▼ hwdbg | |
▼ sim | |
► hwdbg | |
► communication | |
► DebuggerPacketReceiver | |
test_DebuggerPacketReceiver.py | Testing module for DebuggerPacketReceiver |
► DebuggerPacketSender | |
test_DebuggerPacketSender.py | Testing module for DebuggerPacketSender |
► SendReceiveSynchronizer | |
test_SendReceiveSynchronizer.py | Testing module for SendReceiveSynchronizer |
► DebuggerModuleTestingBRAM | |
test_DebuggerModuleTestingBRAM.py | Testing module for DebuggerModuleTestingBRAM |
► modelsim | |
modelsim.py | |
modelsim.tcl | |
▼ src | |
► test | |
bram | |
▼ hyperdbg | |
▼ hyperdbg-cli | |
hyperdbg-cli.cpp | Main HyperDbg Cli source coede |
▼ hyperdbg-test | |
► code | |
► tests | |
hyperdbg-test.cpp | Perform tests on a remote process (this is the remote process) |
namedpipe.cpp | Server and Client communication over NamedPipes |
tools.cpp | General functions used in test project |
► header | |
namedpipe.h | Named pipe communication headers |
routines.h | Header for testing routines |
pch.cpp | |
pch.h | Pre-compiled headers |
▼ hyperhv | |
► code | |
► broadcast | |
Broadcast.c | Broadcast debugger function to all logical cores |
DpcRoutines.c | All the dpc routines which relates to executing on a single core for multi-core you can use Broadcast.c |
► common | |
Bitwise.c | Functions for bit-level operations |
Common.c | Common functions that needs to be used in all source code files |
UnloadDll.c | Unloading DLL in the target Windows |
► components | |
► registers | |
DebugRegisters.c | Implementation of debug registers functions |
► devices | |
Apic.c | |
► disassembler | |
Disassembler.c | |
ZydisKernel.c | |
► features | |
CompatibilityChecks.c | Checks for processor compatibility with different features |
DirtyLogging.c | Implementation of memory hooks functions |
► globals | |
GlobalVariableManagement.c | Management of global variables |
► hooks | |
► ept-hook | |
EptHook.c | Implementation of different EPT hidden hooks functions |
ExecTrap.c | The reversing machine's routines |
ModeBasedExecHook.c | Implementation of hooks based on Mode-based execution |
► syscall-hook | |
EferHook.c | Implementation of the functions related to the EFER Syscall Hook |
SsdtHook.c | Implementation of functions to find SSDT entries for SSDT Hook |
► interface | |
Callback.c | VMM callback interface routines |
Configuration.c | Configuration interface for hypervisor events |
DirectVmcall.c | Direct VMCALL routines |
Dispatch.c | Implementation of debugger functions for dispatching, triggering and emulating events |
Export.c | Implementation of exported functions from hypervisor |
► memory | |
AddressCheck.c | |
Conversion.c | Functions for address checks |
Layout.c | Functions for working with memory layouts |
MemoryManager.c | Reading/Writing memory and all memory affairs |
MemoryMapper.c | This file shows the functions to map memory to reserved system ranges |
PoolManager.c | The pool manager used in vmx root |
Segmentation.c | Functions for handling memory segmentations |
SwitchLayout.c | Functions for switching memory layouts |
► transparency | |
Transparency.c | Try to hide the debugger from anti-debugging and anti-hypervisor methods |
► vmm | |
► ept | |
Ept.c | The implementation of functions relating to the Extended Page Table (a.k.a. EPT) |
Invept.c | Implementation of functions that perform different INVEPT functions |
Vpid.c | VPID Implementations |
► vmx | |
Counters.c | The functions for emulating counters |
CrossVmexits.c | The functions for passing vm-exits in vmx root |
Events.c | Functions relating to Exception Bitmap and Event (Interrupt and Exception) Injection |
Hv.c | This file describes the routines in Hypervisor |
IdtEmulation.c | Handlers of Guest's IDT Emulator |
IoHandler.c | The I/O Handler for vm-exit |
ManageRegs.c | Manage Registers |
MsrHandlers.c | Handle for MSR-related tasks in VMX-root |
Mtf.c | Routines relating to Monitor Trap Flag (MTF) |
ProtectedHv.c | File for protected hypervisor resources |
Vmcall.c | The main VMCALL and Hypercall handler |
