hyperdbg-ipt.cpp File Reference

#include "pch.h"
#include <string.h>
#include <stdlib.h>
#include <dbghelp.h>
#include "../dependencies/libipt/intel-pt.h"
#include <Zydis/Zydis.h>

Classes
struct	_PROC_BASIC_INFO

Typedefs
typedef struct _PROC_BASIC_INFO	PROC_BASIC_INFO
typedef LONG(NTAPI *	PFN_NT_QIP) (HANDLE, ULONG, PVOID, ULONG, PULONG)

Functions
int	main2 (int argc, char **argv)

Typedef Documentation

PFN_NT_QIP

typedef LONG(NTAPI * PFN_NT_QIP) (HANDLE, ULONG, PVOID, ULONG, PULONG)

PROC_BASIC_INFO

typedef struct _PROC_BASIC_INFO PROC_BASIC_INFO

Function Documentation

main2()

int main2	(	int	argc,
		char **	argv )

{
    const char * function = "main";
    BOOLEAN      packets  = FALSE;
    int          pinCore  = 0;
 
    if (argc < 2)
    {
        printf("HyperDbg Intel PT tracer\n");
        printf("usage: %s <path-to-exe-that-exits> [function] [-p] [-c core]\n", argv[0]);
        printf("  [function]  symbol to IP-filter (default 'main'; pass '*' for whole .text)\n");
        printf("  -p          dump raw PT packets (TNT/TIP/FUP/PSB/...) instead of instructions\n");
        printf("  -c core     pin the target to this logical core (default 0; -1 = unpinned)\n");
        return 1;
    }
 
    for (int i = 2; i < argc; i++)
    {
        if (strcmp(argv[i], "-p") == 0 || strcmp(argv[i], "--packets") == 0)
            packets = TRUE;
        else if (strcmp(argv[i], "-c") == 0 && i + 1 < argc)
            pinCore = atoi(argv[++i]);
        else if (strcmp(argv[i], "*") == 0)
            function = NULL;
        else
            function = argv[i];
    }
 
    if (LoadVmmAndTrace() != 0)
    {
        return 1;
    }
        
    RunAndTrace(argv[1], function, packets, pinCore);
 
    printf("[*] unloading HyperDbg VMM...\n");
 
    //
    // Unload the driver
    //
    hyperdbg_u_unload_vmm();
    hyperdbg_u_unload_kd();
    hyperdbg_u_stop_kd_driver();
    hyperdbg_u_uninstall_kd_driver();
 
    printf("[+] done\n");
 
    return 0;
}