export.cpp File Reference

Exported functions from libhyperdbg interface. More...

#include "pch.h"

Functions
BOOLEAN	hyperdbg_u_detect_vmx_support ()
	Detects the support of VMX.
VOID	hyperdbg_u_read_vendor_string (CHAR *vendor_string)
	Read the vendor string of the CPU.
INT	hyperdbg_u_load_vmm ()
	Load the VMM.
INT	hyperdbg_u_unload_vmm ()
	Unload the VMM.
INT	hyperdbg_u_install_vmm_driver ()
	Install the VMM driver.
INT	hyperdbg_u_uninstall_vmm_driver ()
	Uninstall the VMM driver.
INT	hyperdbg_u_stop_vmm_driver ()
	Stop the VMM driver.
INT	hyperdbg_u_interpreter (CHAR *command)
	Interprets the command.
VOID	hyperdbg_u_show_signature ()
	Show the signature of the debugger.
VOID	hyperdbg_u_set_text_message_callback (PVOID handler)
	Set the function callback that will be called if any message needs to be shown (by passing message as a parameter)
PVOID	hyperdbg_u_set_text_message_callback_using_shared_buffer (PVOID handler)
	Set the function callback that will be called if any message needs to be shown (using shared buffer method)
VOID	hyperdbg_u_unset_text_message_callback ()
	Unset the function callback that will be called if any message needs to be shown.
INT	hyperdbg_u_script_read_file_and_execute_commandline (INT argc, CHAR *argv[])
	Parsing the command line options for scripts.
BOOLEAN	hyperdbg_u_continue_previous_command ()
	Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.
BOOLEAN	hyperdbg_u_check_multiline_command (CHAR *current_command, BOOLEAN reset)
	Check if the command is a multiline command or not.
VOID	hyperdbg_u_connect_local_debugger ()
	Connect to the local debugger.
BOOLEAN	hyperdbg_u_connect_remote_debugger (const CHAR *ip, const CHAR *port)
	Connect to the remote debugger.
VOID	hyperdbg_u_continue_debuggee ()
	Continue the debuggee (equal to the 'g' command)
VOID	hyperdbg_u_pause_debuggee ()
	Pause the debuggee (equal to the 'pause' command or CTRL+C)
VOID	hyperdbg_u_set_breakpoint (UINT64 address, UINT32 pid, UINT32 tid, UINT32 core_numer)
	Set a breakpoint.
BOOLEAN	hyperdbg_u_set_custom_driver_path (CHAR *driver_file_path, CHAR *driver_name)
	Set custom driver path.
VOID	hyperdbg_u_use_default_driver_path ()
	Use the default driver path.
BOOLEAN	hyperdbg_u_read_memory (UINT64 target_address, DEBUGGER_READ_MEMORY_TYPE memory_type, DEBUGGER_READ_READING_TYPE reading_Type, UINT32 pid, UINT32 size, BOOLEAN get_address_mode, DEBUGGER_READ_MEMORY_ADDRESS_MODE *address_mode, BYTE *target_buffer_to_store, UINT32 *return_length)
	Read memory and disassembler.
VOID	hyperdbg_u_show_memory_or_disassemble (DEBUGGER_SHOW_MEMORY_STYLE style, UINT64 address, DEBUGGER_READ_MEMORY_TYPE memory_type, DEBUGGER_READ_READING_TYPE reading_type, UINT32 pid, UINT32 size, PDEBUGGER_DT_COMMAND_OPTIONS dt_details)
	Show memory or disassembler.
BOOLEAN	hyperdbg_u_read_all_registers (GUEST_REGS *guest_registers, GUEST_EXTRA_REGISTERS *extra_registers)
	Read all registers.
BOOLEAN	hyperdbg_u_read_target_register (REGS_ENUM register_id, UINT64 *target_register)
	Read target register.
BOOLEAN	hyperdbg_u_write_target_register (REGS_ENUM register_id, UINT64 value)
	Write target register.
BOOLEAN	hyperdbg_u_show_all_registers ()
	Show all registers.
BOOLEAN	hyperdbg_u_show_target_register (REGS_ENUM register_id)
	Show target register.
BOOLEAN	hyperdbg_u_write_memory (PVOID destination_address, DEBUGGER_EDIT_MEMORY_TYPE memory_type, UINT32 process_id, PVOID source_address, UINT32 number_of_bytes)
	Write memory.
UINT64	hyperdbg_u_get_kernel_base ()
	Get the kernel base.
BOOLEAN	hyperdbg_u_connect_remote_debugger_using_com_port (const CHAR *port_name, DWORD baudrate)
	Connect to the remote debugger using COM port.
BOOLEAN	hyperdbg_u_connect_remote_debugger_using_named_pipe (const CHAR *named_pipe)
	Connect to the remote debugger using named pipe.
BOOLEAN	HyperDbgDebugCurrentDeviceUsingComPort (const CHAR *PortName, DWORD Baudrate)
	Connect to a remote serial device (Debuggee)
BOOLEAN	hyperdbg_u_connect_current_debugger_using_com_port (const CHAR *port_name, DWORD baudrate)
	Connect to the current debugger using COM port.
BOOLEAN	hyperdbg_u_start_process (const WCHAR *path)
	Start a new process.
BOOLEAN	hyperdbg_u_start_process_with_args (const WCHAR *path, const WCHAR *arguments)
	Start a new process.