Vmexit.c | The functions for VM-Exit handler for different exit reasons |
Vmx.c | VMX Instructions and VMX Related Functions |
VmxBroadcast.c | Broadcast mechanism in vmx-root |
VmxMechanisms.c | VMX based mechanisms |
VmxRegions.c | Implement allocations for VMX Regions (VMXON Region, VMCS, MSR Bitmap and etc.) |
► header | |
► assembly | |
InlineAsm.h | The definition of functions written in Assembly |
► broadcast | |
Broadcast.h | The broadcast (DPC) function to all the cores for debugger commands |
DpcRoutines.h | Headers of all the dpc routines which relates to executing on a single core |
► common | |
Bitwise.h | Header files for bit-level operations |
Common.h | Header files for common functions |
Dpc.h | Definition for Windows DPC functions |
Msr.h | Model-Specific Registers definitions |
State.h | Model-Specific Registers definitions |
Trace.h | WPP Tracing Definitions |
UnloadDll.h | Headers for unloading DLL in the target Windows |
► devices | |
Apic.h | Routines for Advanced Programmable Interrupt Controller (APIC) |
► disassembler | |
Disassembler.h | Header for disassembler in kernel |
► features | |
CompatibilityChecks.h | Header for checks for processor compatibility with different features |
DirtyLogging.h | Headers for dirty logging mechanism |
► globals | |
GlobalVariableManagement.h | Headers for management of global variables |
GlobalVariables.h | Here we put global variables that are used more or less in all part of our hypervisor (not all of them) |
► hooks | |
ExecTrap.h | Header for the user-mode, kernel-mode execution traps' routines |
Hooks.h | Hook headers |
ModeBasedExecHook.h | Hook headers for Mode-based execution |
► interface | |
Callback.h | Header for VMM callback interface routines |
DirectVmcall.h | Header for direct VMCALL routines |
Dispatch.h | Headers of debugger functions for dispatching, triggering and emulating events |
► memory | |
AddressCheck.h | Header files for address checks |
Conversion.h | Header files for memory conversions |
Layout.h | Header files for working with memory layouts |
MemoryMapper.h | |
PoolManager.h | Headers of pool manager |
Segmentation.h | Functions for handling memory segmentations |
SwitchLayout.h | Header files for switching memory layouts |
► transparency | |
Transparency.h | Hide the debugger from anti-debugging and anti-hypervisor methods (headers) |
► vmm | |
► ept | |
Ept.h | Contains the headers relating to EPT structures, MTRR and all basic Hooking structures |
Invept.h | Header for INVEPT functions |
Vpid.h | VPID Headers |
► vmx | |
Counters.h | The headers for functions for emulating counters |
Events.h | Headers relating to Exception Bitmap and Event (Interrupt and Exception) Injection |
Hv.h | This file contains the headers for Hypervisor Routines which have to be called by external codes |
HypervTlfs.h | |
IdtEmulation.h | Header for Handlers of Guest's IDT Emulator |
IoHandler.h | The I/O Handler for vm-exit headers |
MsrHandlers.h | Headers to Handle for MSR-related tasks in VMX-root |
Mtf.h | Monitor Trap Flag Headers |
ProtectedHv.h | Header files for protected hypervisor resources |
Vmcall.h | VMCALL Headers |
Vmx.h | VMX Instruction and operation headers |
VmxBroadcast.h | Headers for broadcast in VMX-root mode |
VmxMechanisms.h | VMX based mechanisms header |
VmxRegions.h | Headers for implement allocations for VMX Regions (VMXON Region, VMCS, MSR Bitmap and etc.) |
pch.c | Pre-compiled headers |
pch.h | Pre-compiled headers |
▼ hyperkd | |
► code | |
► common | |
Common.c | Routines for common tasks in debugger |
► debugger | |
► broadcast | |
DpcRoutines.c | All the dpc routines which relates to executing on a single core for multi-core you can use Broadcast.c |
HaltedBroadcast.c | Broadcasting functions in case of halted cores |
HaltedRoutines.c | All single core broadcasting functions in case of halted core |
► commands | |
BreakpointCommands.c | Routines for breakpoint commands |
Callstack.c | Kernel routines for callstack |
