Driver.h File Reference

Header for WDK driver functions. More...

Go to the source code of this file.

Functions
NTSTATUS	DriverEntry (PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
	Load & Unload.
VOID	DrvUnload (PDRIVER_OBJECT DriverObject)
	Run in the case of driver unload to unregister the devices.
NTSTATUS	DrvCreate (PDEVICE_OBJECT DeviceObject, PIRP Irp)
	IRP Major Functions.
NTSTATUS	DrvRead (PDEVICE_OBJECT DeviceObject, PIRP Irp)
	IRP_MJ_READ Function handler.
NTSTATUS	DrvWrite (PDEVICE_OBJECT DeviceObject, PIRP Irp)
	IRP_MJ_WRITE Function handler.
NTSTATUS	DrvClose (PDEVICE_OBJECT DeviceObject, PIRP Irp)
	IRP_MJ_CLOSE Function handler.
NTSTATUS	DrvUnsupported (PDEVICE_OBJECT DeviceObject, PIRP Irp)
	Unsupported message for all other IRP_MJ_* handlers.
NTSTATUS	DrvDispatchIoControl (PDEVICE_OBJECT DeviceObject, PIRP Irp)
	Driver IOCTL Dispatcher.
NTSTATUS	DrvDispatchBasicIoControl (PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN *DoNotChangeInformation)
	IOCTL Dispatcher for Basic IOCTLs (initialization and event registration).
NTSTATUS	DrvDispatchKdIoControl (PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN *DoNotChangeInformation)
	IOCTL Dispatcher for KD (Kernel Debugger) IOCTLs.
NTSTATUS	DrvDispatchVmmIoControl (PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN *DoNotChangeInformation)
	IOCTL Dispatcher for VMM IOCTLs.
NTSTATUS	DrvDispatchHyperTraceIoControl (PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN *DoNotChangeInformation)
	IOCTL Dispatcher for HyperTrace IOCTLs.

Detailed Description

Header for WDK driver functions.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-01-13

Copyright

This project is released under the GNU Public License v3.

Function Documentation

DriverEntry()

NTSTATUS DriverEntry	(	PDRIVER_OBJECT	DriverObject,
		PUNICODE_STRING	RegistryPath )

Load & Unload.

Main Driver Entry in the case of driver load.

Load & Unload.

Parameters

DriverObject
RegistryPath

Returns

NTSTATUS

Main Driver Entry in the case of driver load.

{
    NTSTATUS       Ntstatus      = STATUS_SUCCESS;
    UINT64         Index         = 0;
    PDEVICE_OBJECT DeviceObject  = NULL;
    UNICODE_STRING DriverName    = RTL_CONSTANT_STRING(L"\\Device\\HyperDbgReversingMachineDevice");
    UNICODE_STRING DosDeviceName = RTL_CONSTANT_STRING(L"\\DosDevices\\HyperDbgReversingMachineDevice");
 
    UNREFERENCED_PARAMETER(RegistryPath);
    UNREFERENCED_PARAMETER(DriverObject);
 
    //
    // Opt-in to using non-executable pool memory on Windows 8 and later.
    // https://msdn.microsoft.com/en-us/library/windows/hardware/hh920402(v=vs.85).aspx
    //
    ExInitializeDriverRuntime(DrvRtPoolNxOptIn);
 
    //
    // Creating the device for interaction with user-mode
    //
    Ntstatus = IoCreateDevice(DriverObject,
                              0,
                              &DriverName,
                              FILE_DEVICE_UNKNOWN,
                              FILE_DEVICE_SECURE_OPEN,
                              FALSE,
                              &DeviceObject);
 
    if (Ntstatus == STATUS_SUCCESS)
    {
        for (Index = 0; Index < IRP_MJ_MAXIMUM_FUNCTION; Index++)
            DriverObject->MajorFunction[Index] = DrvUnsupported;
 
        //
        // We cannot use logging mechanism of HyperDbg as it's not initialized yet
        //
        DbgPrint("Setting device major functions");
 
        DriverObject->MajorFunction[IRP_MJ_CLOSE]          = DrvClose;
        DriverObject->MajorFunction[IRP_MJ_CREATE]         = DrvCreate;
        DriverObject->MajorFunction[IRP_MJ_READ]           = DrvRead;
        DriverObject->MajorFunction[IRP_MJ_WRITE]          = DrvWrite;
        DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DrvDispatchIoControl;
 
        DriverObject->DriverUnload = DrvUnload;
        IoCreateSymbolicLink(&DosDeviceName, &DriverName);
    }
 
    //
    // Establish user-buffer access method.
    //
    if (DeviceObject != NULL)
    {
        DeviceObject->Flags |= DO_BUFFERED_IO;
    }
 
    //
    // We cannot use logging mechanism of HyperDbg as it's not initialized yet
    //
    DbgPrint("HyperDbg's device and major functions are loaded");
 
 
    ASSERT(NT_SUCCESS(Ntstatus));
    return Ntstatus;
}

DrvClose()

NTSTATUS DrvClose	(	PDEVICE_OBJECT	DeviceObject,
		PIRP	Irp )

IRP_MJ_CLOSE Function handler.

