HyperDbg Debugger
Loading...
Searching...
No Matches
Classes | Macros | Typedefs | Enumerations | Functions
Common.h File Reference

Header files for common functions. More...

Go to the source code of this file.

Classes

struct  _CPUID
 CPUID Registers. More...
 
union  _CR_FIXED
 
struct  _NT_KPROCESS
 KPROCESS Brief structure. More...
 

Macros

#define PASSIVE_LEVEL   0
 
#define LOW_LEVEL   0
 
#define APC_LEVEL   1
 
#define DISPATCH_LEVEL   2
 
#define CMCI_LEVEL   5
 
#define CLOCK_LEVEL   13
 
#define IPI_LEVEL   14
 
#define DRS_LEVEL   14
 
#define POWER_LEVEL   14
 
#define PROFILE_LEVEL   15
 
#define HIGH_LEVEL   15
 
#define X86_CR0_PE   0x00000001 /* Enable Protected Mode (RW) */
 Intel CPU flags in CR0.
 
#define X86_CR0_MP   0x00000002 /* Monitor Coprocessor (RW) */
 
#define X86_CR0_EM   0x00000004 /* Require FPU Emulation (RO) */
 
#define X86_CR0_TS   0x00000008 /* Task Switched (RW) */
 
#define X86_CR0_ET   0x00000010 /* Extension type (RO) */
 
#define X86_CR0_NE   0x00000020 /* Numeric Error Reporting (RW) */
 
#define X86_CR0_WP   0x00010000 /* Supervisor Write Protect (RW) */
 
#define X86_CR0_AM   0x00040000 /* Alignment Checking (RW) */
 
#define X86_CR0_NW   0x20000000 /* Not Write-Through (RW) */
 
#define X86_CR0_CD   0x40000000 /* Cache Disable (RW) */
 
#define X86_CR0_PG   0x80000000 /* Paging */
 
#define X86_CR4_VME   0x0001 /* enable vm86 extensions */
 Intel CPU features in CR4.
 
#define X86_CR4_PVI   0x0002 /* virtual interrupts flag enable */
 
#define X86_CR4_TSD   0x0004 /* disable time stamp at ipl 3 */
 
#define X86_CR4_DE   0x0008 /* enable debugging extensions */
 
#define X86_CR4_PSE   0x0010 /* enable page size extensions */
 
#define X86_CR4_PAE   0x0020 /* enable physical address extensions */
 
#define X86_CR4_MCE   0x0040 /* Machine check enable */
 
#define X86_CR4_PGE   0x0080 /* enable global pages */
 
#define X86_CR4_PCE   0x0100 /* enable performance counters at ipl 3 */
 
#define X86_CR4_OSFXSR   0x0200 /* enable fast FPU save and restore */
 
#define X86_CR4_OSXMMEXCPT   0x0400 /* enable unmasked SSE exceptions */
 
#define X86_CR4_VMXE   0x2000 /* enable VMX */
 
#define X86_FLAGS_CF   (1 << 0)
 EFLAGS/RFLAGS.
 
#define X86_FLAGS_PF   (1 << 2)
 
#define X86_FLAGS_AF   (1 << 4)
 
#define X86_FLAGS_ZF   (1 << 6)
 
#define X86_FLAGS_SF   (1 << 7)
 
#define X86_FLAGS_TF   (1 << 8)
 
#define X86_FLAGS_IF   (1 << 9)
 
#define X86_FLAGS_DF   (1 << 10)
 
#define X86_FLAGS_OF   (1 << 11)
 
#define X86_FLAGS_STATUS_MASK   (0xfff)
 
#define X86_FLAGS_IOPL_MASK   (3 << 12)
 
#define X86_FLAGS_IOPL_SHIFT   (12)
 
#define X86_FLAGS_IOPL_SHIFT_2ND_BIT   (13)
 
#define X86_FLAGS_NT   (1 << 14)
 
#define X86_FLAGS_RF   (1 << 16)
 