DebuggerCommands.c | Implementation of Debugger Commands |
ExtensionCommands.c | Implementation of Debugger Commands (Extensions) |
► communication | |
SerialConnection.c | Serial port connection from debuggee to debugger |
► core | |
Debugger.c | Implementation of Debugger functions |
DebuggerVmcalls.c | Implementation of debugger VMCALLs |
HaltedCore.c | Implementation of applying events in halted cores |
► events | |
ApplyEvents.c | Implementation of debugger functions for applying events |
DebuggerEvents.c | Implementation of Debugger events (triggers and enable events) |
Termination.c | Implementation of debugger functions for terminating events |
ValidateEvents.c | Implementation of debugger functions for validating events |
► kernel-level | |
Kd.c | Routines related to kernel mode debugging |
► memory | |
Allocations.c | Management of global variables memory relating to debugger |
► meta-events | |
MetaDispatch.c | Implementation of meta dispatching functions |
Tracing.c | Implementation of tracing functions |
► objects | |
Process.c | Implementation of kernel debugger functions for processes |
Thread.c | Implementation of kernel debugger functions for threads |
► script-engine | |
ScriptEngine.c | Script engine parser and wrapper functions |
► tests | |
KernelTests.c | Implementation of kernel-side test functions |
► user-level | |
Attaching.c | Attaching and detaching for debugging user-mode processes |
ThreadHolder.c | User debugger's thread holder |
Ud.c | Routines related to user mode debugging |
UserAccess.c | Access and parse user-mode components of binaries |
► driver | |
Driver.c | The project entry |
Ioctl.c | IOCTL Functions form user mode and other parts |
Loader.c | The functions used in loading the debugger and VMM |
► header | |
► assembly | |
Assembly.h | |
► common | |
Common.h | Routines for common tasks in debugger |
Dpc.h | Definition for Windows DPC functions |
► debugger | |
► broadcast | |
DpcRoutines.h | Headers of all the dpc routines which relates to executing on a single core |
HaltedBroadcast.h | Headers for broadcasting functions in case of halted cores |
HaltedRoutines.h | Headers for all single core broadcasting functions in case of halted core |
► commands | |
BreakpointCommands.h | Commands for setting breakpoints |
Callstack.h | Kernel headers for callstacks |
DebuggerCommands.h | Commands for debugger |
ExtensionCommands.h | Headers of Debugger Commands (Extensions) |
► communication | |
SerialConnection.h | Header for serial port connection from debuggee to debugger |
► core | |
Debugger.h | General debugger headers |
DebuggerVmcalls.h | |
HaltedCore.h | Header for the implementation of applying events in halted cores |
State.h | Model-Specific Registers definitions |
► events | |
ApplyEvents.h | Headers of debugger functions for applying events |
DebuggerEvents.h | Implementation of debugger VMCALLs |
Termination.h | Headers of debugger functions for terminating events |
ValidateEvents.h | Headers of debugger functions for validating events |
► kernel-level | |
Kd.h | Header for routines related to kernel mode debugging |
► memory | |
Allocations.h | Headers for management of global variables |
Memory.h | Headers for some Intel memory structures |
► meta-events | |
MetaDispatch.h | Headers for meta dispatching functions |
Tracing.h | Headers for the tracing functions |
► objects | |
Process.h | Header for kernel debugger functions for processes |
Thread.h | Header for kernel debugger functions for threads |
► script-engine | |
ScriptEngine.h | Headers for script engine functions used in kernel-mode evaluator of the script engine |
► tests | |
KernelTests.h | Kernel Test headers |
► user-level | |
Attaching.h | Header for attaching and detaching for debugging user-mode processes |
ThreadHolder.h | User debugger's thread holder headers |
Ud.h | Header for routines related to user mode debugging |
UserAccess.h | Access and parse user-mode components of binaries |
► driver | |
Driver.h | Header for WDK driver functions |
