visit the documentation for the 'prealloc' command or use "
                     "'.help prealloc' to to reserve more pre-allocated pools\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EPT_COULD_NOT_SPLIT_THE_LARGE_PAGE_TO_4KB_PAGES:
        ShowMessages("err, could not convert 2MB large page to 4KB pages "
                     "(maybe pre-allocated buffers are empty?) (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EPT_FAILED_TO_GET_PML1_ENTRY_OF_TARGET_ADDRESS:
        ShowMessages("err, failed to get the PML1 entry of the target address (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_EPT_MULTIPLE_HOOKS_IN_A_SINGLE_PAGE:
        ShowMessages("err, the page modification is not applied, make sure that you don't "
                     "put multiple EPT Hooks or Monitors on a single page (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_COULD_NOT_BUILD_THE_EPT_HOOK:
        ShowMessages("err, could not build the EPT hook (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_COULD_NOT_FIND_ALLOCATION_TYPE:
        ShowMessages("err, could not find the allocation type (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_TEST_QUERY_INDEX:
        ShowMessages("err, invalid index specified for test query command (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS:
        ShowMessages("err, unable to attach to the target process (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED:
        ShowMessages("err, unable to remove hooks as the entrypoint of user-mode "
                     "process is not reached yet (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS:
        ShowMessages("err, unable to remove hooks (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED:
        ShowMessages("err, the routines for getting the PEB is not correctly "
                     "initialized (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS:
        ShowMessages("err, unable to detect whether the process was 32-bit "
                     "or 64-bit (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS:
        ShowMessages("err, unable to kill the process (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN:
        ShowMessages("err, invalid thread debugging token (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS:
        ShowMessages("err, unable to pause the threads of the process (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS:
        ShowMessages("err, the user debugger is already attached to this "
                     "process, please use the '.switch' command to switch "
                     "to this process (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS:
        ShowMessages("err, the user debugger is not already attached to "
                     "the process (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS:
        ShowMessages("err, the user debugger is not able to detach from "
                     "this process as there are paused threads in the "
                     "target process, please make sure to remove all "
                     "the events and continue the target process, then "
                     "perform the detach again (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID:
        ShowMessages("err, unable to switch to the process id or thread id "
                     "as the target process id or thread id is not found in "
                     "the attached threads list, please view the list of "
                     "processes and threads by using the '.switch list' command (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS:
        ShowMessages("err, unable to switch to the process as the process doesn't "
                     "contain an active intercepted thread (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS:
        ShowMessages("err, unable to get user-mode modules of the process (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_GET_CALLSTACK:
        ShowMessages("err, unable to get the callstack (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_QUERY_COUNT_OF_PROCESSES_OR_THREADS:
        ShowMessages("err, unable to query count of processes or threads (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_USING_SHORT_CIRCUITING_EVENT_WITH_POST_EVENT_MODE_IS_FORBIDDEDN:
        ShowMessages("err, using short-circuiting event with post events is not possible (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNKNOWN_TEST_QUERY_RECEIVED:
        ShowMessages("err, unknown test query is received to the debugger (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_READING_MEMORY_INVALID_PARAMETER:
        ShowMessages("err, invalid process or memory address (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_THE_TRAP_FLAG_LIST_IS_FULL:
        ShowMessages("err, unable to add the current thread/process to the list of trap flags. "
                     "Are you debugging multiple threads or stepping through different processes "
                     "simultaneously? (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS:
        ShowMessages("err, process does not exists (already terminated?) (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_MODE_EXECUTION_IS_INVALID:
        ShowMessages("err, the specified execution mode is invalid (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PROCESS_ID_CANNOT_BE_SPECIFIED_WHILE_APPLYING_EVENT_FROM_VMX_ROOT_MODE:
        ShowMessages("err, you cannot specify process id while the debugger is paused in the debugger mode. "
                     "You can use the '.process' or the '.thread' command to switch to the target process's "
                     "memory layout (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_EVENT_AND_CONDITIONALS:
        ShowMessages("err, the requested buffer for storing event and conditions is larger than the pre-allocated "
                     "buffer size (%x)\nfor more information on how to resolve this issue, "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND:
        ShowMessages("err, not enough pre-allocated buffer exists for storing the event. You can use the 'prealloc' "
                     "command to fix this issue by pre-allocating more buffers (%x)\nfor more information "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_BIG_PREALLOCATED_BUFFER_NOT_FOUND:
        ShowMessages("err, the requested event is considered as a \"big instant event\" and right now, there is no "
                     "pre-allocated buffer for storing it. You can use the 'prealloc' command to fix this issue by "
                     "pre-allocating big instant event buffers (%x)\nfor more information "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_CREATE_ACTION_CANNOT_ALLOCATE_BUFFER:
        ShowMessages("err, unable to allocate buffer for the target action (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_ACTION_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND:
        ShowMessages("err, not enough pre-allocated buffer exists for storing the event's action. You can use the 'prealloc' "
                     "command to fix this issue by pre-allocating more buffers (%x)\nfor more information "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_ACTION_BIG_PREALLOCATED_BUFFER_NOT_FOUND:
        ShowMessages("err, the requested action is considered as a \"big instant event (action)\" and right now, there is no "
                     "pre-allocated buffer for storing it. You can use the 'prealloc' command to fix this issue by "
                     "pre-allocating big instant event's action buffers (%x)\nfor more information "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_ACTION_BUFFER:
        ShowMessages("err, the requested buffer for storing action is larger than the pre-allocated "