#define X86_FLAGS_VM   (1 << 17)
 
#define X86_FLAGS_AC   (1 << 18)
 
#define X86_FLAGS_VIF   (1 << 19)
 
#define X86_FLAGS_VIP   (1 << 20)
 
#define X86_FLAGS_ID   (1 << 21)
 
#define X86_FLAGS_RESERVED_ONES   0x2
 
#define X86_FLAGS_RESERVED   0xffc0802a
 
#define X86_FLAGS_RESERVED_BITS   0xffc38028
 
#define X86_FLAGS_FIXED   0x00000002
 
#define KGDT64_NULL   (0 * 16)
 
#define KGDT64_R0_CODE   (1 * 16)
 
#define KGDT64_R0_DATA   (1 * 16) + 8
 
#define KGDT64_R3_CMCODE   (2 * 16)
 
#define KGDT64_R3_DATA   (2 * 16) + 8
 
#define KGDT64_R3_CODE   (3 * 16)
 
#define KGDT64_SYS_TSS   (4 * 16)
 
#define KGDT64_R3_CMTEB   (5 * 16)
 
#define KGDT64_R0_CMCODE   (6 * 16)
 
#define KGDT64_LAST   (7 * 16)
 
#define PCID_NONE   0x000
 PCID Flags.
 
#define PCID_MASK   0x003
 
#define CPUID_HV_VENDOR_AND_MAX_FUNCTIONS   0x40000000
 The Microsoft Hypervisor interface defined constants.
 
#define CPUID_HV_INTERFACE   0x40000001
 
#define CPUID_ADDR_WIDTH   0x80000008
 Cpuid to get virtual address width.
 
#define CPUID_PROCESSOR_AND_PROCESSOR_FEATURE_IDENTIFIERS   0x00000001
 CPUID Features.
 
#define RESERVED_MSR_RANGE_LOW   0x40000000
 Hypervisor reserved range for RDMSR and WRMSR.
 
#define RESERVED_MSR_RANGE_HI   0x400000F0
 
#define __CPU_INDEX__   KeGetCurrentProcessorNumberEx(NULL)
 Core Id.
 
#define ALIGNMENT_PAGE_SIZE   4096
 Alignment Size.
 
#define MAXIMUM_ADDRESS   0xffffffffffffffff
 Maximum x64 Address.
 
#define DPL_USER   3
 System and User ring definitions.
 
#define DPL_SYSTEM   0
 
#define RPL_MASK   3
 RPL Mask.
 
#define BITS_PER_LONG   (sizeof(unsigned long) * 8)
 
#define ORDER_LONG   (sizeof(unsigned long) == 4 ? 5 : 6)
 
#define BITMAP_ENTRY(_nr, _bmap)   ((_bmap))[(_nr) / BITS_PER_LONG]
 
#define BITMAP_SHIFT(_nr)   ((_nr) % BITS_PER_LONG)
 
#define PAGE_OFFSET(Va)   ((PVOID)((ULONG_PTR)(Va) & (PAGE_SIZE - 1)))
 Offset from a page's 4096 bytes.
 
#define _XBEGIN_STARTED   (~0u)
 Intel TSX Constants.
 
#define _XABORT_EXPLICIT   (1 << 0)
 
#define _XABORT_RETRY   (1 << 1)
 
#define _XABORT_CONFLICT   (1 << 2)
 
#define _XABORT_CAPACITY   (1 << 3)
 
#define _XABORT_DEBUG   (1 << 4)
 
#define _XABORT_NESTED   (1 << 5)
 
#define _XABORT_CODE(x)   (((x) >> 24) & 0xFF)
 

Typedefs

typedef enum _SEGMENT_REGISTERS SEGMENT_REGISTERS
 Segment selector registers in x86.
 
typedef SEGMENT_DESCRIPTOR_32 * PSEGMENT_DESCRIPTOR
 
typedef struct _CPUID CPUID
 CPUID Registers.
 
typedef struct _CPUID * PCPUID
 
typedef union _CR_FIXED CR_FIXED
 
typedef union _CR_FIXED * PCR_FIXED
 
typedef struct _NT_KPROCESS NT_KPROCESS
 KPROCESS Brief structure.
 
typedef struct _NT_KPROCESS * PNT_KPROCESS
 
typedef void(* RunOnLogicalCoreFunc) (ULONG ProcessorId)
 Prototype to run a function on a logical core.
 

