export.cpp File Reference

Exported functions from libhyperdbg interface. More...

#include "pch.h"

Functions
BOOLEAN	hyperdbg_u_detect_vmx_support ()
	Detects the support of VMX.
VOID	hyperdbg_u_read_vendor_string (CHAR *vendor_string)
	Read the vendor string of the CPU.
INT	hyperdbg_u_load_vmm ()
	Load the VMM.
BOOLEAN	hyperdbg_u_is_any_module_loaded ()
	Check if any module is loaded.
INT	hyperdbg_u_unload_all_modules ()
	Unload all modules.
INT	hyperdbg_u_unload_vmm ()
	Unload the VMM module.
INT	hyperdbg_u_unload_hypertrace_module ()
	Unload the trace module.
INT	hyperdbg_u_unload_kd ()
	Unload the KD module.
INT	hyperdbg_u_install_kd_driver ()
	Install the KD driver.
INT	hyperdbg_u_uninstall_kd_driver ()
	Uninstall the KD (Kernel Debugger) driver.
INT	hyperdbg_u_start_kd_driver ()
	Start the KD driver.
INT	hyperdbg_u_stop_kd_driver ()
	Stop the KD driver.
GENERIC_PROCESSOR_VENDOR	hyperdbg_u_get_processor_vendor ()
	Get the vendor of the current processor.
INT	hyperdbg_u_load_kd_module ()
	Load the KD module.
INT	hyperdbg_u_load_hypertrace_module ()
	Load the hypertrace module.
INT	hyperdbg_u_load_all_modules ()
	Load all modules.
INT	hyperdbg_u_run_command (CHAR *command)
	Run a command.
BOOLEAN	hyperdbg_u_test_command_parser (CHAR *command, UINT32 number_of_tokens, CHAR **tokens_list, UINT32 *failed_token_num, UINT32 *failed_token_position)
	Parse the command (used for testing purposes).
VOID	hyperdbg_u_test_command_parser_show_tokens (CHAR *command)
	Parse and show tokens for the command (used for testing purposes).
VOID	hyperdbg_u_show_signature ()
	Show the signature of the debugger.
VOID	hyperdbg_u_set_text_message_callback (PVOID handler)
	Set the function callback that will be called if any message needs to be shown (by passing message as a parameter).
PVOID	hyperdbg_u_set_text_message_callback_using_shared_buffer (PVOID handler)
	Set the function callback that will be called if any message needs to be shown (using shared buffer method).
VOID	hyperdbg_u_unset_text_message_callback ()
	Unset the function callback that will be called if any message needs to be shown.
INT	hyperdbg_u_script_read_file_and_execute_commandline (INT argc, CHAR *argv[])
	Parsing the command line options for scripts.
BOOLEAN	hyperdbg_u_continue_previous_command ()
	Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.
BOOLEAN	hyperdbg_u_check_multiline_command (CHAR *current_command, BOOLEAN reset)
	Check if the command is a multiline command or not.
VOID	hyperdbg_u_connect_local_debugger ()
	Connect to the local debugger.
BOOLEAN	hyperdbg_u_connect_remote_debugger (const CHAR *ip, const CHAR *port)
	Connect to the remote debugger.
VOID	hyperdbg_u_continue_debuggee ()
	Continue the debuggee (equal to the 'g' command).
VOID	hyperdbg_u_pause_debuggee ()
	Pause the debuggee (equal to the 'pause' command).
BOOLEAN	hyperdbg_u_set_breakpoint (UINT64 address, UINT32 pid, UINT32 tid, UINT32 core_number)
	Set a breakpoint.
BOOLEAN	hyperdbg_u_set_custom_driver_path (CHAR *driver_file_path, CHAR *driver_name)
	Set custom driver path.
VOID	hyperdbg_u_use_default_driver_path ()
	Use the default driver path.
BOOLEAN	hyperdbg_u_read_memory (UINT64 target_address, DEBUGGER_READ_MEMORY_TYPE memory_type, DEBUGGER_READ_READING_TYPE reading_Type, UINT32 pid, UINT32 size, BOOLEAN get_address_mode, DEBUGGER_READ_MEMORY_ADDRESS_MODE *address_mode, BYTE *target_buffer_to_store, UINT32 *return_length)
	Read memory and disassembler.
VOID	hyperdbg_u_show_memory_or_disassemble (DEBUGGER_SHOW_MEMORY_STYLE style, UINT64 address, DEBUGGER_READ_MEMORY_TYPE memory_type, DEBUGGER_READ_READING_TYPE reading_type, UINT32 pid, UINT32 size, PDEBUGGER_DT_COMMAND_OPTIONS dt_details)
	Show memory or disassembler.
BOOLEAN	hyperdbg_u_read_all_registers (GUEST_REGS *guest_registers, GUEST_EXTRA_REGISTERS *extra_registers)
	Read all registers.
BOOLEAN	hyperdbg_u_read_target_register (REGS_ENUM register_id, UINT64 *target_register)
	Read target register.