Variables
TCHAR	g_DriverLocation [MAX_PATH]
	Holds the location driver to install it.
TCHAR	g_DriverName [MAX_PATH]
	Holds the name of the driver to install it.
BOOLEAN	g_UseCustomDriverLocation
	Whether the user wants to use a custom driver location or not.

Detailed Description

Exported functions from libhyperdbg interface.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

1.0

Date

2024-06-24

Copyright

This project is released under the GNU Public License v3.

Function Documentation

hyperdbg_u_check_multiline_command()

BOOLEAN hyperdbg_u_check_multiline_command	(	CHAR *	current_command,
		BOOLEAN	reset )

Check if the command is a multiline command or not.

Parameters

current_command	The current command
reset	If it's true, it will reset the multiline command

Returns

BOOLEAN

{
    return CheckMultilineCommand(current_command, reset);
}

hyperdbg_u_connect_current_debugger_using_com_port()

BOOLEAN hyperdbg_u_connect_current_debugger_using_com_port	(	const CHAR *	port_name,
		DWORD	baudrate )

Connect to the current debugger using COM port.

Parameters

port_name	The port name
baudrate	The baudrate

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgDebugCurrentDeviceUsingComPort(port_name, baudrate);
}

hyperdbg_u_connect_local_debugger()

VOID hyperdbg_u_connect_local_debugger

(

)

Connect to the local debugger.

Returns

VOID

{
    ConnectLocalDebugger();
}

hyperdbg_u_connect_remote_debugger()

BOOLEAN hyperdbg_u_connect_remote_debugger	(	const CHAR *	ip,
		const CHAR *	port )

Connect to the remote debugger.

Parameters

ip	The IP address of the remote debugger
port	The port of the remote debugger

Returns

BOOLEAN Returns true if it was successful

{
    return ConnectRemoteDebugger(ip, port);
}

hyperdbg_u_connect_remote_debugger_using_com_port()

BOOLEAN hyperdbg_u_connect_remote_debugger_using_com_port	(	const CHAR *	port_name,
		DWORD	baudrate )

Connect to the remote debugger using COM port.

Parameters

port_name	The port name
baudrate	The baudrate

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgDebugRemoteDeviceUsingComPort(port_name, baudrate);
}

hyperdbg_u_connect_remote_debugger_using_named_pipe()

BOOLEAN hyperdbg_u_connect_remote_debugger_using_named_pipe

(

const CHAR *

named_pipe

)

Connect to the remote debugger using named pipe.

