Loader.h File Reference

Routines for perform initial VMM and debugger loads. More...

Go to the source code of this file.

Functions
BOOLEAN	LoaderInitHyperLog ()
	Initialize the hyper log module.
BOOLEAN	LoaderInitHyperTrace (PDEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTracePacket, BOOLEAN RunningOnHypervisorEnvironment)
	Initialize the hyper trace module.
BOOLEAN	LoaderInitDebuggerAndVmm (PDEBUGGER_INIT_VMM_PACKET InitVmmPacket)
	Initialize the debugger and the vmm.
VOID	LoaderUninitVmmAndDebugger ()
	Uninitialize the VMM and the debugger.
VOID	LoaderUninitHyperTrace ()
	Uninitialize the hyper trace module.
VOID	LoaderUninitLogTracer ()
	Uninitialize the log tracer.

Detailed Description

Routines for perform initial VMM and debugger loads.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-01-15

Copyright

This project is released under the GNU Public License v3.

Function Documentation

LoaderInitDebuggerAndVmm()

BOOLEAN LoaderInitDebuggerAndVmm

(

PDEBUGGER_INIT_VMM_PACKET

InitVmmPacket

)

Initialize the debugger and the vmm.

Parameters

InitVmmPacket

The packet to fill the result of the initialization

Returns

BOOLEAN

{
    //
    // First we need to initialize the debugger
    // because the VMM relies on the debugger for some of its functionalities,
    // so if we cannot initialize the debugger we cannot initialize the VMM
    //
    if (!LoaderInitKd())
    {
        //
        // Unable to initialize the debugger, so we cannot initialize the VMM, and we return false
        //
        InitVmmPacket->KernelStatus = DEBUGGER_ERROR_CANNOT_INITIALIZE_DEBUGGER;
 
        return FALSE;
    }
 
    //
    // Now we can initialize the VMM
    //
    if (!LoaderInitVmm(InitVmmPacket))
    {
        return FALSE;
    }
 
    //
    // Set the kernel status to success
    //
    InitVmmPacket->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
    return TRUE;
}

LoaderInitHyperLog()

BOOLEAN LoaderInitHyperLog

(

)

Initialize the hyper log module.

Returns

BOOLEAN

{
    MESSAGE_TRACING_CALLBACKS MsgTracingCallbacks = {0};
 
    //
    // *** Fill the callbacks for the message tracer ***
    //
    MsgTracingCallbacks.VmxOperationCheck            = VmFuncVmxGetCurrentExecutionMode;
    MsgTracingCallbacks.CheckImmediateMessageSending = KdCheckImmediateMessagingMechanism;
    MsgTracingCallbacks.SendImmediateMessage         = KdLoggingResponsePacketToDebugger;
 
    //
    // Initialize message tracer (if not already initialized)
    //
    if (g_HyperLogInitialized == FALSE && LogInitialize(&MsgTracingCallbacks))
    {
        g_HyperLogInitialized = TRUE;
 
        LogDebugInfo("HyperDbg's hyperlog loaded successfully");
 
        return TRUE;
    }
    else
    {
        //
        // We use DbgPrint here because if the hyperlog is not loaded we can't use it to log the error
        // so we just log the error with DbgPrint and continue without loading hyperlog
        //
        DbgPrint("Err, HyperDbg's hyperlog was not loaded or already loaded");
        return FALSE;
    }
}

LoaderInitHyperTrace()

BOOLEAN LoaderInitHyperTrace	(	PDEBUGGER_INIT_HYPERTRACE_PACKET	InitHyperTracePacket,
		BOOLEAN	RunningOnHypervisorEnvironment )

Initialize the hyper trace module.

Parameters

RunningOnHypervisorEnvironment

Whether the initialization is being done for hypervisor environment or not

Returns

BOOLEAN

{
    HYPERTRACE_CALLBACKS HyperTraceCallbacks = {0};
 
    //
    // *** Fill the callbacks for using hypertrace ***
    //
 
    //
    // Fill the callbacks for using hyperlog in hypertrace
    // We use the callbacks directly to avoid two calls to the same function
    //
    HyperTraceCallbacks.LogCallbackPrepareAndSendMessageToQueueWrapper = LogCallbackPrepareAndSendMessageToQueueWrapper;
    HyperTraceCallbacks.LogCallbackSendMessageToQueue                  = LogCallbackSendMessageToQueue;
    HyperTraceCallbacks.LogCallbackSendBuffer                          = LogCallbackSendBuffer;
    HyperTraceCallbacks.LogCallbackCheckIfBufferIsFull                 = LogCallbackCheckIfBufferIsFull;
 
    //
    // Fill the callbacks for using hyperhv in hypertrace
    //
    HyperTraceCallbacks.VmFuncVmxGetCurrentExecutionMode = VmFuncVmxGetCurrentExecutionMode;
 
    //
    // *** Legacy LBR callbacks ***
    //
 
    HyperTraceCallbacks.VmFuncCheckCpuSupportForSaveAndLoadDebugControls = VmFuncCheckCpuSupportForSaveAndLoadDebugControls;
 