BOOLEAN	hyperdbg_u_write_target_register (REGS_ENUM register_id, UINT64 value)
	Write target register.
BOOLEAN	hyperdbg_u_show_all_registers ()
	Show all registers.
BOOLEAN	hyperdbg_u_show_target_register (REGS_ENUM register_id)
	Show target register.
BOOLEAN	hyperdbg_u_write_memory (PVOID destination_address, DEBUGGER_EDIT_MEMORY_TYPE memory_type, UINT32 process_id, PVOID source_address, UINT32 number_of_bytes)
	Write memory.
UINT64	hyperdbg_u_get_kernel_base ()
	Get the kernel base.
BOOLEAN	hyperdbg_u_connect_remote_debugger_using_com_port (const CHAR *port_name, DWORD baudrate, BOOLEAN pause_after_connection)
	Connect to the remote debugger using COM port.
BOOLEAN	hyperdbg_u_connect_remote_debugger_using_named_pipe (const CHAR *named_pipe, BOOLEAN pause_after_connection)
	Connect to the remote debugger using named pipe.
BOOLEAN	hyperdbg_u_debug_close_remote_debugger ()
	Close the remote debugger.
BOOLEAN	hyperdbg_u_connect_current_debugger_using_com_port (const CHAR *port_name, DWORD baudrate)
	Connect to the current debugger using COM port.
BOOLEAN	hyperdbg_u_start_process (const WCHAR *path)
	Start a new process.
BOOLEAN	hyperdbg_u_start_process_with_args (const WCHAR *path, const WCHAR *arguments)
	Start a new process.
BOOLEAN	hyperdbg_u_assemble_get_length (const CHAR *assembly_code, UINT64 start_address, UINT32 *length)
	Assembler function to get the length of the assembly code.
BOOLEAN	hyperdbg_u_assemble (const CHAR *assembly_code, UINT64 start_address, PVOID buffer_to_store_assembled_data, UINT32 buffer_size)
	Assembler function.
BOOLEAN	hyperdbg_u_setup_path_for_filename (const CHAR *filename, CHAR *file_location, UINT32 buffer_len, BOOLEAN check_file_existence)
	Setip the path for the filename.
BOOLEAN	hyperdbg_u_stepping_instrumentation_step_in ()
	Perform instrumentation step-in.
BOOLEAN	hyperdbg_u_stepping_regular_step_in ()
	Perform regular step-in.
BOOLEAN	hyperdbg_u_stepping_step_over ()
	Perform step-over.
BOOLEAN	hyperdbg_u_stepping_instrumentation_step_in_for_tracking ()
	Perform instrumentation step-in for tracking.
BOOLEAN	hyperdbg_u_stepping_step_over_for_gu (BOOLEAN last_instruction)
	Perform step-over for gu.
BOOLEAN	hyperdbg_u_get_local_apic (PLAPIC_PAGE local_apic, BOOLEAN *is_using_x2apic)
	Get Local APIC.
BOOLEAN	hyperdbg_u_get_io_apic (IO_APIC_ENTRY_PACKETS *io_apic)
	Get I/O APIC.
BOOLEAN	hyperdbg_u_get_idt_entry (INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS *idt_packet)
	Get IDT entry.
BOOLEAN	hyperdbg_u_perform_smi_operation (SMI_OPERATION_PACKETS *SmiOperation)
	Perform SMI operation.
BOOLEAN	hwdbg_script_run_script (const CHAR *script, const CHAR *instance_filepath_to_read, const CHAR *hardware_script_file_path_to_save, UINT32 initial_bram_buffer_size)
	Run hwdbg script.
VOID	hwdbg_script_engine_wrapper_test_parser (const char *Expr)
	Run (test evaluation) hwdbg script.
BOOLEAN	hyperdbg_u_enable_transparent_mode (UINT32 ProcessId, CHAR *ProcessName, BOOLEAN IsProcessId)
	Enable transparent mode.
BOOLEAN	hyperdbg_u_enable_transparent_mode_ex (UINT32 ProcessId, CHAR *ProcessName, BOOLEAN IsProcessId, UINT32 EvadeMask)
	Enable transparent mode with a feature mask.
BOOLEAN	hyperdbg_u_disable_transparent_mode ()
	Disable transparent mode.
BOOLEAN	hyperdbg_u_run_script (CHAR *Expr, BOOLEAN ShowErrorMessageIfAny)
	Run HyperDbg scripts in the target process (user debugger) or debuggee (kernel debugger).
UINT64	hyperdbg_u_eval_expression (CHAR *Expr, PBOOLEAN HasError)
	Evaluate expression and return result based on the target process (user debugger) or debuggee (kernel debugger) context.
BOOLEAN	hyperdbg_u_lbr_dump (HYPERTRACE_LBR_DUMP_PACKETS *LbrdumpRequest)
	Dump LBR stack.
BOOLEAN	hyperdbg_u_pt_operation (HYPERTRACE_PT_OPERATION_PACKETS *PtRequest)
	Perform an Intel PT operation (enable / disable / pause / resume / size / dump / flush / filter).
BOOLEAN	hyperdbg_u_pt_mmap (HYPERTRACE_PT_MMAP_PACKETS *MmapRequest)
	Map the per-CPU Intel PT output buffers into the calling process.