Enumerations

enum  _SEGMENT_REGISTERS {
  ES = 0 , CS , SS , DS ,
  FS , GS , LDTR , TR
}
 Segment selector registers in x86. More...
 

Functions

UCHAR * PsGetProcessImageFileName (IN PEPROCESS Process)
 
BOOLEAN CommonAffinityBroadcastToProcessors (_In_ ULONG ProcessorNumber, _In_ RunOnLogicalCoreFunc Routine)
 
BOOLEAN CommonIsStringStartsWith (const char *pre, const char *str)
 Detects whether the string starts with another string.
 
BOOLEAN CommonIsGuestOnUsermode32Bit ()
 determines if the guest was in 32-bit user-mode or 64-bit (long mode)
 
PCHAR CommonGetProcessNameFromProcessControlBlock (PEPROCESS eprocess)
 Get process name by eprocess.
 
VOID CommonCpuidInstruction (UINT32 Func, UINT32 SubFunc, int *CpuInfo)
 Get cpuid results.
 
VOID CommonWriteDebugInformation (VIRTUAL_MACHINE_STATE *VCpu)
 Produce debug information from unrecoverable bugs.
 

Detailed Description

Header files for common functions.

Author
Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)
Version
0.1
Date
2020-04-10
Copyright
This project is released under the GNU Public License v3.

Macro Definition Documentation

◆ __CPU_INDEX__

#define __CPU_INDEX__   KeGetCurrentProcessorNumberEx(NULL)

Core Id.

◆ _XABORT_CAPACITY

#define _XABORT_CAPACITY   (1 << 3)

◆ _XABORT_CODE

#define _XABORT_CODE ( x)    (((x) >> 24) & 0xFF)

◆ _XABORT_CONFLICT

#define _XABORT_CONFLICT   (1 << 2)

◆ _XABORT_DEBUG

#define _XABORT_DEBUG   (1 << 4)

◆ _XABORT_EXPLICIT

#define _XABORT_EXPLICIT   (1 << 0)

◆ _XABORT_NESTED

#define _XABORT_NESTED   (1 << 5)

◆ _XABORT_RETRY

#define _XABORT_RETRY   (1 << 1)

◆ _XBEGIN_STARTED

#define _XBEGIN_STARTED   (~0u)

Intel TSX Constants.

◆ ALIGNMENT_PAGE_SIZE

#define ALIGNMENT_PAGE_SIZE   4096

Alignment Size.

◆ APC_LEVEL

#define APC_LEVEL   1

◆ BITMAP_ENTRY

#define BITMAP_ENTRY ( _nr,
_bmap )   ((_bmap))[(_nr) / BITS_PER_LONG]

◆ BITMAP_SHIFT

#define BITMAP_SHIFT ( _nr)    ((_nr) % BITS_PER_LONG)

◆ BITS_PER_LONG

#define BITS_PER_LONG   (sizeof(unsigned long) * 8)

◆ CLOCK_LEVEL

#define CLOCK_LEVEL   13

◆ CMCI_LEVEL

#define CMCI_LEVEL   5

◆ CPUID_ADDR_WIDTH

#define CPUID_ADDR_WIDTH   0x80000008

Cpuid to get virtual address width.

◆ CPUID_HV_INTERFACE

#define CPUID_HV_INTERFACE   0x40000001

◆ CPUID_HV_VENDOR_AND_MAX_FUNCTIONS

#define CPUID_HV_VENDOR_AND_MAX_FUNCTIONS   0x40000000

The Microsoft Hypervisor interface defined constants.