    HyperTraceCallbacks.VmFuncGetDebugctl                   = VmFuncGetDebugctl;
    HyperTraceCallbacks.VmFuncGetDebugctlVmcallOnTargetCore = VmFuncGetDebugctlVmcallOnTargetCore;
    HyperTraceCallbacks.VmFuncSetDebugctl                   = VmFuncSetDebugctl;
    HyperTraceCallbacks.VmFuncSetDebugctlVmcallOnTargetCore = VmFuncSetDebugctlVmcallOnTargetCore;
 
    HyperTraceCallbacks.VmFuncSetLoadDebugControls                   = VmFuncSetLoadDebugControls;
    HyperTraceCallbacks.VmFuncSetLoadDebugControlsVmcallOnTargetCore = VmFuncSetLoadDebugControlsVmcallOnTargetCore;
    HyperTraceCallbacks.VmFuncSetSaveDebugControls                   = VmFuncSetSaveDebugControls;
    HyperTraceCallbacks.VmFuncSetSaveDebugControlsVmcallOnTargetCore = VmFuncSetSaveDebugControlsVmcallOnTargetCore;
 
    HyperTraceCallbacks.VmFuncSetLbrSelect                   = VmFuncSetLbrSelect;
    HyperTraceCallbacks.VmFuncSetLbrSelectVmcallOnTargetCore = VmFuncSetLbrSelectVmcallOnTargetCore;
 
    //
    // *** Architectural LBR callbacks ***
    //
 
    HyperTraceCallbacks.VmFuncCheckCpuSupportForLoadAndClearGuestIa32LbrCtlControls = VmFuncCheckCpuSupportForLoadAndClearGuestIa32LbrCtlControls;
 
    HyperTraceCallbacks.VmFuncGetGuestIa32LbrCtl                   = VmFuncGetGuestIa32LbrCtl;
    HyperTraceCallbacks.VmFuncGetGuestIa32LbrCtlVmcallOnTargetCore = VmFuncGetGuestIa32LbrCtlVmcallOnTargetCore;
    HyperTraceCallbacks.VmFuncSetGuestIa32LbrCtl                   = VmFuncSetGuestIa32LbrCtl;
    HyperTraceCallbacks.VmFuncSetGuestIa32LbrCtlVmcallOnTargetCore = VmFuncSetGuestIa32LbrCtlVmcallOnTargetCore;
 
    HyperTraceCallbacks.VmFuncSetLoadGuestIa32LbrCtl                    = VmFuncSetLoadGuestIa32LbrCtl;
    HyperTraceCallbacks.VmFuncSetLoadGuestIa32LbrCtlVmcallOnTargetCore  = VmFuncSetLoadGuestIa32LbrCtlVmcallOnTargetCore;
    HyperTraceCallbacks.VmFuncSetClearGuestIa32LbrCtl                   = VmFuncSetClearGuestIa32LbrCtl;
    HyperTraceCallbacks.VmFuncSetClearGuestIa32LbrCtlVmcallOnTargetCore = VmFuncSetClearGuestIa32LbrCtlVmcallOnTargetCore;
 
    //
    // Initialize hypertrace module
    //
    if (HyperTraceInitCallback(&HyperTraceCallbacks, RunningOnHypervisorEnvironment))
    {
        LogDebugInfo("HyperDbg's hypertrace loaded successfully");
 
        //
        // Mark hypertrace as initialized
        //
        g_HyperTraceInitialized = TRUE;
 
        //
        // Set the kernel status to success
        //
        InitHyperTracePacket->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
        return TRUE;
    }
    else
    {
        //
        // We won't fail the loading just because of hypertrace, so we just log the error and continue without loading hypertrace
        //
        LogDebugInfo("Err, HyperDbg's hypertrace was not loaded");
 
        //
        // Set the kernel status to indicate failure
        //
        InitHyperTracePacket->KernelStatus = DEBUGGER_ERROR_HYPERTRACE_NOT_INITIALIZED;
 
        return FALSE;
    }
}

LoaderUninitHyperTrace()

VOID LoaderUninitHyperTrace

(

)

Uninitialize the hyper trace module.

Returns

VOID

{
    //
    // Mark hypertrace as uninitialized before uninitializing it to avoid any potential reentrancy issues during the uninitialization process
    //
    g_HyperTraceInitialized = FALSE;
 
    //
    // Uninitialize the hypertrace
    //
    HyperTraceUninit();
}

LoaderUninitLogTracer()

VOID LoaderUninitLogTracer

(

)

Uninitialize the log tracer.

Returns

VOID

{
    LogDebugInfo("Unloading HyperDbg's debugger...\n");
 
#if !UseDbgPrintInsteadOfUsermodeMessageTracking
 
    //
    // Uinitialize log buffer
    //
    LogDebugInfo("Uninitializing logs\n");
    LogUnInitialize();
#endif
}

LoaderUninitVmmAndDebugger()

VOID LoaderUninitVmmAndDebugger

(

)

Uninitialize the VMM and the debugger.

Returns

VOID

{
    //
    // Uninitialize the VMM first because it relies on the debugger for some
    //
    LoaderUninitVmm();
 
    //
    // Uninitialize the debugger
    //
    LoaderUninitKd();
}