                     "buffer size (%x)\nfor more information on how to resolve this issue, "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_REQUESTED_OPTIONAL_BUFFER_IS_BIGGER_THAN_DEBUGGERS_SEND_RECEIVE_STACK:
        ShowMessages("err, the requested optional buffer is bigger than the debuggers send/receive stack, "
                     "please select a smaller requested buffer for the target event (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_REQUESTED_SAFE_BUFFER_NOT_FOUND:
        ShowMessages("err, by default HyperDbg won't allocate requested safe buffers for instant events in "
                     "the debugger mode. You can use the 'prealloc' command to allocate (regular) requested safe "
                     "buffers before running this command (%x)\nfor more information "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_BIG_REQUESTED_SAFE_BUFFER_NOT_FOUND:
        ShowMessages("err, the requested safe buffer is bigger than regular buffers. You can use the 'prealloc' "
                     "command to allocate (big) requested safe buffers before running this command (%x)\n"
                     "for more information "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_REQUESTED_SAFE_BUFFER:
        ShowMessages("err, the requested buffer for storing safe buffers of the action is larger than the pre-allocated "
                     "buffer size (%x)\nfor more information on how to resolve this issue, "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_ALLOCATE_REQUESTED_SAFE_BUFFER:
        ShowMessages("err, unable to allocate buffer for the target requested safe buffer (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_COULD_NOT_FIND_PREACTIVATION_TYPE:
        ShowMessages("err, invalid type is specified for preactivation (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_THE_MODE_EXEC_TRAP_IS_NOT_INITIALIZED:
        ShowMessages("err, for performance reasons, the '!mode' event command cannot be directly initialized in the Debugger Mode. "
                     "You can use the 'preactivate mode' command to preactivate this mechanism after that, "
                     "you can use the '!mode' event (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_THE_TARGET_EVENT_IS_DISABLED_BUT_CANNOT_BE_CLEARED_PRIRITY_BUFFER_IS_FULL:
        ShowMessages("err, the event(s) that you've requested are disabled, yet HyperDbg cannot remove (clear) them in "
                     "the subsequent run due to the user-mode priority buffers being at full capacity. "
                     "This typically occurs when you attempt to clear numerous events without resuming the debuggee. "
                     "Since these unserviced events remain in the queue, HyperDbg is unable to clear them. "
                     "To address this issue, you can resume the debuggee, allowing all queued events to be cleared (usually 2 to 10 seconds). "
                     "Afterward, you can pause the debuggee again and request the removal of new events (%x)\n"
                     "for more information on how to resolve this issue "
                     "please visit: https://docs.hyperdbg.org/tips-and-tricks/misc/instant-events\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_NOT_ALL_CORES_ARE_LOCKED_FOR_APPLYING_INSTANT_EVENT:
        ShowMessages("err, the event cannot be applied since not all cores are locked! "
                     "If you are using the instant-event mechanism or switching between cores, this will likely halt the system. "
                     "This may be caused by a race condition, but continuing and halting the debugger might resolve it. "
                     "If the problem persists, please open an issue and provide steps to reproduce it (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_TARGET_SWITCHING_CORE_IS_NOT_LOCKED:
        ShowMessages("err, target core is not locked! "
                     "This may be caused by a race condition, continuing and halting the debugger might resolve it. "
                     "If the problem persists, please open an issue and provide steps to reproduce it (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_PHYSICAL_ADDRESS:
        ShowMessages("err, invalid physical address (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_APIC_ACTIONS_ERROR:
        ShowMessages("err, could not perform APIC actions (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_DEBUGGER_ALREADY_UNHIDE:
        ShowMessages("err, debugger was not in the hidden transparent-mode (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_DEBUGGER_NOT_INITIALIZED:
        ShowMessages("err, the user debugger cannot be initialized (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_CANNOT_PUT_EPT_HOOKS_ON_PHYSICAL_ADDRESS_ABOVE_512_GB:
        ShowMessages("err, putting EPT hooks on physical address above 512 GB is not supported (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_SMI_OPERATION_PARAMETERS:
        ShowMessages("err, invalid SMI operation parameter(s) are specified (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_TRIGGER_SMI:
        ShowMessages("err, unable to trigger SMI, are you running on a nested-virtualization environment? (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_UNABLE_TO_APPLY_COMMAND_TO_THE_TARGET_THREAD:
        ShowMessages("err, unable to apply command to the target thread (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_HYPERTRACE_NOT_INITIALIZED:
        ShowMessages("err, the hypertrace module is not loaded and initialized, "
                     "use the 'load trace' command to load the hypertrace module  (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_INVALID_HYPERTRACE_OPERATION_TYPE:
        ShowMessages("err, invalid hypertrace operation type is specified (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_LBR_ALREADY_ENABLED:
        ShowMessages("err, LBR is already enabled, you can disable it using the '!lbr' command (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_LBR_ALREADY_DISABLED:
        ShowMessages("err, LBR is already disabled, you can enable it using the '!lbr' command (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_LBR_NOT_SUPPORTED:
        ShowMessages("err, LBR is not supported on this processor, this is likely caused by running inside "
                     "a nested virtualization (VM) environment that masks and removes LBR CPU flags (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_LBR_NOT_SUPPORTED_ON_VMCS:
        ShowMessages("err, LBR is not supported on VMCS (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PT_ALREADY_ENABLED:
        ShowMessages("err, PT is already enabled (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PT_ALREADY_DISABLED:
        ShowMessages("err, PT is already disabled (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_PT_NOT_SUPPORTED:
        ShowMessages("err, PT is not supported on this processor (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_VMM_CANNOT_BE_INITIALIZED_IF_HYPERTRACE_IS_LOADED:
        ShowMessages("err, hypertrace is already loaded, please unload hypertrace module using the "
                     "'unload' command and then load the 'VMM' module. Then you can load hypertrace "
                     "after loading the VMM as it is because hypertrace behaves differently to sync "
                     "with VMM modules; it needs to have this notion that it is running within the "
                     "hypervisor, so that is why it needs to be initialized again if the VMM module "
                     "is loaded (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_VMM_CANNOT_BE_INITIALIZED_IF_DEBUGGER_IS_NOT_LOADED:
        ShowMessages("err, the VMM module cannot be initialized because the debugger is not loaded (%x)\n",
                     Error);
        break;
 