Variables
TCHAR	g_DriverLocation [MAX_PATH]
	Holds the location driver to install it.
TCHAR	g_DriverName [MAX_PATH]
	Holds the name of the driver to install it.
BOOLEAN	g_UseCustomDriverLocation
	Whether the user wants to use a custom driver location or not.

Detailed Description

Exported functions from libhyperdbg interface.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

jtaw5649

Version

0.10

Date

2024-06-24

Copyright

This project is released under the GNU Public License v3.

Function Documentation

hwdbg_script_engine_wrapper_test_parser()

VOID hwdbg_script_engine_wrapper_test_parser

(

const char *

Expr

)

Run (test evaluation) hwdbg script.

Parameters

Expr

Returns

VOID

{
    std::string StrExpr = Expr; // Convert const char* to std::string
    ScriptEngineWrapperTestParserForHwdbg(StrExpr);
}

hwdbg_script_run_script()

BOOLEAN hwdbg_script_run_script	(	const CHAR *	script,
		const CHAR *	instance_filepath_to_read,
		const CHAR *	hardware_script_file_path_to_save,
		UINT32	initial_bram_buffer_size )

Run hwdbg script.

Parameters

script
instance_filepath_to_read
hardware_script_file_path_to_save
initial_bram_buffer_size

Returns

BOOLEAN

{
    return HwdbgScriptRunScript(script,
                                instance_filepath_to_read,
                                hardware_script_file_path_to_save,
                                initial_bram_buffer_size);
}

hyperdbg_u_assemble()

BOOLEAN hyperdbg_u_assemble	(	const CHAR *	assembly_code,
		UINT64	start_address,
		PVOID	buffer_to_store_assembled_data,
		UINT32	buffer_size )

Assembler function.

Parameters

assembly_code	The assembly code
start_address	The start address of the assembly code
buffer_to_store_assembled_data	The buffer to store the assembled data
buffer_size	The size of the buffer

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgAssemble(assembly_code, start_address, buffer_to_store_assembled_data, buffer_size);
}

hyperdbg_u_assemble_get_length()

BOOLEAN hyperdbg_u_assemble_get_length	(	const CHAR *	assembly_code,
		UINT64	start_address,
		UINT32 *	length )

Assembler function to get the length of the assembly code.

Parameters

assembly_code	The assembly code
start_address	The start address of the assembly code
length	The length of the assembly code

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgAssembleGetLength(assembly_code, start_address, length);
}

hyperdbg_u_check_multiline_command()

BOOLEAN hyperdbg_u_check_multiline_command	(	CHAR *	current_command,
		BOOLEAN	reset )

Check if the command is a multiline command or not.

Parameters

current_command	The current command
reset	If it's true, it will reset the multiline command

Returns

BOOLEAN

{
    return CheckMultilineCommand(current_command, reset);
}

hyperdbg_u_connect_current_debugger_using_com_port()

BOOLEAN hyperdbg_u_connect_current_debugger_using_com_port	(	const CHAR *	port_name,
		DWORD	baudrate )

Connect to the current debugger using COM port.