Parameters

DeviceObject
Irp

Returns

NTSTATUS

{
    UNREFERENCED_PARAMETER(DeviceObject);
 
    //
    // If the close is called means that all of the IOCTLs
    // are not in a pending state so we can safely allow
    // a new handle creation for future calls to the driver
    //
    g_HandleInUse = FALSE;
 
    Irp->IoStatus.Status      = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}

DrvCreate()

NTSTATUS DrvCreate	(	PDEVICE_OBJECT	DeviceObject,
		PIRP	Irp )

IRP Major Functions.

IRP_MJ_CREATE Function handler.

IRP Major Functions.

Parameters

DeviceObject
Irp

Returns

NTSTATUS

IRP_MJ_CREATE Function handler.

{
    UNREFERENCED_PARAMETER(DeviceObject);
 
    //
    // Check for privilege
    //
    // Check for the correct security access.
    // The caller must have the SeDebugPrivilege.
    //
 
    LUID DebugPrivilege = {SE_DEBUG_PRIVILEGE, 0};
 
    if (!SeSinglePrivilegeCheck(DebugPrivilege, Irp->RequestorMode))
    {
        Irp->IoStatus.Status      = STATUS_ACCESS_DENIED;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
        return STATUS_ACCESS_DENIED;
    }
 
    //
    // Check to allow just one handle to the driver
    // means that only one application can get the handle
    // and new application won't allowed to create a new
    // handle unless the IRP_MJ_CLOSE called.
    //
    if (g_HandleInUse)
    {
        //
        // A driver got the handle before
        //
        Irp->IoStatus.Status      = STATUS_SUCCESS;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
        return STATUS_SUCCESS;
    }
 
    //
    // Initialize the vmm and the reversing machine
    //
    if (LoaderInitVmmAndReversingMachine())
    {
        Irp->IoStatus.Status      = STATUS_SUCCESS;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
        return STATUS_SUCCESS;
    }
    else
    {
        //
        // There was a problem, so not loaded
        //
        Irp->IoStatus.Status      = STATUS_UNSUCCESSFUL;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
        return STATUS_UNSUCCESSFUL;
    }
}

DrvDispatchBasicIoControl()

NTSTATUS DrvDispatchBasicIoControl	(	PIRP	Irp,
		PIO_STACK_LOCATION	IrpStack,
		BOOLEAN *	DoNotChangeInformation )

IOCTL Dispatcher for Basic IOCTLs (initialization and event registration).

Parameters

Irp
IrpStack
DoNotChangeInformation

Returns

NTSTATUS

{
    PREGISTER_NOTIFY_BUFFER          RegisterEventRequest;
    PDEBUGGER_INIT_VMM_PACKET        InitVmmRequest;
    PDEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTraceRequest;
    ULONG                            InBuffLength;
    ULONG                            OutBuffLength;
    NTSTATUS                         Status = STATUS_SUCCESS;
    UINT32                           Ioctl  = IrpStack->Parameters.DeviceIoControl.IoControlCode;
 
    switch (Ioctl)
    {
    case IOCTL_INIT_VMM:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_INIT_VMM_PACKET,
                                                (PVOID *)&InitVmmRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Initialize the debugger and the vmm
        //
        if (LoaderInitDebuggerAndVmm(InitVmmRequest))
        {
            Status = STATUS_SUCCESS;
        }
        else
        {
            //
            // There was a problem, so not loaded
            //
            Status = STATUS_UNSUCCESSFUL;
        }
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_INIT_VMM_PACKET, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_INIT_HYPERTRACE:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_INIT_HYPERTRACE_PACKET,
                                                (PVOID *)&InitHyperTraceRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Initialize the HyperTrace (if supported by the processor)
        //
        LoaderInitHyperTrace(InitHyperTraceRequest, TRUE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_INIT_HYPERTRACE_PACKET, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_REGISTER_EVENT:
 
        //
        // First validate the parameters.
        //
        if (IrpStack->Parameters.DeviceIoControl.InputBufferLength < SIZEOF_REGISTER_EVENT || Irp->AssociatedIrp.SystemBuffer == NULL)
        {
            Status = STATUS_INVALID_PARAMETER;
            LogError("Err, invalid parameter to IOCTL dispatcher");
            break;
        }
 
        //
        // IRPs supply a pointer to a buffer at Irp->AssociatedIrp.SystemBuffer.
        // This buffer represents both the input buffer and the output buffer that
        // are specified in calls to DeviceIoControl
        //
        RegisterEventRequest = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
 
        switch (RegisterEventRequest->Type)
        {
        case IRP_BASED:
 
