hide.cpp File Reference

!hide command More...

#include "pch.h"

Functions
VOID	CommandHideHelp ()
	help of the !hide command
BOOLEAN	CommandHideFillSystemCalls (SYSTEM_CALL_NUMBERS_INFORMATION *SyscallNumberDetails)
	This function is called when the user wants to hide the fill system calls in the transparent mode based on current system call numbers.
BOOLEAN	HyperDbgEnableTransparentModeEx (UINT32 ProcessId, CHAR *ProcessName, BOOLEAN IsProcessId, UINT32 EvadeMask)
	Enable transparent mode.
BOOLEAN	HyperDbgEnableTransparentMode (UINT32 ProcessId, CHAR *ProcessName, BOOLEAN IsProcessId)
	Enable transparent mode.
VOID	CommandHide (vector< CommandToken > CommandTokens, string Command)
	!hide command handler

Variables
BOOLEAN	g_IsVmmModuleLoaded
	shows whether the VMM module is loaded or not
ACTIVE_DEBUGGING_PROCESS	g_ActiveProcessDebuggingState
	State of active debugging thread.

Detailed Description

!hide command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

jtaw5649

Version

0.1

Date

2020-07-07

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandHide()

VOID CommandHide	(	vector< CommandToken >	CommandTokens,
		string	Command )

!hide command handler

Parameters

CommandTokens
Command

Returns

VOID

{
    UINT32  TargetPid;
    BOOLEAN TrueIfProcessIdAndFalseIfProcessName;
 
#if ActivateHyperEvadeProject != TRUE
 
    ShowMessages("warning, the !hide command (hyperevade project) is in the Beta phase and is not yet well-tested, "
                 "so it is disabled in this version. If you want to test, you can enable it "
                 "from the configuration file (set ActivateHyperEvadeProject to TRUE) and recompile HyperDbg\n\n");
    return;
 
#endif
 
    if (CommandTokens.size() != 1 && CommandTokens.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandHideHelp();
        return;
    }
 
    //
    // Find out whether the user enters pid or name
    //
    if (CommandTokens.size() == 1)
    {
        if (g_ActiveProcessDebuggingState.IsActive)
        {
            TrueIfProcessIdAndFalseIfProcessName = TRUE;
            TargetPid                            = g_ActiveProcessDebuggingState.ProcessId;
        }
        else
        {
            //
            // There is no user-debugging process
            //
            ShowMessages("you're not attached to any user-mode process, "
                         "please explicitly specify the process id or process name\n\n");
            CommandHideHelp();
            return;
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "pid"))
    {
        TrueIfProcessIdAndFalseIfProcessName = TRUE;
 
        //
        // Check for the user to not add extra arguments
        //
        if (CommandTokens.size() != 3)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandHideHelp();
            return;
        }
 
        //
        // It's just a pid for the process
        //
        if (!ConvertTokenToUInt32(CommandTokens.at(2), &TargetPid))
        {
            ShowMessages("incorrect process id\n\n");
            return;
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "name"))
    {
        TrueIfProcessIdAndFalseIfProcessName = FALSE;
    }
    else
    {
        //
        // Invalid argument for the second parameter to the command
        //
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandHideHelp();
        return;
    }
 
    //
    // Enable the transparent mode
    //
    if (TrueIfProcessIdAndFalseIfProcessName)
    {
        HyperDbgEnableTransparentMode(TargetPid,
                                      NULL,
                                      TRUE);
    }
    else
    {
        HyperDbgEnableTransparentMode(NULL,
                                      (CHAR *)GetCaseSensitiveStringFromCommandToken(CommandTokens.at(2)).c_str(),
                                      FALSE);
    }
}

CommandHideFillSystemCalls()

BOOLEAN CommandHideFillSystemCalls

(

SYSTEM_CALL_NUMBERS_INFORMATION *

SyscallNumberDetails

)

This function is called when the user wants to hide the fill system calls in the transparent mode based on current system call numbers.

Parameters

SyscallNumberDetails

Returns

BOOLEAN

{
    BOOLEAN Result = TRUE;
 
    //
    // Get the syscall number of NtQuerySystemInformation
    //
    SyscallNumberDetails->SysNtQuerySystemInformation = PeGetSyscallNumber("NtQuerySystemInformation");
 
    if (SyscallNumberDetails->SysNtQuerySystemInformation == 0)
    {
        ShowMessages("warning, failed to get NtQuerySystemInformation syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtQuerySystemInformationEx
    //
    SyscallNumberDetails->SysNtQuerySystemInformationEx = PeGetSyscallNumber("NtQuerySystemInformationEx");
 
    if (SyscallNumberDetails->SysNtQuerySystemInformationEx == 0)
    {
        ShowMessages("warning, failed to get NtQuerySystemInformationEx syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtSystemDebugControl
    //
    SyscallNumberDetails->SysNtSystemDebugControl = PeGetSyscallNumber("NtSystemDebugControl");
 