Parameters

named_pipe

The named pipe

Returns

BOOLEAN Returns true if it was successful

{
    return HyperDbgDebugRemoteDeviceUsingNamedPipe(named_pipe);
}

hyperdbg_u_continue_debuggee()

VOID hyperdbg_u_continue_debuggee

(

)

Continue the debuggee (equal to the 'g' command)

Returns

VOID

{
    CommandGRequest();
}

hyperdbg_u_continue_previous_command()

BOOLEAN hyperdbg_u_continue_previous_command

(

)

Some of commands like stepping commands (i, p, t) and etc. need to be repeated when the user press enter, this function shows whether we should continue the previous command or not.

Returns

TRUE means the command should be continued, FALSE means command should be ignored

{
    return ContinuePreviousCommand();
}

hyperdbg_u_detect_vmx_support()

BOOLEAN hyperdbg_u_detect_vmx_support

(

)

Detects the support of VMX.

Returns

BOOLEAN Returns true if the CPU supports VMX

{
    return VmxSupportDetection();
}

hyperdbg_u_get_kernel_base()

UINT64 hyperdbg_u_get_kernel_base

(

)

Get the kernel base.

Returns

UINT64 The kernel base

{
    return DebuggerGetKernelBase();
}

hyperdbg_u_install_vmm_driver()

INT hyperdbg_u_install_vmm_driver

(

)

Install the VMM driver.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgInstallVmmDriver();
}

hyperdbg_u_interpreter()

INT hyperdbg_u_interpreter

(

CHAR *

command

)

Interprets the command.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgInterpreter(command);
}

hyperdbg_u_load_vmm()

INT hyperdbg_u_load_vmm

(

)

Load the VMM.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgLoadVmmModule();
}

hyperdbg_u_pause_debuggee()

VOID hyperdbg_u_pause_debuggee

(

)

Pause the debuggee (equal to the 'pause' command or CTRL+C)

Returns

VOID

{
    CommandPauseRequest();
}

hyperdbg_u_read_all_registers()

BOOLEAN hyperdbg_u_read_all_registers	(	GUEST_REGS *	guest_registers,
		GUEST_EXTRA_REGISTERS *	extra_registers )

Read all registers.

Parameters

guest_registers	The buffer to store the registers
extra_registers	The buffer to store the extra registers

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgReadAllRegisters(guest_registers, extra_registers);
}

hyperdbg_u_read_memory()

BOOLEAN hyperdbg_u_read_memory	(	UINT64	target_address,
		DEBUGGER_READ_MEMORY_TYPE	memory_type,
		DEBUGGER_READ_READING_TYPE	reading_Type,
		UINT32	pid,
		UINT32	size,
		BOOLEAN	get_address_mode,
		DEBUGGER_READ_MEMORY_ADDRESS_MODE *	address_mode,
		BYTE *	target_buffer_to_store,
		UINT32 *	return_length )

Read memory and disassembler.

Parameters

target_address	location of where to read the memory
memory_type	type of memory (phyical or virtual)
reading_Type	read from kernel or vmx-root
pid	The target process id
size	size of memory to read
get_address_mode	check for address mode
address_mode	Address mode (32 or 64)
target_buffer_to_store	The buffer to store the read memory
return_length	The length of the read memory

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgReadMemory(target_address, memory_type, reading_Type, pid, size, get_address_mode, address_mode, target_buffer_to_store, return_length);
}

hyperdbg_u_read_target_register()

BOOLEAN hyperdbg_u_read_target_register	(	REGS_ENUM	register_id,
		UINT64 *	target_register )

Read target register.

Parameters

register_id	The target register
target_register	The buffer to store the register

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgReadTargetRegister(register_id, target_register);
}

hyperdbg_u_read_vendor_string()

VOID hyperdbg_u_read_vendor_string

(

CHAR *

vendor_string

)

Read the vendor string of the CPU.

Parameters

vendor_string

The buffer to store the vendor string

Returns

VOID

{
    CpuReadVendorString(vendor_string);
}

hyperdbg_u_script_read_file_and_execute_commandline()

INT hyperdbg_u_script_read_file_and_execute_commandline	(	INT	argc,
		CHAR *	argv[] )

Parsing the command line options for scripts.