◆ CPUID_PROCESSOR_AND_PROCESSOR_FEATURE_IDENTIFIERS

#define CPUID_PROCESSOR_AND_PROCESSOR_FEATURE_IDENTIFIERS   0x00000001

CPUID Features.

◆ DISPATCH_LEVEL

#define DISPATCH_LEVEL   2

◆ DPL_SYSTEM

#define DPL_SYSTEM   0

◆ DPL_USER

#define DPL_USER   3

System and User ring definitions.

◆ DRS_LEVEL

#define DRS_LEVEL   14

◆ HIGH_LEVEL

#define HIGH_LEVEL   15

◆ IPI_LEVEL

#define IPI_LEVEL   14

◆ KGDT64_LAST

#define KGDT64_LAST   (7 * 16)

◆ KGDT64_NULL

#define KGDT64_NULL   (0 * 16)

◆ KGDT64_R0_CMCODE

#define KGDT64_R0_CMCODE   (6 * 16)

◆ KGDT64_R0_CODE

#define KGDT64_R0_CODE   (1 * 16)

◆ KGDT64_R0_DATA

#define KGDT64_R0_DATA   (1 * 16) + 8

◆ KGDT64_R3_CMCODE

#define KGDT64_R3_CMCODE   (2 * 16)

◆ KGDT64_R3_CMTEB

#define KGDT64_R3_CMTEB   (5 * 16)

◆ KGDT64_R3_CODE

#define KGDT64_R3_CODE   (3 * 16)

◆ KGDT64_R3_DATA

#define KGDT64_R3_DATA   (2 * 16) + 8

◆ KGDT64_SYS_TSS

#define KGDT64_SYS_TSS   (4 * 16)

◆ LOW_LEVEL

#define LOW_LEVEL   0

◆ MAXIMUM_ADDRESS

#define MAXIMUM_ADDRESS   0xffffffffffffffff

Maximum x64 Address.

◆ ORDER_LONG

#define ORDER_LONG   (sizeof(unsigned long) == 4 ? 5 : 6)

◆ PAGE_OFFSET

#define PAGE_OFFSET ( Va)    ((PVOID)((ULONG_PTR)(Va) & (PAGE_SIZE - 1)))

Offset from a page's 4096 bytes.

◆ PASSIVE_LEVEL

#define PASSIVE_LEVEL   0

◆ PCID_MASK

#define PCID_MASK   0x003

◆ PCID_NONE

#define PCID_NONE   0x000

PCID Flags.

◆ POWER_LEVEL

#define POWER_LEVEL   14

◆ PROFILE_LEVEL

#define PROFILE_LEVEL   15

◆ RESERVED_MSR_RANGE_HI

#define RESERVED_MSR_RANGE_HI   0x400000F0

◆ RESERVED_MSR_RANGE_LOW

#define RESERVED_MSR_RANGE_LOW   0x40000000

Hypervisor reserved range for RDMSR and WRMSR.

◆ RPL_MASK

#define RPL_MASK   3

RPL Mask.

◆ X86_CR0_AM

#define X86_CR0_AM   0x00040000 /* Alignment Checking (RW) */

◆ X86_CR0_CD

#define X86_CR0_CD   0x40000000 /* Cache Disable (RW) */

◆ X86_CR0_EM

#define X86_CR0_EM   0x00000004 /* Require FPU Emulation (RO) */

◆ X86_CR0_ET

#define X86_CR0_ET   0x00000010 /* Extension type (RO) */

◆ X86_CR0_MP

#define X86_CR0_MP   0x00000002 /* Monitor Coprocessor (RW) */

◆ X86_CR0_NE

#define X86_CR0_NE   0x00000020 /* Numeric Error Reporting (RW) */

◆ X86_CR0_NW

#define X86_CR0_NW   0x20000000 /* Not Write-Through (RW) */

◆ X86_CR0_PE

#define X86_CR0_PE   0x00000001 /* Enable Protected Mode (RW) */

Intel CPU flags in CR0.