            LogRegisterIrpBasedNotification((PVOID)Irp, &Status);
 
            break;
        case EVENT_BASED:
 
            if (LogRegisterEventBasedNotification((PVOID)Irp))
            {
                Status = STATUS_SUCCESS;
            }
            else
            {
                Status = STATUS_UNSUCCESSFUL;
            }
 
            break;
        default:
            LogError("Err, unknown notification type from user-mode");
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        break;
 
    case IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL:
 
        //
        // Send an immediate message, and we're no longer get new IRP
        //
        LogCallbackSendBuffer(OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS,
                              "$",
                              sizeof(CHAR),
                              TRUE);
 
        Status = STATUS_SUCCESS;
 
        break;
 
    default:
        LogError("Err, unknown IOCTL");
        Status = STATUS_NOT_IMPLEMENTED;
        break;
    }
 
    return Status;
}

DrvDispatchHyperTraceIoControl()

NTSTATUS DrvDispatchHyperTraceIoControl	(	PIRP	Irp,
		PIO_STACK_LOCATION	IrpStack,
		BOOLEAN *	DoNotChangeInformation )

IOCTL Dispatcher for HyperTrace IOCTLs.

Parameters

Irp
IrpStack
DoNotChangeInformation

Returns

NTSTATUS

{
    PHYPERTRACE_LBR_OPERATION_PACKETS HyperTraceLbrOperationRequest;
    PHYPERTRACE_LBR_DUMP_PACKETS      HyperTraceLbrdumpRequest;
    PHYPERTRACE_PT_OPERATION_PACKETS  HyperTracePtOperationRequest;
    PHYPERTRACE_PT_MMAP_PACKETS       HyperTracePtMmapRequest;
    ULONG                             InBuffLength;
    ULONG                             OutBuffLength;
    NTSTATUS                          Status = STATUS_SUCCESS;
    UINT32                            Ioctl  = IrpStack->Parameters.DeviceIoControl.IoControlCode;
 
    switch (Ioctl)
    {
    case IOCTL_PERFORM_HYPERTRACE_UNLOAD:
 
        //
        // Perform the unload of HyperTrace (there is no parameter for this IOCTL)
        //
        LoaderUninitHyperTrace();
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(0, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PERFORM_HYPERTRACE_LBR_OPERATION:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_HYPERTRACE_LBR_OPERATION_PACKETS,
                                                (PVOID *)&HyperTraceLbrOperationRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the HyperTrace LBR operation
        //
        HyperTraceLbrPerformOperation(HyperTraceLbrOperationRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_HYPERTRACE_LBR_OPERATION_PACKETS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PERFORM_HYPERTRACE_LBR_DUMP:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_HYPERTRACE_LBR_DUMP_PACKETS,
                                                (PVOID *)&HyperTraceLbrdumpRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the HyperTrace LBR dump operation
        //
        HyperTraceLbrPerformDump(HyperTraceLbrdumpRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_HYPERTRACE_LBR_DUMP_PACKETS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PERFORM_HYPERTRACE_PT_OPERATION:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_HYPERTRACE_PT_OPERATION_PACKETS,
                                                (PVOID *)&HyperTracePtOperationRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // If the caller asked to filter by a process id (and didn't
        // already provide an explicit CR3), resolve the PID to the CR3
        // the PT engine should match here — hyperkd owns the NT_KPROCESS
        // layout, whereas the hypertrace engine only consumes a CR3. The
        // kernel/user CR3 is chosen based on the requested trace mode so
        // it works whether or not KVA shadowing (KPTI) is enabled.
        //
        if (HyperTracePtOperationRequest->TargetProcessId != 0 &&
            HyperTracePtOperationRequest->TargetCr3 == 0)
        {
            HyperTracePtOperationRequest->TargetCr3 =
                DrvResolvePtTargetCr3(HyperTracePtOperationRequest->TargetProcessId,
                                      (BOOLEAN)(HyperTracePtOperationRequest->TraceUser != 0),
                                      (BOOLEAN)(HyperTracePtOperationRequest->TraceKernel != 0));
        }
 
        //
        // Perform the HyperTrace PT operation
        //
        HyperTracePtPerformOperation(HyperTracePtOperationRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_HYPERTRACE_PT_OPERATION_PACKETS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PERFORM_HYPERTRACE_PT_MMAP:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_HYPERTRACE_PT_MMAP_PACKETS,
                                                (PVOID *)&HyperTracePtMmapRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Map the per-CPU PT output buffers into the calling user process
        //
        HyperTracePtMmap(HyperTracePtMmapRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_HYPERTRACE_PT_MMAP_PACKETS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    default:
        LogError("Err, unknown IOCTL");
        Status = STATUS_NOT_IMPLEMENTED;
        break;
    }
 
    return Status;
}

DrvDispatchIoControl()

NTSTATUS DrvDispatchIoControl	(	PDEVICE_OBJECT	DeviceObject,
		PIRP	Irp )

Driver IOCTL Dispatcher.