Parameters

port_name	The port name
baudrate	The baudrate

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgDebugCurrentDeviceUsingComPort(port_name, baudrate);
}

hyperdbg_u_connect_local_debugger()

VOID hyperdbg_u_connect_local_debugger

(

)

Connect to the local debugger.

Returns

VOID

{
    ConnectLocalDebugger();
}

hyperdbg_u_connect_remote_debugger()

BOOLEAN hyperdbg_u_connect_remote_debugger	(	const CHAR *	ip,
		const CHAR *	port )

Connect to the remote debugger.

Parameters

ip	The IP address of the remote debugger
port	The port of the remote debugger

Returns

BOOLEAN Returns true if it was successful

{
    return ConnectRemoteDebugger(ip, port);
}

hyperdbg_u_connect_remote_debugger_using_com_port()

BOOLEAN hyperdbg_u_connect_remote_debugger_using_com_port	(	const CHAR *	port_name,
		DWORD	baudrate,
		BOOLEAN	pause_after_connection )

Connect to the remote debugger using COM port.

Parameters

port_name	The port name
baudrate	The baudrate
pause_after_connection	Pause after connection

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgDebugRemoteDeviceUsingComPort(port_name, baudrate, pause_after_connection);
}

hyperdbg_u_connect_remote_debugger_using_named_pipe()

BOOLEAN hyperdbg_u_connect_remote_debugger_using_named_pipe	(	const CHAR *	named_pipe,
		BOOLEAN	pause_after_connection )

Connect to the remote debugger using named pipe.

Parameters

named_pipe	The named pipe
pause_after_connection	Pause after connection

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgDebugRemoteDeviceUsingNamedPipe(named_pipe, pause_after_connection);
}

hyperdbg_u_continue_debuggee()

VOID hyperdbg_u_continue_debuggee

(

)

Continue the debuggee (equal to the 'g' command).

Returns

VOID

{
    CommandGRequest();
}

hyperdbg_u_continue_previous_command()

BOOLEAN hyperdbg_u_continue_previous_command

(

)

Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.

Returns

TRUE means the command should be continued, FALSE means command should be ignored

{
    return ContinuePreviousCommand();
}

hyperdbg_u_debug_close_remote_debugger()

BOOLEAN hyperdbg_u_debug_close_remote_debugger

(

)

Close the remote debugger.

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgDebugCloseRemoteDebugger();
}

hyperdbg_u_detect_vmx_support()

BOOLEAN hyperdbg_u_detect_vmx_support

(

)

Detects the support of VMX.

Returns

BOOLEAN Returns true if the CPU supports VMX

{
    return VmxSupportDetection();
}

hyperdbg_u_disable_transparent_mode()

BOOLEAN hyperdbg_u_disable_transparent_mode

(

)

Disable transparent mode.

Returns

BOOLEAN

{
    return HyperDbgDisableTransparentMode();
}

hyperdbg_u_enable_transparent_mode()

BOOLEAN hyperdbg_u_enable_transparent_mode	(	UINT32	ProcessId,
		CHAR *	ProcessName,
		BOOLEAN	IsProcessId )

Enable transparent mode.

Parameters

ProcessId	The process ID to enable transparent mode for
ProcessName	The process name to enable transparent mode for
IsProcessId	If true, ProcessId is used, otherwise ProcessName is used

Returns

BOOLEAN

{
    return HyperDbgEnableTransparentMode(ProcessId, ProcessName, IsProcessId);
}

hyperdbg_u_enable_transparent_mode_ex()

BOOLEAN hyperdbg_u_enable_transparent_mode_ex	(	UINT32	ProcessId,
		CHAR *	ProcessName,
		BOOLEAN	IsProcessId,
		UINT32	EvadeMask )

Enable transparent mode with a feature mask.

Parameters

ProcessId	The process ID to enable transparent mode for
ProcessName	The process name to enable transparent mode for
IsProcessId	If true, ProcessId is used, otherwise ProcessName is used
EvadeMask	The transparent-mode feature mask, or zero for default behavior

Returns

BOOLEAN

{
    return HyperDbgEnableTransparentModeEx(ProcessId, ProcessName, IsProcessId, EvadeMask);
}

hyperdbg_u_eval_expression()

UINT64 hyperdbg_u_eval_expression	(	CHAR *	Expr,
		PBOOLEAN	HasError )

Evaluate expression and return result based on the target process (user debugger) or debuggee (kernel debugger) context.