◆ X86_CR0_PG

#define X86_CR0_PG   0x80000000 /* Paging */

◆ X86_CR0_TS

#define X86_CR0_TS   0x00000008 /* Task Switched (RW) */

◆ X86_CR0_WP

#define X86_CR0_WP   0x00010000 /* Supervisor Write Protect (RW) */

◆ X86_CR4_DE

#define X86_CR4_DE   0x0008 /* enable debugging extensions */

◆ X86_CR4_MCE

#define X86_CR4_MCE   0x0040 /* Machine check enable */

◆ X86_CR4_OSFXSR

#define X86_CR4_OSFXSR   0x0200 /* enable fast FPU save and restore */

◆ X86_CR4_OSXMMEXCPT

#define X86_CR4_OSXMMEXCPT   0x0400 /* enable unmasked SSE exceptions */

◆ X86_CR4_PAE

#define X86_CR4_PAE   0x0020 /* enable physical address extensions */

◆ X86_CR4_PCE

#define X86_CR4_PCE   0x0100 /* enable performance counters at ipl 3 */

◆ X86_CR4_PGE

#define X86_CR4_PGE   0x0080 /* enable global pages */

◆ X86_CR4_PSE

#define X86_CR4_PSE   0x0010 /* enable page size extensions */

◆ X86_CR4_PVI

#define X86_CR4_PVI   0x0002 /* virtual interrupts flag enable */

◆ X86_CR4_TSD

#define X86_CR4_TSD   0x0004 /* disable time stamp at ipl 3 */

◆ X86_CR4_VME

#define X86_CR4_VME   0x0001 /* enable vm86 extensions */

Intel CPU features in CR4.

◆ X86_CR4_VMXE

#define X86_CR4_VMXE   0x2000 /* enable VMX */

◆ X86_FLAGS_AC

#define X86_FLAGS_AC   (1 << 18)

◆ X86_FLAGS_AF

#define X86_FLAGS_AF   (1 << 4)

◆ X86_FLAGS_CF

#define X86_FLAGS_CF   (1 << 0)

EFLAGS/RFLAGS.

◆ X86_FLAGS_DF

#define X86_FLAGS_DF   (1 << 10)

◆ X86_FLAGS_FIXED

#define X86_FLAGS_FIXED   0x00000002

◆ X86_FLAGS_ID

#define X86_FLAGS_ID   (1 << 21)

◆ X86_FLAGS_IF

#define X86_FLAGS_IF   (1 << 9)

◆ X86_FLAGS_IOPL_MASK

#define X86_FLAGS_IOPL_MASK   (3 << 12)

◆ X86_FLAGS_IOPL_SHIFT

#define X86_FLAGS_IOPL_SHIFT   (12)

◆ X86_FLAGS_IOPL_SHIFT_2ND_BIT

#define X86_FLAGS_IOPL_SHIFT_2ND_BIT   (13)

◆ X86_FLAGS_NT

#define X86_FLAGS_NT   (1 << 14)

◆ X86_FLAGS_OF

#define X86_FLAGS_OF   (1 << 11)

◆ X86_FLAGS_PF

#define X86_FLAGS_PF   (1 << 2)

◆ X86_FLAGS_RESERVED

#define X86_FLAGS_RESERVED   0xffc0802a

◆ X86_FLAGS_RESERVED_BITS

#define X86_FLAGS_RESERVED_BITS   0xffc38028

◆ X86_FLAGS_RESERVED_ONES

#define X86_FLAGS_RESERVED_ONES   0x2

◆ X86_FLAGS_RF

#define X86_FLAGS_RF   (1 << 16)

◆ X86_FLAGS_SF

#define X86_FLAGS_SF   (1 << 7)