    if (SyscallNumberDetails->SysNtSystemDebugControl == 0)
    {
        ShowMessages("warning, failed to get NtSystemDebugControl syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtQueryAttributesFile
    //
    SyscallNumberDetails->SysNtQueryAttributesFile = PeGetSyscallNumber("NtQueryAttributesFile");
 
    if (SyscallNumberDetails->SysNtQueryAttributesFile == 0)
    {
        ShowMessages("warning, failed to get NtQueryAttributesFile syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtOpenDirectoryObject
    //
    SyscallNumberDetails->SysNtOpenDirectoryObject = PeGetSyscallNumber("NtOpenDirectoryObject");
 
    if (SyscallNumberDetails->SysNtOpenDirectoryObject == 0)
    {
        ShowMessages("warning, failed to get NtOpenDirectoryObject syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtQueryDirectoryObject
    //
    SyscallNumberDetails->SysNtQueryDirectoryObject = PeGetSyscallNumber("NtQueryDirectoryObject");
 
    if (SyscallNumberDetails->SysNtQueryDirectoryObject == 0)
    {
        ShowMessages("warning, failed to get NtQueryDirectoryObject syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtQueryInformationProcess
    //
    SyscallNumberDetails->SysNtQueryInformationProcess = PeGetSyscallNumber("NtQueryInformationProcess");
 
    if (SyscallNumberDetails->SysNtQueryInformationProcess == 0)
    {
        ShowMessages("warning, failed to get NtQueryInformationProcess syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtSetInformationProcess
    //
    SyscallNumberDetails->SysNtSetInformationProcess = PeGetSyscallNumber("NtSetInformationProcess");
 
    if (SyscallNumberDetails->SysNtSetInformationProcess == 0)
    {
        ShowMessages("warning, failed to get NtSetInformationProcess syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtQueryInformationThread
    //
    SyscallNumberDetails->SysNtQueryInformationThread = PeGetSyscallNumber("NtQueryInformationThread");
 
    if (SyscallNumberDetails->SysNtQueryInformationThread == 0)
    {
        ShowMessages("warning, failed to get NtQueryInformationThread syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtSetInformationThread
    //
    SyscallNumberDetails->SysNtSetInformationThread = PeGetSyscallNumber("NtSetInformationThread");
 
    if (SyscallNumberDetails->SysNtSetInformationThread == 0)
    {
        ShowMessages("warning, failed to get NtSetInformationThread syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtOpenFile
    //
    SyscallNumberDetails->SysNtOpenFile = PeGetSyscallNumber("NtOpenFile");
 
    if (SyscallNumberDetails->SysNtOpenFile == 0)
    {
        ShowMessages("warning, failed to get NtOpenFile syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtOpenKey
    //
    SyscallNumberDetails->SysNtOpenKey = PeGetSyscallNumber("NtOpenKey");
 
    if (SyscallNumberDetails->SysNtOpenKey == 0)
    {
        ShowMessages("warning, failed to get NtOpenKey syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtOpenKeyEx
    //
    SyscallNumberDetails->SysNtOpenKeyEx = PeGetSyscallNumber("NtOpenKeyEx");
 
    if (SyscallNumberDetails->SysNtOpenKeyEx == 0)
    {
        ShowMessages("warning, failed to get NtOpenKeyEx syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtQueryValueKey
    //
    SyscallNumberDetails->SysNtQueryValueKey = PeGetSyscallNumber("NtQueryValueKey");
 
    if (SyscallNumberDetails->SysNtQueryValueKey == 0)
    {
        ShowMessages("warning, failed to get NtQueryValueKey syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    //
    // Get the syscall number of NtEnumerateKey
    //
    SyscallNumberDetails->SysNtEnumerateKey = PeGetSyscallNumber("NtEnumerateKey");
 
    if (SyscallNumberDetails->SysNtEnumerateKey == 0)
    {
        ShowMessages("warning, failed to get NtEnumerateKey syscall number for transparent-mode\n");
        Result = FALSE;
    }
 
    return Result;
}

CommandHideHelp()

VOID CommandHideHelp

(

)

help of the !hide command

Returns

VOID

{
    ShowMessages("!hide : tries to make HyperDbg transparent from anti-debugging "
                 "and anti-hypervisor methods.\n\n");
 
    ShowMessages("syntax : \t!hide\n");
    ShowMessages("syntax : \t!hide [pid ProcessId (hex)]\n");
    ShowMessages("syntax : \t!hide [name ProcessName (string)]\n");
 
    ShowMessages("note : \tprocess names are case sensitive and you can use "
                 "this command multiple times.\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : !hide\n");
    ShowMessages("\t\te.g : !hide pid b60 \n");
    ShowMessages("\t\te.g : !hide name procexp.exe\n");
}

HyperDbgEnableTransparentMode()

BOOLEAN HyperDbgEnableTransparentMode	(	UINT32	ProcessId,
		CHAR *	ProcessName,
		BOOLEAN	IsProcessId )

Enable transparent mode.