Parameters

DeviceObject
Irp

Returns

NTSTATUS

{
    PIO_STACK_LOCATION      IrpStack;
    PREGISTER_NOTIFY_BUFFER RegisterEventRequest;
    NTSTATUS                Status;
 
    UNREFERENCED_PARAMETER(DeviceObject);
 
    //
    // Here's the best place to see if there is any allocation pending
    // to be allcated as we're in PASSIVE_LEVEL
    //
    // DO NOT CHANGE CALLING OF THE FOLLOWING FUNCTION
    //
    // PoolManagerCheckAndPerformAllocationAndDeallocation();
 
    if (g_VmmInitialized)
    {
        IrpStack = IoGetCurrentIrpStackLocation(Irp);
 
        switch (IrpStack->Parameters.DeviceIoControl.IoControlCode)
        {
        case IOCTL_REGISTER_EVENT:
 
            //
            // First validate the parameters.
            //
            if (IrpStack->Parameters.DeviceIoControl.InputBufferLength < SIZEOF_REGISTER_EVENT || Irp->AssociatedIrp.SystemBuffer == NULL)
            {
                Status = STATUS_INVALID_PARAMETER;
                LogError("Err, invalid parameter to IOCTL dispatcher");
                break;
            }
 
            //
            // IRPs supply a pointer to a buffer at Irp->AssociatedIrp.SystemBuffer.
            // This buffer represents both the input buffer and the output buffer that
            // are specified in calls to DeviceIoControl
            //
            RegisterEventRequest = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
 
            switch (RegisterEventRequest->Type)
            {
            case IRP_BASED:
 
                LogRegisterIrpBasedNotification((PVOID)Irp, &Status);
 
                break;
            case EVENT_BASED:
 
                if (LogRegisterEventBasedNotification((PVOID)Irp))
                {
                    Status = STATUS_SUCCESS;
                }
                else
                {
                    Status = STATUS_UNSUCCESSFUL;
                }
 
                break;
            default:
                LogError("Err, unknown notification type from user-mode");
                Status = STATUS_INVALID_PARAMETER;
                break;
            }
            break;
 
        default:
            LogError("Err, unknown IOCTL");
            Status = STATUS_NOT_IMPLEMENTED;
            break;
        }
    }
    else
    {
        //
        // We're no longer serve IOCTL
        //
        Status = STATUS_SUCCESS;
    }
 
    if (Status != STATUS_PENDING)
    {
        Irp->IoStatus.Status = Status;
 
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
    }
 
    return Status;
}

DrvDispatchKdIoControl()

NTSTATUS DrvDispatchKdIoControl	(	PIRP	Irp,
		PIO_STACK_LOCATION	IrpStack,
		BOOLEAN *	DoNotChangeInformation )

IOCTL Dispatcher for KD (Kernel Debugger) IOCTLs.

Parameters

Irp
IrpStack
DoNotChangeInformation

Returns

NTSTATUS

{
    NTSTATUS Status = STATUS_SUCCESS;
    UINT32   Ioctl  = IrpStack->Parameters.DeviceIoControl.IoControlCode;
 
    UNREFERENCED_PARAMETER(Irp);
    UNREFERENCED_PARAMETER(DoNotChangeInformation);
 
    switch (Ioctl)
    {
    default:
        LogError("Err, unknown IOCTL");
        Status = STATUS_NOT_IMPLEMENTED;
        break;
    }
 
    return Status;
}

DrvDispatchVmmIoControl()

NTSTATUS DrvDispatchVmmIoControl	(	PIRP	Irp,
		PIO_STACK_LOCATION	IrpStack,
		BOOLEAN *	DoNotChangeInformation )

IOCTL Dispatcher for VMM IOCTLs.