◆ X86_FLAGS_STATUS_MASK

#define X86_FLAGS_STATUS_MASK   (0xfff)

◆ X86_FLAGS_TF

#define X86_FLAGS_TF   (1 << 8)

◆ X86_FLAGS_VIF

#define X86_FLAGS_VIF   (1 << 19)

◆ X86_FLAGS_VIP

#define X86_FLAGS_VIP   (1 << 20)

◆ X86_FLAGS_VM

#define X86_FLAGS_VM   (1 << 17)

◆ X86_FLAGS_ZF

#define X86_FLAGS_ZF   (1 << 6)

Typedef Documentation

◆ CPUID

typedef struct _CPUID CPUID

CPUID Registers.

◆ CR_FIXED

typedef union _CR_FIXED CR_FIXED

◆ NT_KPROCESS

typedef struct _NT_KPROCESS NT_KPROCESS

KPROCESS Brief structure.

◆ PCPUID

typedef struct _CPUID * PCPUID

◆ PCR_FIXED

typedef union _CR_FIXED * PCR_FIXED

◆ PNT_KPROCESS

typedef struct _NT_KPROCESS * PNT_KPROCESS

◆ PSEGMENT_DESCRIPTOR

typedef SEGMENT_DESCRIPTOR_32* PSEGMENT_DESCRIPTOR

◆ RunOnLogicalCoreFunc

typedef void(* RunOnLogicalCoreFunc) (ULONG ProcessorId)

Prototype to run a function on a logical core.

◆ SEGMENT_REGISTERS

typedef enum _SEGMENT_REGISTERS SEGMENT_REGISTERS

Segment selector registers in x86.

Enumeration Type Documentation

◆ _SEGMENT_REGISTERS

enum _SEGMENT_REGISTERS

Segment selector registers in x86.

Enumerator
ES 
CS 
SS 
DS 
FS 
GS 
LDTR 
TR 
23{
24 ES = 0,
25 CS,
26 SS,
27 DS,
28 FS,
29 GS,
30 LDTR,
31 TR
32} SEGMENT_REGISTERS;
TR
@ TR
Definition Common.h:31
LDTR
@ LDTR
Definition Common.h:30
FS
@ FS
Definition Common.h:28
ES
@ ES
Definition Common.h:24
CS
@ CS
Definition Common.h:25
GS
@ GS
Definition Common.h:29
DS
@ DS
Definition Common.h:27
SS
@ SS
Definition Common.h:26
SEGMENT_REGISTERS
enum _SEGMENT_REGISTERS SEGMENT_REGISTERS
Segment selector registers in x86.

Function Documentation

◆ CommonAffinityBroadcastToProcessors()

BOOLEAN CommonAffinityBroadcastToProcessors ( _In_ ULONG ProcessorNumber,
_In_ RunOnLogicalCoreFunc Routine )

◆ CommonCpuidInstruction()

VOID CommonCpuidInstruction ( UINT32 Func,
UINT32 SubFunc,
int * CpuInfo )

Get cpuid results.

Parameters
UINT32Func
UINT32SubFunc
int* CpuInfo
Returns
VOID
86{
87 __cpuidex(CpuInfo, Func, SubFunc);
88}

◆ CommonGetProcessNameFromProcessControlBlock()

PCHAR CommonGetProcessNameFromProcessControlBlock ( PEPROCESS Eprocess)

Get process name by eprocess.