Parameters

argc
argv

Returns

INT

{
    return ScriptReadFileAndExecuteCommandline(argc, argv);
}

hyperdbg_u_set_breakpoint()

VOID hyperdbg_u_set_breakpoint	(	UINT64	address,
		UINT32	pid,
		UINT32	tid,
		UINT32	core_numer )

Set a breakpoint.

Parameters

address	The address of the breakpoint
pid	The process ID of the breakpoint
tid	The thread ID of the breakpoint
core_numer	The core number of the breakpoint

Returns

VOID

{
    CommandBpRequest(address, pid, tid, core_numer);
}

hyperdbg_u_set_custom_driver_path()

BOOLEAN hyperdbg_u_set_custom_driver_path	(	CHAR *	driver_file_path,
		CHAR *	driver_name )

Set custom driver path.

Parameters

driver_file_path	The path of the driver
driver_name	The name of the driver

Returns

BOOLEAN Returns true if it was successful

{
    if (strlen(driver_file_path) > MAX_PATH)
    {
        ShowMessages("The driver path is too long, the maximum length is %d\n", MAX_PATH);
        return FALSE;
    }
 
    if (strlen(driver_name) > MAX_PATH)
    {
        ShowMessages("The driver name is too long, the maximum length is %d\n", MAX_PATH);
        return FALSE;
    }
 
    //
    // Copy the driver path
    //
    strcpy_s(g_DriverLocation, MAX_PATH, driver_file_path);
 
    //
    // Copy the driver name
    //
    strcpy_s(g_DriverName, MAX_PATH, driver_name);
 
    //
    // Set the flag to use the custom driver path
    //
    g_UseCustomDriverLocation = TRUE;
 
    return TRUE;
}

hyperdbg_u_set_text_message_callback()

VOID hyperdbg_u_set_text_message_callback

(

PVOID

handler

)

Set the function callback that will be called if any message needs to be shown (by passing message as a parameter)

Parameters

handler

Function that handles the messages

Returns

VOID

{
    SetTextMessageCallback(handler);
}

hyperdbg_u_set_text_message_callback_using_shared_buffer()

PVOID hyperdbg_u_set_text_message_callback_using_shared_buffer

(

PVOID

handler

)

Set the function callback that will be called if any message needs to be shown (using shared buffer method)

Parameters

handler

Function that handles the messages

Returns

PVOID

{
    return SetTextMessageCallbackUsingSharedBuffer(handler);
}

hyperdbg_u_show_all_registers()

BOOLEAN hyperdbg_u_show_all_registers

(

)

Show all registers.

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgRegisterShowAll();
}

hyperdbg_u_show_memory_or_disassemble()

VOID hyperdbg_u_show_memory_or_disassemble	(	DEBUGGER_SHOW_MEMORY_STYLE	style,
		UINT64	address,
		DEBUGGER_READ_MEMORY_TYPE	memory_type,
		DEBUGGER_READ_READING_TYPE	reading_type,
		UINT32	pid,
		UINT32	size,
		PDEBUGGER_DT_COMMAND_OPTIONS	dt_details )

Show memory or disassembler.

Parameters

style	style of show memory (as byte, dwrod, qword)
address	location of where to read the memory
memory_type	type of memory (phyical or virtual)
reading_type	read from kernel or vmx-root
pid	The target process id
size	size of memory to read
dt_details	Options for dt structure show details

Returns

VOID

{
    HyperDbgShowMemoryOrDisassemble(style, address, memory_type, reading_type, pid, size, dt_details);
}

hyperdbg_u_show_signature()

VOID hyperdbg_u_show_signature

(

)

Show the signature of the debugger.

Returns

VOID

{
    HyperDbgShowSignature();
}

hyperdbg_u_show_target_register()

BOOLEAN hyperdbg_u_show_target_register

(

REGS_ENUM

register_id

)

Show target register.

Parameters

register_id

The target register

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgRegisterShowTargetRegister(register_id);
}

hyperdbg_u_start_process()

BOOLEAN hyperdbg_u_start_process

(

const WCHAR *

path

)

Start a new process.