Parameters

Irp
IrpStack
DoNotChangeInformation

Returns

NTSTATUS

{
    PDEBUGGER_READ_MEMORY                                   DebuggerReadMemRequest;
    PDEBUGGER_READ_AND_WRITE_ON_MSR                         DebuggerReadOrWriteMsrRequest;
    PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE            DebuggerHideAndUnhideRequest;
    PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS               DebuggerPteRequest;
    PDEBUGGER_PAGE_IN_REQUEST                               DebuggerPageinRequest;
    PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET               PcitreeRequest;
    PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET            PcidevinfoRequest;
    PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS                      DebuggerVa2paAndPa2vaRequest;
    PDEBUGGER_EDIT_MEMORY                                   DebuggerEditMemoryRequest;
    PDEBUGGER_SEARCH_MEMORY                                 DebuggerSearchMemoryRequest;
    PDEBUGGER_GENERAL_EVENT_DETAIL                          DebuggerNewEventRequest;
    PDEBUGGER_MODIFY_EVENTS                                 DebuggerModifyEventRequest;
    PDEBUGGER_FLUSH_LOGGING_BUFFERS                         DebuggerFlushBuffersRequest;
    PDEBUGGER_PREALLOC_COMMAND                              DebuggerReservePreallocPoolRequest;
    PDEBUGGER_PREACTIVATE_COMMAND                           DebuggerPreactivationRequest;
    PDEBUGGER_APIC_REQUEST                                  DebuggerApicRequest;
    PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS             DebuggerQueryIdtRequest;
    PDEBUGGEE_BP_PACKET                                     DebuggerBreakpointRequest;
    PDEBUGGER_UD_COMMAND_PACKET                             DebuggerUdCommandRequest;
    PUSERMODE_LOADED_MODULE_DETAILS                         DebuggerUsermodeModulesRequest;
    PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS             DebuggerUsermodeProcessOrThreadQueryRequest;
    PDEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET             GetInformationProcessRequest;
    PREVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST           RevServiceRequest;
    PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET              GetInformationThreadRequest;
    PDEBUGGER_PERFORM_KERNEL_TESTS                          DebuggerKernelTestRequest;
    PDEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL        DebuggerCommandExecutionFinishedRequest;
    PDEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER            DebuggerSendUsermodeMessageRequest;
    PDEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER DebuggerSendBufferFromDebuggeeToDebuggerRequest;
    PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS               DebuggerAttachOrDetachToThreadRequest;
    PDEBUGGER_PREPARE_DEBUGGEE                              DebuggeeRequest;
    PDEBUGGER_PAUSE_PACKET_RECEIVED                         DebuggerPauseKernelRequest;
    PDEBUGGER_GENERAL_ACTION                                DebuggerNewActionRequest;
    PSMI_OPERATION_PACKETS                                  SmiOperationRequest;
    PVOID                                                   BufferToStoreThreadsAndProcessesDetails;
    ULONG                                                   InBuffLength;  // Input buffer length
    ULONG                                                   OutBuffLength; // Output buffer length
    SIZE_T                                                  ReturnSize;
    NTSTATUS                                                Status = STATUS_SUCCESS;
    UINT32                                                  Ioctl  = IrpStack->Parameters.DeviceIoControl.IoControlCode;
 
    switch (Ioctl)
    {
    case IOCTL_TERMINATE_VMX:
 
        //
        // Uninitialize the VMM and the debugger
        //
        LoaderUninitVmmAndDebugger();
 
        Status = STATUS_SUCCESS;
 
        break;
 
    case IOCTL_DEBUGGER_READ_MEMORY:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_READ_MEMORY,
                                                (PVOID *)&DebuggerReadMemRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        if (DebuggerCommandReadMemory(DebuggerReadMemRequest,
                                      ((CHAR *)DebuggerReadMemRequest) + SIZEOF_DEBUGGER_READ_MEMORY,
                                      &ReturnSize) == TRUE)
        {
            //
            // Return the header a read bytes
            //
            DrvAdjustStatusAndSetOutputSize((UINT32)(ReturnSize + SIZEOF_DEBUGGER_READ_MEMORY), DoNotChangeInformation, Irp, &Status);
        }
        else
        {
            //
            // Just return the header to the user-mode
            //
            DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_READ_MEMORY, DoNotChangeInformation, Irp, &Status);
        }
 
        break;
 
    case IOCTL_DEBUGGER_READ_OR_WRITE_MSR:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR,
                                                (PVOID *)&DebuggerReadOrWriteMsrRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place
        //
        Status = DebuggerReadOrWriteMsr(DebuggerReadOrWriteMsrRequest, (UINT64 *)DebuggerReadOrWriteMsrRequest, &ReturnSize);
 
        //
        // Set the size
        //
        if (Status == STATUS_SUCCESS)
        {
            //
            // Adjust the status and output size
            //
            DrvAdjustStatusAndSetOutputSize((UINT32)ReturnSize, DoNotChangeInformation, Irp, &Status);
        }
 
        break;
 