Parameters
EprocessProcess eprocess
Returns
PCHAR Returns a pointer to the process name
49{
50 PCHAR Result = 0;
51
52 //
53 // We can't use PsLookupProcessByProcessId as in pageable and not
54 // work on vmx-root
55 //
56 Result = (CHAR *)PsGetProcessImageFileName(Eprocess);
57
58 return Result;
59}
CHAR
char CHAR
Definition BasicTypes.h:31
PsGetProcessImageFileName
UCHAR * PsGetProcessImageFileName(IN PEPROCESS Process)

◆ CommonIsGuestOnUsermode32Bit()

BOOLEAN CommonIsGuestOnUsermode32Bit ( )

determines if the guest was in 32-bit user-mode or 64-bit (long mode)

this function should be called from vmx-root

Returns
BOOLEAN
98{
99 //
100 // Only 16 bit is needed however, VMWRITE might write on other bits
101 // and corrupt other variables, that's why we get 64bit
102 //
103 UINT64 CsSel = NULL64_ZERO;
104
105 //
106 // Read guest's cs selector
107 //
108 CsSel = HvGetCsSelector();
109
110 if (CsSel == KGDT64_R0_CODE)
111 {
112 //
113 // 64-bit kernel-mode
114 //
115 return FALSE;
116 }
117 else if ((CsSel & ~3) == KGDT64_R3_CODE)
118 {
119 //
120 // 64-bit user-mode
121 //
122 return FALSE;
123 }
124 else if ((CsSel & ~3) == KGDT64_R3_CMCODE)
125 {
126 //
127 // 32-bit user-mode
128 //
129 return TRUE;
130 }
131 else
132 {
133 LogError("Err, unknown value for cs, cannot determine wow64 mode");
134 }
135
136 //
137 // By default, 64-bit
138 //
139 return FALSE;
140}
NULL64_ZERO
#define NULL64_ZERO
Definition BasicTypes.h:52
TRUE
#define TRUE
Definition BasicTypes.h:55
FALSE
#define FALSE
Definition BasicTypes.h:54
UINT64
unsigned __int64 UINT64
Definition BasicTypes.h:21
HvGetCsSelector
UINT16 HvGetCsSelector()
Read CS selector.
Definition Hv.c:1132
LogError
#define LogError(format,...)
Log in the case of error.
Definition HyperDbgHyperLogIntrinsics.h:113
KGDT64_R3_CODE
#define KGDT64_R3_CODE
Definition Common.h:127
KGDT64_R0_CODE
#define KGDT64_R0_CODE
Definition Common.h:123
KGDT64_R3_CMCODE
#define KGDT64_R3_CMCODE
Definition Common.h:125

◆ CommonIsStringStartsWith()

BOOLEAN CommonIsStringStartsWith ( const char * pre,
const char * str )

Detects whether the string starts with another string.

Parameters
constchar * pre
constchar * str
Returns
BOOLEAN Returns true if it starts with and false if not strats with
70{
71 size_t lenpre = strlen(pre),
72 lenstr = strlen(str);
73 return lenstr < lenpre ? FALSE : memcmp(pre, str, lenpre) == 0;
74}

◆ CommonWriteDebugInformation()

VOID CommonWriteDebugInformation ( VIRTUAL_MACHINE_STATE * VCpu)

Produce debug information from unrecoverable bugs.