Parameters

ProcessId
ProcessName
IsProcessId

Returns

BOOLEAN

{
    return HyperDbgEnableTransparentModeEx(ProcessId, ProcessName, IsProcessId, 0);
}

HyperDbgEnableTransparentModeEx()

BOOLEAN HyperDbgEnableTransparentModeEx	(	UINT32	ProcessId,
		CHAR *	ProcessName,
		BOOLEAN	IsProcessId,
		UINT32	EvadeMask )

Enable transparent mode.

Parameters

ProcessId
ProcessName
IsProcessId
EvadeMask

Returns

BOOLEAN

{
    BOOLEAN                                      Status;
    ULONG                                        ReturnedLength;
    DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE  HideRequest        = {0};
    PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE FinalRequestBuffer = 0;
    SIZE_T                                       RequestBufferSize  = 0;
    UINT32                                       EffectiveEvadeMask = EvadeMask == 0 ? TRANSPARENT_EVADE_MASK_DEFAULT : EvadeMask;
 
    //
    // Check if debugger is loaded or not
    //
    // AssertShowMessageReturnStmt(g_IsVmmModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_VMM_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
 
    //
    // We wanna hide the debugger and make transparent vm-exits
    //
    if ((EffectiveEvadeMask & ~TRANSPARENT_EVADE_MASK_ALL) != 0)
    {
        ShowMessages("unknown transparent-mode evade mask bits\n");
        return FALSE;
    }
 
    HideRequest.IsHide    = TRUE;
    HideRequest.EvadeMask = EffectiveEvadeMask;
 
    HideRequest.TrueIfProcessIdAndFalseIfProcessName = IsProcessId;
 
    if (IsProcessId)
    {
        //
        // It's a process id
        //
        HideRequest.ProcId = (UINT32)ProcessId;
 
        RequestBufferSize = sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE);
    }
    else
    {
        //
        // It's a process name
        //
        HideRequest.LengthOfProcessName = (UINT32)strlen(ProcessName) + 1;
        RequestBufferSize               = sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) + HideRequest.LengthOfProcessName;
    }
 
    if ((EffectiveEvadeMask & TRANSPARENT_EVADE_MASK_SYSCALL_HOOK) != 0 &&
        !CommandHideFillSystemCalls(&HideRequest.SystemCallNumbersInformation))
    {
        ShowMessages("warning, failed to resolve one or more syscall numbers for transparent-mode\n");
        return FALSE;
    }
 
    //
    // Allocate the requested buffer
    //
    FinalRequestBuffer = (PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE)malloc(RequestBufferSize);
 
    if (FinalRequestBuffer == NULL)
    {
        ShowMessages("insufficient space\n");
        return FALSE;
    }
 
    //
    // Zero the memory
    //
    RtlZeroMemory(FinalRequestBuffer, RequestBufferSize);
 
    //
    // Copy the buffer on the top of the final buffer
    // to send the kernel
    //
    memcpy(FinalRequestBuffer, &HideRequest, sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE));
 
    //
    // If it's a name then we should add it to the end of the buffer
    //
    if (!IsProcessId)
    {
        CHAR * ProcName = ProcessName;
 
        memcpy(((UINT64 *)((UINT64)FinalRequestBuffer + sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE))),
               ProcName,
               HideRequest.LengthOfProcessName);
    }
 
    //
    // Send the request to the kernel
    //
    Status = DeviceIoControl(
        g_DeviceHandle,                                             // Handle to device
        IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER, // IO Control
        // code
        FinalRequestBuffer,                                 // Input Buffer to driver.
        (DWORD)RequestBufferSize,                           // Input buffer length
        FinalRequestBuffer,                                 // Output Buffer from driver.
        SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, // Length of output
        // buffer in bytes.
        &ReturnedLength, // Bytes placed in buffer.
        NULL             // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        free(FinalRequestBuffer);
        return FALSE;
    }
 
    if (FinalRequestBuffer->KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("transparent debugging successfully enabled :)\n");
    }
    else if (FinalRequestBuffer->KernelStatus == DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER)
    {
        ShowMessages("unable to hide the debugger (transparent-debugging) :(\n");
        free(FinalRequestBuffer);
        return FALSE;
    }
    else
    {
        ShowMessages("unknown error occurred :(\n");
        free(FinalRequestBuffer);
        return FALSE;
    }
 
    //
    // free the buffer
    //
    free(FinalRequestBuffer);
 
    //
    // It means the transparent mode enabled successfully
    //
    return TRUE;
}

Variable Documentation

g_ActiveProcessDebuggingState

ACTIVE_DEBUGGING_PROCESS g_ActiveProcessDebuggingState

extern

State of active debugging thread.

{0};

g_IsVmmModuleLoaded

BOOLEAN g_IsVmmModuleLoaded

extern

shows whether the VMM module is loaded or not