Parameters

Expr	The expression to evaluate
HasError	If true, there was an error in evaluation

Returns

UINT64 The result of the evaluated expression

{
    return ScriptEngineEvalSingleExpression(Expr, HasError);
}

hyperdbg_u_get_idt_entry()

BOOLEAN hyperdbg_u_get_idt_entry

(

INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS *

idt_packet

)

Get IDT entry.

Parameters

idt_packet

Returns

BOOLEAN

{
    return HyperDbgGetIdtEntry(idt_packet);
}

hyperdbg_u_get_io_apic()

BOOLEAN hyperdbg_u_get_io_apic

(

IO_APIC_ENTRY_PACKETS *

io_apic

)

Get I/O APIC.

Parameters

io_apic

Returns

BOOLEAN

{
    return HyperDbgGetIoApic(io_apic);
}

hyperdbg_u_get_kernel_base()

UINT64 hyperdbg_u_get_kernel_base

(

)

Get the kernel base.

Returns

UINT64 The kernel base

{
    return DebuggerGetKernelBase();
}

hyperdbg_u_get_local_apic()

BOOLEAN hyperdbg_u_get_local_apic	(	PLAPIC_PAGE	local_apic,
		BOOLEAN *	is_using_x2apic )

Get Local APIC.

The system automatically detects whether to read it in the xAPIC or x2APIC mode

Parameters

local_apic
is_using_x2apic

Returns

BOOLEAN

{
    return HyperDbgGetLocalApic(local_apic, is_using_x2apic);
}

hyperdbg_u_get_processor_vendor()

GENERIC_PROCESSOR_VENDOR hyperdbg_u_get_processor_vendor

(

)

Get the vendor of the current processor.

Returns

GENERIC_PROCESSOR_VENDOR the vendor of the processor

{
    return HyperDbgGetProcessorVendor();
}

hyperdbg_u_install_kd_driver()

INT hyperdbg_u_install_kd_driver

(

)

Install the KD driver.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgInstallKdDriver();
}

hyperdbg_u_is_any_module_loaded()

BOOLEAN hyperdbg_u_is_any_module_loaded

(

)

Check if any module is loaded.

Returns

BOOLEAN Returns true if any module is loaded and false if no module is loaded

{
    return HyperDbgIsAnyModuleLoaded();
}

hyperdbg_u_lbr_dump()

BOOLEAN hyperdbg_u_lbr_dump

(

HYPERTRACE_LBR_DUMP_PACKETS *

LbrdumpRequest

)

Dump LBR stack.

Parameters

LbrdumpRequest

The LBR dump request packet

Returns

BOOLEAN

{
    return HyperDbgLbrdumpSendRequest(LbrdumpRequest);
}

hyperdbg_u_load_all_modules()

INT hyperdbg_u_load_all_modules

(

)

Load all modules.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgLoadAllModules();
}

hyperdbg_u_load_hypertrace_module()

INT hyperdbg_u_load_hypertrace_module

(

)

Load the hypertrace module.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgLoadHyperTraceModule();
}

hyperdbg_u_load_kd_module()

INT hyperdbg_u_load_kd_module

(

)

Load the KD module.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgLoadKdModule();
}

hyperdbg_u_load_vmm()

INT hyperdbg_u_load_vmm

(

)

Load the VMM.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgLoadVmmModule();
}

hyperdbg_u_pause_debuggee()

VOID hyperdbg_u_pause_debuggee

(

)

Pause the debuggee (equal to the 'pause' command).

Returns

VOID

{
    CommandPauseRequest();
}

hyperdbg_u_perform_smi_operation()

BOOLEAN hyperdbg_u_perform_smi_operation

(

SMI_OPERATION_PACKETS *

SmiOperation

)

Perform SMI operation.

Parameters

SmiOperation

The SMI operation packet

Returns

{
    return HyperDbgPerformSmiOperation(SmiOperation);
}

hyperdbg_u_pt_mmap()

BOOLEAN hyperdbg_u_pt_mmap

(

HYPERTRACE_PT_MMAP_PACKETS *

MmapRequest

)

Map the per-CPU Intel PT output buffers into the calling process.

Parameters

MmapRequest

The PT mmap request packet; filled with per-CPU { UserVa, Size } on success

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgPtMmapSendRequest(MmapRequest);
}

hyperdbg_u_pt_operation()

BOOLEAN hyperdbg_u_pt_operation

(

HYPERTRACE_PT_OPERATION_PACKETS *

PtRequest

)

Perform an Intel PT operation (enable / disable / pause / resume / size / dump / flush / filter).