    case IOCTL_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS,
                                                (PVOID *)&DebuggerPteRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place (it's not in vmx-root)
        //
        ExtensionCommandPte(DebuggerPteRequest, FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_REGISTER_EVENT:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_GENERAL_EVENT_DETAIL,
                                                (PVOID *)&DebuggerNewEventRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place (not coming from the VMX-root mode)
        //
        DebuggerParseEvent(DebuggerNewEventRequest,
                           (PDEBUGGER_EVENT_AND_ACTION_RESULT)Irp->AssociatedIrp.SystemBuffer,
                           FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_GENERAL_ACTION,
                                                (PVOID *)&DebuggerNewActionRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place
        //
        DebuggerParseAction(DebuggerNewActionRequest,
                            (PDEBUGGER_EVENT_AND_ACTION_RESULT)Irp->AssociatedIrp.SystemBuffer,
                            FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE,
                                                (PVOID *)&DebuggerHideAndUnhideRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // check if it's a !hide or !unhide command
        //
        if (DebuggerHideAndUnhideRequest->IsHide == TRUE)
        {
            //
            // It's a hide request
            //
            TransparentHideDebuggerWrapper(DebuggerHideAndUnhideRequest);
        }
        else
        {
            //
            // It's a unhide request
            //
            TransparentUnhideDebuggerWrapper(DebuggerHideAndUnhideRequest);
        }
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS,
                                                (PVOID *)&DebuggerVa2paAndPa2vaRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place (we're not in vmx-root here)
        //
        ExtensionCommandVa2paAndPa2va(DebuggerVa2paAndPa2vaRequest, FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_EDIT_MEMORY:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_EDIT_MEMORY,
                                                (PVOID *)&DebuggerEditMemoryRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Here we should validate whether the input parameter is
        // valid or in other words whether we received enough space or not
        //
        if (IrpStack->Parameters.DeviceIoControl.InputBufferLength != SIZEOF_DEBUGGER_EDIT_MEMORY + DebuggerEditMemoryRequest->CountOf64Chunks * sizeof(UINT64))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place
        //
        DebuggerCommandEditMemory(DebuggerEditMemoryRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_EDIT_MEMORY, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_SEARCH_MEMORY:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_SEARCH_MEMORY,
                                                (PVOID *)&DebuggerSearchMemoryRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // The OutBuffLength should have at least MaximumSearchResults * sizeof(UINT64)
        // free space to store the results
        //
        if (OutBuffLength < MaximumSearchResults * sizeof(UINT64))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Here we should validate whether the input parameter is
        // valid or in other words whether we received enough space or not
        //
        if (IrpStack->Parameters.DeviceIoControl.InputBufferLength != SIZEOF_DEBUGGER_SEARCH_MEMORY + DebuggerSearchMemoryRequest->CountOf64Chunks * sizeof(UINT64))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place
        //
        if (DebuggerCommandSearchMemory(DebuggerSearchMemoryRequest) != STATUS_SUCCESS)
        {
            //
            // It is because it was not valid in any of the ways to the function
            // then we're sure that the usermode code won't interpret it's previous
            // buffer as a valid buffer and will not show it to the user
            //
            RtlZeroMemory(DebuggerSearchMemoryRequest, MaximumSearchResults * sizeof(UINT64));
        }
 