Loader.h | Routines for perform initial VMM and debugger loads |
► globals | |
Global.h | Headers for global variables |
pch.h | Pre-compiled headers for debugger |
▼ hyperlog | |
► code | |
Logging.c | Message logging and tracing implementation |
UnloadDll.c | Unloading DLL in the target Windows |
► header | |
Logging.h | Headers of Message logging and tracing |
pch.h | Headers of Message logging and tracing |
UnloadDll.h | Headers for unloading DLL in the target Windows |
▼ include | |
► components | |
► optimizations | |
► code | |
AvlTree.c | The file contains array management routines (AVL Tree) |
BinarySearch.c | The file contains array management routines (Binary Search) |
InsertionSort.c | The file contains array management routines (Insertion Sort) |
OptimizationsExamples.c | |
► header | |
AvlTree.h | Headers for the file that contains array management routines (AVL Tree) |
BinarySearch.h | The header file for array management routines (Binary Search) |
InsertionSort.h | Headers for the file that contains array management routines (Insertion Sort) |
OptimizationsExamples.h | |
► spinlock | |
► code | |
Spinlock.c | This is the implementation for custom spinlock |
► header | |
Spinlock.h | Headers of spinlock routines |
► keystone | |
arm.h | |
arm64.h | |
evm.h | |
hexagon.h | |
keystone.h | |
mips.h | |
ppc.h | |
riscv.h | |
sparc.h | |
systemz.h | |
x86.h | |
► macros | |
MetaMacros.h | Helper macros |
► platform | |
► kernel | |
► code | |
Mem.c | Implementation of cross APIs for different platforms for memory allocation |
► header | |
Environment.h | The running environment of HyperDbg |
Mem.h | Cross platform APIs for memory allocation |
► user | |
► header | |
Environment.h | The running environment of HyperDbg |
Windows.h | Windows specific headers |
► SDK | |
► Examples | |
► hyperdbg_app | |
► code | |
hyperdbg-app.cpp | Controller of the reversing machine's module |
► header | |
pch.h | Pre-compiled headers for reversing machine's module |
► hyperdbg_driver | |
► code | |
► core | |
Core.c | The functions used in core of reversing machine |
► driver | |
Driver.c | The project entry (RM) |
Ioctl.c | IOCTL Functions form user mode and other parts |
Loader.c | The functions used in loading the VMM and RM |
► header | |
► core | |
Core.h | |
► driver | |
Driver.h | Header for WDK driver functions for RM |
Loader.h | Routines for perform initial VMM and RM |
► misc | |
Global.h | Headers for global variables |
pch.h | Pre-compiled headers for RM |
► Headers | |
Assertions.h | HyperDbg's assertions |
BasicTypes.h | HyperDbg's SDK Headers For Basic Datatypes |
Connection.h | HyperDbg's SDK Headers For Native Structures, Enums and Constants |
Constants.h | HyperDbg's SDK constants |
DataTypes.h | HyperDbg's SDK data type definitions |
ErrorCodes.h | HyperDbg's SDK Error codes |
Events.h | HyperDbg's SDK Headers for Events |
HardwareDebugger.h | HyperDbg's Hardware Debugger (hwdbg) types and constants |
Ioctls.h | HyperDbg's SDK IOCTL codes |
RequestStructures.h | HyperDbg's SDK Headers Request Packets |
ScriptEngineCommonDefinitions.h | |
Symbols.h | HyperDbg's SDK Header Files For Symbol Parsing |
► Imports | |
► Kernel | |
HyperDbgHyperLogImports.h | Headers relating exported functions from hyperlog project |
HyperDbgHyperLogIntrinsics.h | Headers relating exported functions from hyperlog project |
HyperDbgVmmImports.h | Headers relating exported functions from hypervisor |
► User | |
HyperDbgLibImports.h | Headers relating exported functions from controller interface |
HyperDbgScriptImports.h | Headers relating exported functions from script engine |
HyperDbgSymImports.h | Headers relating exported functions from symbol parser |
► Modules | |
HyperLog.h | HyperDbg's SDK for HyperLog project |
VMM.h | HyperDbg's SDK for VMM project |
HyperDbgSdk.h | |
► zydis | |
ZycoreExportConfig.h | |
ZydisExportConfig.h | |
Configuration.h | Global configuration that applies on compile time |
Definition.h | Header files for global definitions |