Parameters

path	The path of the process

Returns

BOOLEAN Returns true if it was successful

{
    return UdAttachToProcess(NULL,
                             path,
                             NULL,
                             FALSE);
}

hyperdbg_u_start_process_with_args()

BOOLEAN hyperdbg_u_start_process_with_args	(	const WCHAR *	path,
		const WCHAR *	arguments )

Start a new process.

Parameters

path	The path of the process
arguments	The arguments of the process

Returns

BOOLEAN Returns true if it was successful

{
    return UdAttachToProcess(NULL,
                             path,
                             arguments,
                             FALSE);
}

hyperdbg_u_stop_vmm_driver()

INT hyperdbg_u_stop_vmm_driver

(

)

Stop the VMM driver.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgStopVmmDriver();
}

hyperdbg_u_uninstall_vmm_driver()

INT hyperdbg_u_uninstall_vmm_driver

(

)

Uninstall the VMM driver.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgUninstallVmmDriver();
}

hyperdbg_u_unload_vmm()

INT hyperdbg_u_unload_vmm

(

)

Unload the VMM.

Returns

INT Returns 0 if it was successful and 1 if it was failed

{
    return HyperDbgUnloadVmm();
}

hyperdbg_u_unset_text_message_callback()

VOID hyperdbg_u_unset_text_message_callback

(

)

Unset the function callback that will be called if any message needs to be shown.

Returns

VOID

{
    UnsetTextMessageCallback();
}

hyperdbg_u_use_default_driver_path()

VOID hyperdbg_u_use_default_driver_path

(

)

Use the default driver path.

Returns

VOID

{
    //
    // Set the flag to use the default driver path
    //
    g_UseCustomDriverLocation = FALSE;
}

hyperdbg_u_write_memory()

BOOLEAN hyperdbg_u_write_memory	(	PVOID	destination_address,
		DEBUGGER_EDIT_MEMORY_TYPE	memory_type,
		UINT32	process_id,
		PVOID	source_address,
		UINT32	number_of_bytes )

Write memory.

Parameters

destination_address	The destination address
memory_type	The type of memory (physical or virtual)
process_id	The target process id (if it's virtual memory)
source_address	The source address
number_of_bytes	The number of bytes to write

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgWriteMemory(destination_address, memory_type, process_id, source_address, number_of_bytes);
}

hyperdbg_u_write_target_register()

BOOLEAN hyperdbg_u_write_target_register	(	REGS_ENUM	register_id,
		UINT64	value )

Write target register.

Parameters

register_id	The target register
value	The value to write

Returns

BOOLEAN TRUE if the operation was successful, otherwise FALSE

{
    return HyperDbgWriteTargetRegister(register_id, value);
}

HyperDbgDebugCurrentDeviceUsingComPort()

BOOLEAN HyperDbgDebugCurrentDeviceUsingComPort	(	const CHAR *	PortName,
		DWORD	Baudrate )

Connect to a remote serial device (Debuggee)

Parameters

PortName
Baudrate

Returns

BOOLEAN

{
    UINT32 Port;
 
    //
    // Check if baudrate is valid or not
    //
    if (!CommandDebugCheckBaudrate(Baudrate))
    {
        //
        // Baud-rate is invalid
        //
        return FALSE;
    }
 
    //
    // check if com port address is valid or not
    //
    if (!CommandDebugCheckComPort(PortName, &Port))
    {
        //
        // com port is invalid
        //
        return FALSE;
    }
 
    //
    // Everything is okay, connect to the remote machine to send (debuggee)
    //
    return KdPrepareAndConnectDebugPort(PortName, Baudrate, Port, TRUE, FALSE);
}

Variable Documentation

g_DriverLocation

TCHAR g_DriverLocation[MAX_PATH]

extern

Holds the location driver to install it.

{0};

g_DriverName

TCHAR g_DriverName[MAX_PATH]

extern

Holds the name of the driver to install it.

{0};

g_UseCustomDriverLocation

BOOLEAN g_UseCustomDriverLocation

extern

Whether the user wants to use a custom driver location or not.