        //
        // Configure IRP status, and also we send the results
        // buffer, with it's null values (if any)
        //
        DrvAdjustStatusAndSetOutputSize(MaximumSearchResults * sizeof(UINT64), DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_MODIFY_EVENTS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_MODIFY_EVENTS,
                                                (PVOID *)&DebuggerModifyEventRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place
        //
        DebuggerParseEventsModification(DebuggerModifyEventRequest, FALSE, EnableInstantEventMechanism ? g_KernelDebuggerState : FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_MODIFY_EVENTS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_FLUSH_LOGGING_BUFFERS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_FLUSH_LOGGING_BUFFERS,
                                                (PVOID *)&DebuggerFlushBuffersRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the flush
        //
        DebuggerCommandFlush(DebuggerFlushBuffersRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_FLUSH_LOGGING_BUFFERS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS,
                                                (PVOID *)&DebuggerAttachOrDetachToThreadRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the attach to the target process
        //
        AttachingTargetProcess(DebuggerAttachOrDetachToThreadRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PREPARE_DEBUGGEE:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_PREPARE_DEBUGGEE,
                                                (PVOID *)&DebuggeeRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the action
        //
        SerialConnectionPrepare(DebuggeeRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_PREPARE_DEBUGGEE, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PAUSE_PACKET_RECEIVED:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED,
                                                (PVOID *)&DebuggerPauseKernelRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the action
        //
        KdHaltSystem(DebuggerPauseKernelRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_SEND_SIGNAL_EXECUTION_IN_DEBUGGEE_FINISHED:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL,
                                                (PVOID *)&DebuggerCommandExecutionFinishedRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the signal operation
        //
        DebuggerCommandSignalExecutionState(DebuggerCommandExecutionFinishedRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_SEND_USERMODE_MESSAGES_TO_DEBUGGER:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER,
                                                (PVOID *)&DebuggerSendUsermodeMessageRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Second validation phase
        //
        if (DebuggerSendUsermodeMessageRequest->Length == NULL_ZERO ||
            IrpStack->Parameters.DeviceIoControl.InputBufferLength != SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER + DebuggerSendUsermodeMessageRequest->Length)
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the signal operation
        //
        DebuggerCommandSendMessage(DebuggerSendUsermodeMessageRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_SEND_GENERAL_BUFFER_FROM_DEBUGGEE_TO_DEBUGGER:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER,
                                                (PVOID *)&DebuggerSendBufferFromDebuggeeToDebuggerRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Second validation phase
        //
        if (DebuggerSendBufferFromDebuggeeToDebuggerRequest->LengthOfBuffer == NULL_ZERO ||
            IrpStack->Parameters.DeviceIoControl.InputBufferLength != SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER + DebuggerSendBufferFromDebuggeeToDebuggerRequest->LengthOfBuffer)
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the signal operation
        //
        DebuggerCommandSendGeneralBufferToDebugger(DebuggerSendBufferFromDebuggeeToDebuggerRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PERFORM_KERNEL_SIDE_TESTS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_PERFORM_KERNEL_TESTS,
                                                (PVOID *)&DebuggerKernelTestRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the kernel-side tests
        //
        TestKernelPerformTests(DebuggerKernelTestRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_PERFORM_KERNEL_TESTS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_RESERVE_PRE_ALLOCATED_POOLS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_PREALLOC_COMMAND,
                                                (PVOID *)&DebuggerReservePreallocPoolRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the reservation pools
        //
        DebuggerCommandReservePreallocatedPools(DebuggerReservePreallocPoolRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_PREALLOC_COMMAND, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PREACTIVATE_FUNCTIONALITY:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_PREACTIVATE_COMMAND,
                                                (PVOID *)&DebuggerPreactivationRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the activation of the functionality
        //
        DebuggerCommandPreactivateFunctionality(DebuggerPreactivationRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_PREACTIVATE_COMMAND, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PERFORM_ACTIONS_ON_APIC:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_APIC_REQUEST,
                                                (PVOID *)&DebuggerApicRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(ExtensionCommandPerformActionsForApicRequests(DebuggerApicRequest), DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_QUERY_IDT_ENTRY:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS,
                                                (PVOID *)&DebuggerQueryIdtRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the query of IDT entries (not from vmx-root)
        //
        ExtensionCommandPerformQueryIdtEntriesRequest(DebuggerQueryIdtRequest, FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_SET_BREAKPOINT_USER_DEBUGGER:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGEE_BP_PACKET,
                                                (PVOID *)&DebuggerBreakpointRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform setting the breakpoint (for the user mode debugger)
        // Switching to the target process memory is needed as we are
        // in HyperDbg's process memory layout and we need to switch to
        // the target process memory layout to set the breakpoint
        //
        BreakpointAddNew(DebuggerBreakpointRequest, TRUE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGEE_BP_PACKET, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PERFORM_SMI_OPERATION:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_SMI_OPERATION_PACKETS,
                                                (PVOID *)&SmiOperationRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the SMI operation (it's not from vmx-root)
        //
        VmFuncSmmPerformSmiOperation(SmiOperationRequest, FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_SMI_OPERATION_PACKETS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_SEND_USER_DEBUGGER_COMMANDS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_UD_COMMAND_PACKET,
                                                (PVOID *)&DebuggerUdCommandRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the dispatching of user debugger command
        //
        UdDispatchUsermodeCommands(DebuggerUdCommandRequest, InBuffLength, OutBuffLength);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(OutBuffLength, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_GET_DETAIL_OF_ACTIVE_THREADS_AND_PROCESSES:
 
        OutBuffLength = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;
 
        if (!OutBuffLength)
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode is here
        //
        BufferToStoreThreadsAndProcessesDetails = (PVOID)Irp->AssociatedIrp.SystemBuffer;
 