Parameters
VCpuThe virtual processor's state
Returns
VOID
150{
151 LogError("HyperDbg cannot recover from this error, please provide the following information through the Git issues");
152
153 LogInfo("Target RIP: %llx\n", VCpu->LastVmexitRip);
154
155 CHAR Instruction[MAXIMUM_INSTR_SIZE] = {0};
156
157 MemoryMapperReadMemorySafeOnTargetProcess(VCpu->LastVmexitRip, Instruction, MAXIMUM_INSTR_SIZE);
158
159 for (size_t i = 0; i < MAXIMUM_INSTR_SIZE; i++)
160 {
161 Log("%02X ", Instruction[i] & 0xffU);
162 }
163
164 Log("\n");
165 DisassemblerShowOneInstructionInVmxRootMode((PVOID)VCpu->LastVmexitRip,
166 CommonIsGuestOnUsermode32Bit());
167 Log("\n");
168
169 Log(
170 "RAX=%016llx RBX=%016llx RCX=%016llx\n"
171 "RDX=%016llx RSI=% 016llx RDI=%016llx\n"
172 "RIP=%016llx RSP=%016llx RBP=%016llx\n"
173 "R8 =%016llx R9 =%016llx R10=%016llx\n"
174 "R11=%016llx R12=%016llx R13=%016llx\n"
175 "R14=%016llx R15=%016llx\n",
176 VCpu->Regs->rax,
177 VCpu->Regs->rbx,
178 VCpu->Regs->rcx,
179 VCpu->Regs->rdx,
180 VCpu->Regs->rsi,
181 VCpu->Regs->rdi,
182 VCpu->LastVmexitRip,
183 VCpu->Regs->rsp,
184 VCpu->Regs->rbp,
185 VCpu->Regs->r8,
186 VCpu->Regs->r9,
187 VCpu->Regs->r10,
188 VCpu->Regs->r11,
189 VCpu->Regs->r12,
190 VCpu->Regs->r13,
191 VCpu->Regs->r14,
192 VCpu->Regs->r15);
193}
MAXIMUM_INSTR_SIZE
#define MAXIMUM_INSTR_SIZE
maximum instruction size in Intel
Definition Constants.h:468
DisassemblerShowOneInstructionInVmxRootMode
UINT32 DisassemblerShowOneInstructionInVmxRootMode(PVOID Address, BOOLEAN Is32Bit)
Shows the disassembly of only one instruction.
Definition Disassembler.c:328
Log
#define Log(format,...)
Log without any prefix.
Definition HyperDbgHyperLogIntrinsics.h:129
LogInfo
#define LogInfo(format,...)
Define log variables.
Definition HyperDbgHyperLogIntrinsics.h:71
MemoryMapperReadMemorySafeOnTargetProcess
_Use_decl_annotations_ BOOLEAN MemoryMapperReadMemorySafeOnTargetProcess(UINT64 VaAddressToRead, PVOID BufferToSaveMemory, SIZE_T SizeToRead)
Read memory safely by mapping the buffer on the target process memory (It's a wrapper)
Definition MemoryMapper.c:1120
CommonIsGuestOnUsermode32Bit
BOOLEAN CommonIsGuestOnUsermode32Bit()
determines if the guest was in 32-bit user-mode or 64-bit (long mode)
Definition Common.c:97
_VIRTUAL_MACHINE_STATE::Regs
GUEST_REGS * Regs
Definition State.h:305
_VIRTUAL_MACHINE_STATE::LastVmexitRip
UINT64 LastVmexitRip
Definition State.h:309
GUEST_REGS::rsp
UINT64 rsp
Definition BasicTypes.h:79
GUEST_REGS::r14
UINT64 r14
Definition BasicTypes.h:89
GUEST_REGS::r15
UINT64 r15
Definition BasicTypes.h:90
GUEST_REGS::rdi
UINT64 rdi
Definition BasicTypes.h:82
GUEST_REGS::rax
UINT64 rax
Definition BasicTypes.h:75
GUEST_REGS::r12
UINT64 r12
Definition BasicTypes.h:87
GUEST_REGS::r13
UINT64 r13
Definition BasicTypes.h:88
GUEST_REGS::r9
UINT64 r9
Definition BasicTypes.h:84
GUEST_REGS::r8
UINT64 r8
Definition BasicTypes.h:83
GUEST_REGS::rbp
UINT64 rbp
Definition BasicTypes.h:80
GUEST_REGS::rbx
UINT64 rbx
Definition BasicTypes.h:78
GUEST_REGS::r10
UINT64 r10
Definition BasicTypes.h:85
GUEST_REGS::rcx
UINT64 rcx
Definition BasicTypes.h:76
GUEST_REGS::rsi
UINT64 rsi
Definition BasicTypes.h:81
GUEST_REGS::r11
UINT64 r11
Definition BasicTypes.h:86
GUEST_REGS::rdx
UINT64 rdx
Definition BasicTypes.h:77

◆ PsGetProcessImageFileName()

UCHAR * PsGetProcessImageFileName ( IN PEPROCESS Process)