Parameters

PtRequest

The PT operation request packet

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgPerformPtOperation(PtRequest);
}

hyperdbg_u_read_all_registers()

BOOLEAN hyperdbg_u_read_all_registers	(	GUEST_REGS *	guest_registers,
		GUEST_EXTRA_REGISTERS *	extra_registers )

Read all registers.

Parameters

guest_registers	The buffer to store the registers
extra_registers	The buffer to store the extra registers

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgReadAllRegisters(guest_registers, extra_registers);
}

hyperdbg_u_read_memory()

BOOLEAN hyperdbg_u_read_memory	(	UINT64	target_address,
		DEBUGGER_READ_MEMORY_TYPE	memory_type,
		DEBUGGER_READ_READING_TYPE	reading_Type,
		UINT32	pid,
		UINT32	size,
		BOOLEAN	get_address_mode,
		DEBUGGER_READ_MEMORY_ADDRESS_MODE *	address_mode,
		BYTE *	target_buffer_to_store,
		UINT32 *	return_length )

Read memory and disassembler.

Parameters

target_address	location of where to read the memory
memory_type	type of memory (phyical or virtual)
reading_Type	read from kernel or vmx-root
pid	The target process id
size	size of memory to read
get_address_mode	check for address mode
address_mode	Address mode (32 or 64)
target_buffer_to_store	The buffer to store the read memory
return_length	The length of the read memory

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgReadMemory(target_address, memory_type, reading_Type, pid, size, get_address_mode, address_mode, target_buffer_to_store, return_length);
}

hyperdbg_u_read_target_register()

BOOLEAN hyperdbg_u_read_target_register	(	REGS_ENUM	register_id,
		UINT64 *	target_register )

Read target register.

Parameters

register_id	The target register
target_register	The buffer to store the register

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgReadTargetRegister(register_id, target_register);
}

hyperdbg_u_read_vendor_string()

VOID hyperdbg_u_read_vendor_string

(

CHAR *

vendor_string

)

Read the vendor string of the CPU.

Parameters

vendor_string

The buffer to store the vendor string

Returns

VOID

{
    CpuReadVendorString(vendor_string);
}

hyperdbg_u_run_command()

INT hyperdbg_u_run_command

(

CHAR *

command

)

Run a command.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgInterpreter(command);
}

hyperdbg_u_run_script()

BOOLEAN hyperdbg_u_run_script	(	CHAR *	Expr,
		BOOLEAN	ShowErrorMessageIfAny )

Run HyperDbg scripts in the target process (user debugger) or debuggee (kernel debugger).

Parameters

Expr	The expression to run
ShowErrorMessageIfAny	If true, show error message if any

Returns

BOOLEAN

{
    return ScriptEngineExecuteSingleExpression(Expr, ShowErrorMessageIfAny, FALSE);
}

hyperdbg_u_script_read_file_and_execute_commandline()

INT hyperdbg_u_script_read_file_and_execute_commandline	(	INT	argc,
		CHAR *	argv[] )

Parsing the command line options for scripts.

Parameters

argc
argv

Returns

INT

{
    return HyperDbgScriptReadFileAndExecuteCommandline(argc, argv);
}

hyperdbg_u_set_breakpoint()

BOOLEAN hyperdbg_u_set_breakpoint	(	UINT64	address,
		UINT32	pid,
		UINT32	tid,
		UINT32	core_number )

Set a breakpoint.

Parameters

address	The address of the breakpoint
pid	The process ID of the breakpoint
tid	The thread ID of the breakpoint
core_number	The core number of the breakpoint

Returns

BOOLEAN

{
    return CommandBpRequest(address, pid, tid, core_number);
}

hyperdbg_u_set_custom_driver_path()

BOOLEAN hyperdbg_u_set_custom_driver_path	(	CHAR *	driver_file_path,
		CHAR *	driver_name )

Set custom driver path.

Parameters

driver_file_path	The path of the driver
driver_name	The name of the driver

Returns

BOOLEAN Returns true if it was successful

{
    if (strlen(driver_file_path) > MAX_PATH)
    {
        ShowMessages("The driver path is too long, the maximum length is %d\n", MAX_PATH);
        return FALSE;
    }
 
    if (strlen(driver_name) > MAX_PATH)
    {
        ShowMessages("The driver name is too long, the maximum length is %d\n", MAX_PATH);
        return FALSE;
    }
 
    //
    // Copy the driver path
    //
    strcpy_s(g_DriverLocation, MAX_PATH, driver_file_path);
 
    //
    // Copy the driver name
    //
    strcpy_s(g_DriverName, MAX_PATH, driver_name);
 
    //
    // Set the flag to use the custom driver path
    //
    g_UseCustomDriverLocation = TRUE;
 
    return TRUE;
}

hyperdbg_u_set_text_message_callback()

VOID hyperdbg_u_set_text_message_callback

(

PVOID

handler

)

Set the function callback that will be called if any message needs to be shown (by passing message as a parameter).