    case DEBUGGER_ERROR_CANNOT_INITIALIZE_DEBUGGER:
        ShowMessages("err, cannot initialize the debugger (%x)\n",
                     Error);
        break;
 
    default:
        ShowMessages("err, error not found (%x)\n",
                     Error);
        return FALSE;
        break;
    }
 
    return TRUE;
}

Variable Documentation

g_ActiveProcessDebuggingState

ACTIVE_DEBUGGING_PROCESS g_ActiveProcessDebuggingState

extern

State of active debugging thread.

{0};

g_AutoUnpause

BOOLEAN g_AutoUnpause

extern

Whether auto-unpause mode is enabled or not enabled.

it is enabled by default

g_BreakPrintingOutput

BOOLEAN g_BreakPrintingOutput

extern

Shows whether the pause command or CTRL+C or CTRL+Break is executed or not.

g_EventTag

UINT64 g_EventTag

extern

This variable holds the trace and generate numbers for new tags of events.

g_EventTrace

LIST_ENTRY g_EventTrace

extern

Holds a list of events in kernel and the state of events and the commands to show the state of each command (disabled/enabled).

this list is not have any relation with the things that HyperDbg holds for each event in the kernel

{0};

g_EventTraceInitialized

BOOLEAN g_EventTraceInitialized

extern

it shows whether the debugger started using events or not or in other words, is g_EventTrace initialized with a variable or it is empty

g_IsConnectedToRemoteDebuggee

BOOLEAN g_IsConnectedToRemoteDebuggee

extern

Shows whether the current debugger is the host and connected to a remote debuggee (guest).

g_IsConnectedToRemoteDebugger

BOOLEAN g_IsConnectedToRemoteDebugger

extern

Shows whether the current system is a guest (debuggee) and a remote debugger is connected to this system.

g_IsKdModuleLoaded

BOOLEAN g_IsKdModuleLoaded

extern

shows whether the kernel debugger (KD) module is loaded or not

g_IsSerialConnectedToRemoteDebuggee

BOOLEAN g_IsSerialConnectedToRemoteDebuggee

extern

Shows if the debugger was connected to remote debuggee over (A remote guest).

g_IsSerialConnectedToRemoteDebugger

BOOLEAN g_IsSerialConnectedToRemoteDebugger

extern

Shows if the debugger was connected to remote debugger (A remote host).

g_IsVmmModuleLoaded

BOOLEAN g_IsVmmModuleLoaded

extern

shows whether the VMM module is loaded or not

g_KernelBaseAddress

UINT64 g_KernelBaseAddress

extern

Shows the kernel base address.

g_OutputSources

LIST_ENTRY g_OutputSources

extern

Holds a list of output sources created by output command.

user-mode events and output sources are two separate things in HyperDbg

{0};

g_OutputSourcesInitialized

BOOLEAN g_OutputSourcesInitialized

extern

it shows whether the debugger started using output sources or not or in other words, is g_OutputSources initialized with a variable or it is empty