▼ kdserial | |
apm88xxxx.c | |
bcm2835.c | |
common.c | |
common.h | |
hardware.c | |
ioaccess.c | |
kdcom.h | |
msm8974.c | |
msm8x60.c | |
mx6uart.c | |
nvidia.c | |
omap.c | |
pl011.c | |
sam5250.c | |
sdm845.c | |
spimax311.c | |
uart16550.c | |
uartio.c | |
uartp.h | |
usif.c | |
win11sdk.h | |
▼ libhyperdbg | |
► code | |
► app | |
dllmain.cpp | Defines the entry point for the DLL application |
libhyperdbg.cpp | Main interface to connect applications to driver |
► common | |
common.cpp | HyperDbg general functions for reading and converting and etc |
list.cpp | The list working functions headers |
spinlock.cpp | This is the implementation for custom spinlock |
► debugger | |
► commands | |
► debugging-commands | |
a.cpp | Command |
bc.cpp | Bc command |
bd.cpp | Bd command |
be.cpp | Be command |
bl.cpp | Bl command |
bp.cpp | Bp command |
core.cpp | |
cpu.cpp | Cpu commands |
d-u.cpp | !u* u* , !d* d* commands |
dt-struct.cpp | Dt and struct command |
e.cpp | E* command |
eval.cpp | Eval (?) command |
events.cpp | Events commands |
exit.cpp | Exit command |
flush.cpp | Flush command |
g.cpp | G command |
gu.cpp | Gu command |
i.cpp | I command |
k.cpp | K command |
lm.cpp | Lm command |
load.cpp | Load command |
output.cpp | Output command |
p.cpp | P command |
pause.cpp | Pause command |
preactivate.cpp | Preactivate command |
prealloc.cpp | Prealloc command |
print.cpp | Print command |
r.cpp | R command |
rdmsr.cpp | Rdmsr command |
s.cpp | S* command |
settings.cpp | Settings command |
sleep.cpp | Sleep command |
t.cpp | T command |
test.cpp | Test command |
unload.cpp | Unload command |
wrmsr.cpp | Wrmsr command |
x.cpp | Parse symbols |
► extension-commands | |
cpuid.cpp | !cpuid commands |
crwrite.cpp | !crwrite command |
dr.cpp | !dr commands |
epthook.cpp | !epthook command |
epthook2.cpp | !epthook2 command |
exception.cpp | !exception command |
hide.cpp | !hide command |
interrupt.cpp | !interrupt command |
ioin.cpp | !ioin command |
ioout.cpp | !ioout command |
measure.cpp | !measure command |
mode.cpp | !mode command |
monitor.cpp | !monitor command |
msrread.cpp | !msrread command |
msrwrite.cpp | !msrwrite command |
pa2va.cpp | !pa2va command |
pmc.cpp | !pmc commands |
pte.cpp | !pte command |
rev.cpp | !rev command |
syscall-sysret.cpp | !syscall and !sysret commands |
trace.cpp | !trace command |
track.cpp | !track command |
tsc.cpp | !tsc commands |
unhide.cpp | !unhide command |
va2pa.cpp | !va2pa command |
vmcall.cpp | !vmcall command |
► hwdbg-commands | |
hw_clk.cpp | !hw_clk command |
► meta-commands | |
attach.cpp | .attach command |
cls.cpp | |
connect.cpp | .connect command |
debug.cpp | .debug command |
detach.cpp | .detach command |
disconnect.cpp | .disconnect command |
dump.cpp | |
formats.cpp | .formats command |
help.cpp | .help command |
kill.cpp | .kill command |
listen.cpp | .listen command |
logclose.cpp | .logclose command |
logopen.cpp | .logopen command |
pagein.cpp | .pagein command |
pe.cpp | .pe command |
process.cpp | Show and change process |
restart.cpp | .restart command |
script.cpp | .script command |
start.cpp | .start command |
status.cpp | .status command |
switch.cpp | .switch command |
sym.cpp | .sym command |
sympath.cpp | .sympath command |
thread.cpp | Show and change threads |
► communication | |
forwarding.cpp | Event source forwarding |
namedpipe.cpp | Server and Client communication over NamedPipes |
remote-connection.cpp | Handle remote connections command |
tcpclient.cpp | Server functions over TCP |
tcpserver.cpp | Server functions over TCP |
► core | |
break-control.cpp | Break control is the handler for CTRL+C and CTRL+BREAK Signals |
debugger.cpp | Interpret general fields |
interpreter.cpp | The hyperdbg command interpreter and driver connector |
► driver-loader | |
install.cpp | Install functions |
► kernel-level | |
kd.cpp | Routines to kernel debugging |
kernel-listening.cpp | Listening for remote connections on kernel debugger |
► misc | |