Parameters

handler

Function that handles the messages

Returns

VOID

{
    SetTextMessageCallback(handler);
}

hyperdbg_u_set_text_message_callback_using_shared_buffer()

PVOID hyperdbg_u_set_text_message_callback_using_shared_buffer

(

PVOID

handler

)

Set the function callback that will be called if any message needs to be shown (using shared buffer method).

Parameters

handler

Function that handles the messages

Returns

PVOID

{
    return SetTextMessageCallbackUsingSharedBuffer(handler);
}

hyperdbg_u_setup_path_for_filename()

BOOLEAN hyperdbg_u_setup_path_for_filename	(	const CHAR *	filename,
		CHAR *	file_location,
		UINT32	buffer_len,
		BOOLEAN	check_file_existence )

Setip the path for the filename.

Parameters

filename	The filename
file_location
buffer_len
check_file_existence

Returns

BOOLEAN

{
    return SetupPathForFileName(filename, file_location, buffer_len, check_file_existence);
}

hyperdbg_u_show_all_registers()

BOOLEAN hyperdbg_u_show_all_registers

(

)

Show all registers.

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgRegisterShowAll();
}

hyperdbg_u_show_memory_or_disassemble()

VOID hyperdbg_u_show_memory_or_disassemble	(	DEBUGGER_SHOW_MEMORY_STYLE	style,
		UINT64	address,
		DEBUGGER_READ_MEMORY_TYPE	memory_type,
		DEBUGGER_READ_READING_TYPE	reading_type,
		UINT32	pid,
		UINT32	size,
		PDEBUGGER_DT_COMMAND_OPTIONS	dt_details )

Show memory or disassembler.

Parameters

style	style of show memory (as byte, dwrod, qword)
address	location of where to read the memory
memory_type	type of memory (phyical or virtual)
reading_type	read from kernel or vmx-root
pid	The target process id
size	size of memory to read
dt_details	Options for dt structure show details

Returns

VOID

{
    HyperDbgShowMemoryOrDisassemble(style, address, memory_type, reading_type, pid, size, dt_details);
}

hyperdbg_u_show_signature()

VOID hyperdbg_u_show_signature

(

)

Show the signature of the debugger.

Returns

VOID

{
    HyperDbgShowSignature();
}

hyperdbg_u_show_target_register()

BOOLEAN hyperdbg_u_show_target_register

(

REGS_ENUM

register_id

)

Show target register.

Parameters

register_id

The target register

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgRegisterShowTargetRegister(register_id);
}

hyperdbg_u_start_kd_driver()

INT hyperdbg_u_start_kd_driver

(

)

Start the KD driver.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgStartKdDriver();
}

hyperdbg_u_start_process()

BOOLEAN hyperdbg_u_start_process

(

const WCHAR *

path

)

Start a new process.

Parameters

path	The path of the process

Returns

BOOLEAN Returns true if it was successful

{
    return UdAttachToProcess(NULL,
                             path,
                             NULL,
                             FALSE);
}

hyperdbg_u_start_process_with_args()

BOOLEAN hyperdbg_u_start_process_with_args	(	const WCHAR *	path,
		const WCHAR *	arguments )

Start a new process.

Parameters

path	The path of the process
arguments	The arguments of the process

Returns

BOOLEAN Returns true if it was successful

{
    return UdAttachToProcess(NULL,
                             path,
                             arguments,
                             FALSE);
}

hyperdbg_u_stepping_instrumentation_step_in()

BOOLEAN hyperdbg_u_stepping_instrumentation_step_in

(

)

Perform instrumentation step-in.

Returns

BOOLEAN

{
    return SteppingInstrumentationStepIn();
}

hyperdbg_u_stepping_instrumentation_step_in_for_tracking()

BOOLEAN hyperdbg_u_stepping_instrumentation_step_in_for_tracking

(

)

Perform instrumentation step-in for tracking.

Returns

BOOLEAN

{
    return SteppingInstrumentationStepInForTracking();
}

hyperdbg_u_stepping_regular_step_in()

BOOLEAN hyperdbg_u_stepping_regular_step_in

(

)

Perform regular step-in.