        //
        // Perform the dispatching of user debugger command
        //
        AttachingQueryDetailsOfActiveDebuggingThreadsAndProcesses(BufferToStoreThreadsAndProcessesDetails, OutBuffLength);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(OutBuffLength, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_GET_USER_MODE_MODULE_DETAILS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_USERMODE_LOADED_MODULE_DETAILS,
                                                (PVOID *)&DebuggerUsermodeModulesRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Getting the modules details
        //
        UserAccessGetLoadedModules(DebuggerUsermodeModulesRequest, OutBuffLength);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(OutBuffLength, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_QUERY_COUNT_OF_ACTIVE_PROCESSES_OR_THREADS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS,
                                                (PVOID *)&DebuggerUsermodeProcessOrThreadQueryRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Getting the count result
        //
        if (DebuggerUsermodeProcessOrThreadQueryRequest->QueryType == DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT)
        {
            ProcessQueryCount(DebuggerUsermodeProcessOrThreadQueryRequest);
        }
        else if (DebuggerUsermodeProcessOrThreadQueryRequest->QueryType == DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT)
        {
            ThreadQueryCount(DebuggerUsermodeProcessOrThreadQueryRequest);
        }
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_GET_LIST_OF_THREADS_AND_PROCESSES:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS,
                                                (PVOID *)&DebuggerUsermodeProcessOrThreadQueryRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Getting the list of processes or threads
        //
        if (DebuggerUsermodeProcessOrThreadQueryRequest->QueryType == DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST)
        {
            ProcessQueryList(DebuggerUsermodeProcessOrThreadQueryRequest,
                             DebuggerUsermodeProcessOrThreadQueryRequest,
                             OutBuffLength);
        }
        else if (DebuggerUsermodeProcessOrThreadQueryRequest->QueryType == DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST)
        {
            ThreadQueryList(DebuggerUsermodeProcessOrThreadQueryRequest,
                            DebuggerUsermodeProcessOrThreadQueryRequest,
                            OutBuffLength);
        }
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(OutBuffLength, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_QUERY_CURRENT_THREAD:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET,
                                                (PVOID *)&GetInformationThreadRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Get the information
        //
        ThreadQueryDetails(GetInformationThreadRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_QUERY_CURRENT_PROCESS:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET,
                                                (PVOID *)&GetInformationProcessRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Get the information
        //
        ProcessQueryDetails(GetInformationProcessRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_REQUEST_REV_MACHINE_SERVICE:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST,
                                                (PVOID *)&RevServiceRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Perform the service request
        //
        ConfigureInitializeExecTrapOnAllProcessors();
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_DEBUGGER_BRING_PAGES_IN:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGER_PAGE_IN_REQUEST,
                                                (PVOID *)&DebuggerPageinRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place (it's in VMI-mode)
        //
        DebuggerCommandBringPagein(DebuggerPageinRequest);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGER_PAGE_IN_REQUEST, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PCIE_ENDPOINT_ENUM:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET,
                                                (PVOID *)&PcitreeRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place (it's in VMI-mode)
        //
        ExtensionCommandPcitree(PcitreeRequest, FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    case IOCTL_PCIDEVINFO_ENUM:
 
        //
        // Validate and adjust the parameters, and set the target buffer to the system buffer of the IRP
        //
        if (!DrvValidateAndAdjustIoctlParameter(SIZEOF_DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET,
                                                (PVOID *)&PcidevinfoRequest,
                                                Irp,
                                                IrpStack,
                                                &InBuffLength,
                                                &OutBuffLength))
        {
            Status = STATUS_INVALID_PARAMETER;
            break;
        }
 
        //
        // Both usermode and to send to usermode and the coming buffer are
        // at the same place (it's in VMI-mode)
        //
        ExtensionCommandPcidevinfo(PcidevinfoRequest, FALSE);
 
        //
        // Adjust the status and output size
        //
        DrvAdjustStatusAndSetOutputSize(SIZEOF_DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET, DoNotChangeInformation, Irp, &Status);
 
        break;
 
    default:
        LogError("Err, unknown IOCTL");
        Status = STATUS_NOT_IMPLEMENTED;
        break;
    }
 
    return Status;
}

DrvRead()

NTSTATUS DrvRead	(	PDEVICE_OBJECT	DeviceObject,
		PIRP	Irp )

IRP_MJ_READ Function handler.

Parameters

DeviceObject
Irp

Returns

NTSTATUS

{
    UNREFERENCED_PARAMETER(DeviceObject);
 
    //
    // Not used
    //
    DbgPrint("This function is not used");
 
    Irp->IoStatus.Status      = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}

DrvUnload()

VOID DrvUnload

(

PDRIVER_OBJECT

DriverObject

)

Run in the case of driver unload to unregister the devices.

Parameters

DriverObject

Returns

VOID

{
    UNICODE_STRING DosDeviceName;
 
    RtlInitUnicodeString(&DosDeviceName, L"\\DosDevices\\HyperDbgReversingMachineDevice");
    IoDeleteSymbolicLink(&DosDeviceName);
    IoDeleteDevice(DriverObject->DeviceObject);
 
    //
    // Unloading VMM and Debugger
    //
    LoaderUninitLogTracer();
}

DrvUnsupported()

NTSTATUS DrvUnsupported	(	PDEVICE_OBJECT	DeviceObject,
		PIRP	Irp )

Unsupported message for all other IRP_MJ_* handlers.

Parameters

DeviceObject
Irp

Returns

NTSTATUS

{
    UNREFERENCED_PARAMETER(DeviceObject);
 
    //
    // Not supported
    //
    DbgPrint("This function is not supported");
 
    Irp->IoStatus.Status      = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}

DrvWrite()

NTSTATUS DrvWrite	(	PDEVICE_OBJECT	DeviceObject,
		PIRP	Irp )

IRP_MJ_WRITE Function handler.

Parameters

DeviceObject
Irp

Returns

NTSTATUS

{
    UNREFERENCED_PARAMETER(DeviceObject);
 
    //
    // Not used
    //
    DbgPrint("This function is not used");
 
    Irp->IoStatus.Status      = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
 
    return STATUS_SUCCESS;
}