assembler.cpp | Turns assembly codes into bytes |
callstack.cpp | Callstack related routines |
disassembler.cpp | Demonstrates basic hooking functionality of the ZydisFormatter class by implementing a custom symbol-resolver |
readmem.cpp | HyperDbg command for u and d* |
► script-engine | |
script-engine-wrapper.cpp | Interpret general fields |
script-engine.cpp | Interpret script engine affairs |
symbol.cpp | Symbol parser |
► tests | |
tests.cpp | Perform tests |
► transparency | |
gaussian-rng.cpp | |
transparency.cpp | Measurements for debugger transparency |
► user-level | |
pe-parser.cpp | Portable Executable parser |
ud.cpp | Control the user-mode debugging affairs |
user-listening.cpp | Listening for user debugger thread events |
► export | |
export.cpp | Exported functions from libhyperdbg interface |
► hwdbg | |
hwdbg-interpreter.cpp | Interpreter of hwdbg packets and requests |
► objects | |
objects.cpp | Routines related to objects |
► rev | |
rev-ctrl.cpp | Controller of the reversing machine's module |
► header | |
assembler.h | Headers for turning assembly codes into bytes |
commands.h | The hyperdbg command interpreter and driver connector |
common.h | Header for HyperDbg's general functions for reading and converting and etc |
communication.h | |
debugger.h | General debugger functions |
export.h | Headers for controller of the reversing machine's module |
forwarding.h | Headers for event source forwarding |
globals.h | Global Variables for user-mode interface |
help.h | Help of commands header |
hwdbg-interpreter.h | Headers for the interpreter of hwdbg packets and requests |
inipp.h | |
install.h | Main interface to connect applications to driver headers |
kd.h | Routines for remote kernel debugging |
libhyperdbg.h | Headers for libhyperdbg |
list.h | The list working functions headers |
namedpipe.h | Named pipe communication headers |
objects.h | Header for routines related to objects |
pe-parser.h | Header for Portable Executable parser |
rev-ctrl.h | Headers for controller of the reversing machine's module |
script-engine.h | General script-engine functions and wrappers |
symbol.h | Symbol related functions header |
tests.h | Headers for test functions |
transparency.h | Headers for test functions |
ud.h | Headers for user-mode debugging routines |
pch.cpp | Source file corresponding to the pre-compiled header |
pch.h | Header file corresponding to the pre-compiled header |
▼ libraries | |
keystone | |
▼ miscellaneous | |
constants | |
▼ script-engine | |
► code | |
common.c | |
globals.c | |
parse-table.c | |
scanner.c | |
script-engine.c | Script engine parser and codegen |
type.c | |
► header | |
common.h | |
globals.h | |
parse-table.h | |
scanner.h | |
script-engine.h | Script engine parser and codegen |
type.h | |
► modules | |
► script-engine-test | |
► EvalScripts | |
► Properties | |
AssemblyInfo.cs | |
Eval.cs | |
HighLevelScriptGen.cs | |
Program.cs | |
StatementGenerator.cs | |
► Python | |
test-case-generator.py | |
script-test-cases | |
► python | |
► lalr_parsing | |
__init__.py | |
grammar.py | |
lalr_one.py | |
lr_zero.py | |
generator.py | |
lalr1_parser.py | |
ll1_parser.py | |
util.py | |
pch.c | |
pch.h | |
▼ script-eval | |
► code | |
Functions.c | Script engine functions implementations |
Keywords.c | Script engine keywords implementations |
PseudoRegisters.c | Script engine pseudo-registers implementations |
Regs.c | Script engine registers implementations |
ScriptEngineEval.c | Shared Headers for Script engine |
► header | |
ScriptEngineHeader.h | Headers for exported script engine headers |
ScriptEngineInternalHeader.h | Internal Headers of script engine |
▼ symbol-parser | |
► code | |
casting.cpp | Casting functions queries for script engine |
common-utils.cpp | Common utils |
symbol-parser.cpp | Symbol parser |
► header | |
common-utils.h | Common utils headers |
symbol-parser.h | Symbol parser headers |
pch.cpp | |
pch.h | Pre-compiled headers for symbol parser |
▼ utils | |
counter.py | |
test-environment.py | |