Returns

BOOLEAN

{
    return SteppingRegularStepIn();
}

hyperdbg_u_stepping_step_over()

BOOLEAN hyperdbg_u_stepping_step_over

(

)

Perform step-over.

Returns

BOOLEAN

{
    return SteppingStepOver();
}

hyperdbg_u_stepping_step_over_for_gu()

BOOLEAN hyperdbg_u_stepping_step_over_for_gu

(

BOOLEAN

last_instruction

)

Perform step-over for gu.

Parameters

last_instruction

Returns

BOOLEAN

{
    return SteppingStepOverForGu(last_instruction);
}

hyperdbg_u_stop_kd_driver()

INT hyperdbg_u_stop_kd_driver

(

)

Stop the KD driver.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgStopKdDriver();
}

hyperdbg_u_test_command_parser()

BOOLEAN hyperdbg_u_test_command_parser	(	CHAR *	command,
		UINT32	number_of_tokens,
		CHAR **	tokens_list,
		UINT32 *	failed_token_num,
		UINT32 *	failed_token_position )

Parse the command (used for testing purposes).

Parameters

command	The text of command
number_of_tokens	The number of tokens
tokens_list	The list of tokens

Returns

BOOLEAN returns true if the command was parsed successfully and false if there was an error

{
    return HyperDbgTestCommandParser(command, number_of_tokens, tokens_list, failed_token_num, failed_token_position);
}

hyperdbg_u_test_command_parser_show_tokens()

VOID hyperdbg_u_test_command_parser_show_tokens

(

CHAR *

command

)

Parse and show tokens for the command (used for testing purposes).

Parameters

command

The text of command

Returns

VOID

{
    return HyperDbgTestCommandParserShowTokens(command);
}

hyperdbg_u_uninstall_kd_driver()

INT hyperdbg_u_uninstall_kd_driver

(

)

Uninstall the KD (Kernel Debugger) driver.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgUninstallKdDriver();
}

hyperdbg_u_unload_all_modules()

INT hyperdbg_u_unload_all_modules

(

)

Unload all modules.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgUnloadAllModules();
}

hyperdbg_u_unload_hypertrace_module()

INT hyperdbg_u_unload_hypertrace_module

(

)

Unload the trace module.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgUnloadHyperTrace();
}

hyperdbg_u_unload_kd()

INT hyperdbg_u_unload_kd

(

)

Unload the KD module.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgUnloadKd();
}

hyperdbg_u_unload_vmm()

INT hyperdbg_u_unload_vmm

(

)

Unload the VMM module.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgUnloadVmm();
}

hyperdbg_u_unset_text_message_callback()

VOID hyperdbg_u_unset_text_message_callback

(

)

Unset the function callback that will be called if any message needs to be shown.

Returns

VOID

{
    UnsetTextMessageCallback();
}

hyperdbg_u_use_default_driver_path()

VOID hyperdbg_u_use_default_driver_path

(

)

Use the default driver path.

Returns

VOID

{
    //
    // Set the flag to use the default driver path
    //
    g_UseCustomDriverLocation = FALSE;
}

hyperdbg_u_write_memory()

BOOLEAN hyperdbg_u_write_memory	(	PVOID	destination_address,
		DEBUGGER_EDIT_MEMORY_TYPE	memory_type,
		UINT32	process_id,
		PVOID	source_address,
		UINT32	number_of_bytes )

Write memory.

Parameters

destination_address	The destination address
memory_type	The type of memory (physical or virtual)
process_id	The target process id (if it's virtual memory)
source_address	The source address
number_of_bytes	The number of bytes to write

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgWriteMemory(destination_address, memory_type, process_id, source_address, number_of_bytes);
}

hyperdbg_u_write_target_register()

BOOLEAN hyperdbg_u_write_target_register	(	REGS_ENUM	register_id,
		UINT64	value )

Write target register.

Parameters

register_id	The target register
value	The value to write

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgWriteTargetRegister(register_id, value);
}

Variable Documentation

g_DriverLocation

TCHAR g_DriverLocation[MAX_PATH]

extern

Holds the location driver to install it.

{0};

g_DriverName

TCHAR g_DriverName[MAX_PATH]

extern

Holds the name of the driver to install it.

{0};

g_UseCustomDriverLocation

BOOLEAN g_UseCustomDriverLocation

extern

Whether the user wants to use a custom driver location or not.