HyperDbg Debugger
Loading...
Searching...
No Matches
Kd.h
Go to the documentation of this file.
1
12#pragma once
13
15// Locks //
17
23
29
31// Structures //
33
44
55
66
79
81// Functions //
83
84// ----------------------------------------------------------------------------
85// Private Interfaces
86//
87
88static VOID
89KdCustomDebuggerBreakSpinlockLock(PROCESSOR_DEBUGGING_STATE * DbgState, volatile LONG * Lock);
90
91static VOID
92KdDummyDPC(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2);
93
94static VOID
95KdFireDpc(PVOID Routine, PVOID Parameter);
96
97static BYTE
98KdComputeDataChecksum(_In_reads_bytes_(Length) PVOID Buffer,
99 _In_ UINT32 Length);
100
101static VOID
103
104static VOID
106
107static VOID
109 _In_ BOOLEAN PauseBreaksUntilSpecialMessageSent,
110 _In_ _Strict_type_match_ DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION SpeialEventResponse);
111
112static VOID
114
115static BOOLEAN
117 _Inout_ PDEBUGGEE_REGISTER_READ_DESCRIPTION ReadRegisterRequest);
118static BOOLEAN
119KdReadMemory(_In_ PGUEST_REGS Regs,
120 _Inout_ PDEBUGGEE_REGISTER_READ_DESCRIPTION ReadRegisterRequest);
121
122static BOOLEAN
124 DEBUGGEE_CHANGE_CORE_PACKET * ChangeCorePacket);
125
126static VOID
128
129static VOID
131
132static VOID
134
135static VOID
137
138static VOID
140
141static VOID
142KdRegularStepOver(PROCESSOR_DEBUGGING_STATE * DbgState, BOOLEAN IsNextInstructionACall, UINT32 CallLength);
143
144static BOOLEAN
146 DEBUGGER_EVENT_AND_ACTION_RESULT * DebuggerEventAndActionResult);
147
148static BOOLEAN
150 DEBUGGER_EVENT_AND_ACTION_RESULT * DebuggerEventAndActionResult);
151
152static VOID
154
155static BOOLEAN
157
158static BOOLEAN
160
161static BOOLEAN
163
164static VOID
166
167static VOID
169
170// ----------------------------------------------------------------------------
171// Public Interfaces
172//
173
174VOID
176
177VOID
179
180VOID
185
186VOID
188
189VOID
191
192VOID
194
195VOID
197
198VOID
200
201VOID
203
204VOID
206 _In_ DEBUGGEE_PAUSING_REASON Reason,
208VOID
210 _In_ DEBUGGEE_PAUSING_REASON Reason,
212
213VOID
215
216VOID
218
221
223KdResponsePacketToDebugger(_In_ _Strict_type_match_ DEBUGGER_REMOTE_PACKET_TYPE PacketType,
224 _In_ _Strict_type_match_ DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION Response,
225 _In_reads_bytes_opt_(OptionalBufferLength) CHAR * OptionalBuffer,
226 _In_ UINT32 OptionalBufferLength);
227
229KdLoggingResponsePacketToDebugger(_In_reads_bytes_(OptionalBufferLength) CHAR * OptionalBuffer,
230 _In_ UINT32 OptionalBufferLength,
231 _In_ UINT32 OperationCode);
232
234KdCheckGuestOperatingModeChanges(UINT16 PreviousCsSelector, UINT16 CurrentCsSelector);
235
238
239VOID
240KdHandleNmiBroadcastDebugBreaks(UINT32 CoreId, BOOLEAN IsOnVmxNmiHandler);
241
242VOID
244
247
unsigned short UINT16
Definition BasicTypes.h:47
UCHAR BOOLEAN
Definition BasicTypes.h:39
unsigned char BYTE
Definition BasicTypes.h:24
#define VOID
Definition BasicTypes.h:33
unsigned __int64 UINT64
Definition BasicTypes.h:21
unsigned int UINT32
Definition BasicTypes.h:48
char CHAR
Definition BasicTypes.h:31
enum _DEBUGGER_REMOTE_PACKET_TYPE DEBUGGER_REMOTE_PACKET_TYPE
enum for different packet types in HyperDbg packets
enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION
enum for requested action for HyperDbg packet
enum _DEBUGGEE_PAUSING_REASON DEBUGGEE_PAUSING_REASON
enum for reasons why debuggee is paused
enum _DEBUGGER_THREAD_PROCESS_TRACING DEBUGGER_THREAD_PROCESS_TRACING
enum to query different process and thread interception mechanisms
VOID KdContinueDebuggeeJustCurrentCore(PROCESSOR_DEBUGGING_STATE *DbgState)
continue the debuggee, just the current operating core
Definition Kd.c:616
BOOLEAN KdCheckTargetCoreIsLocked(UINT32 CoreNumber)
Check whether a specific target core is locked or not.
Definition Kd.c:1734
VOID KdRegularStepInInstruction(PROCESSOR_DEBUGGING_STATE *DbgState)
Regular step-in | step one instruction to the debuggee.
Definition Kd.c:1515
VOID KdApplyTasksPreHaltCore(PROCESSOR_DEBUGGING_STATE *DbgState)
before halting any core, all the tasks will be applied to all cores including the main core
Definition Kd.c:517
_Use_decl_annotations_ VOID KdReloadSymbolDetailsInDebuggee(PDEBUGGEE_SYMBOL_REQUEST_PACKET SymPacket)
Notify user-mode to re-send (reload) the symbol packets.
Definition Kd.c:851
_Use_decl_annotations_ BOOLEAN KdReadMemory(PGUEST_REGS Regs, PDEBUGGEE_REGISTER_READ_DESCRIPTION ReadRegisterRequest)
read registers
Definition Kd.c:688
VOID KdNotifyDebuggeeForUserInput(DEBUGGEE_USER_INPUT_PACKET *Descriptor, UINT32 Len)
Notify user-mode to about new user-input buffer.
Definition Kd.c:876
VOID KdGuaranteedStepInstruction(PROCESSOR_DEBUGGING_STATE *DbgState)
apply a guaranteed step one instruction to the debuggee
Definition Kd.c:1406
BOOLEAN KdPerformEventQueryAndModification(PDEBUGGER_MODIFY_EVENTS ModifyAndQueryEvent)
Perform modify and query events.
Definition Kd.c:2084
_Use_decl_annotations_ VOID KdContinueDebuggee(PROCESSOR_DEBUGGING_STATE *DbgState, BOOLEAN PauseBreaksUntilSpecialMessageSent, DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION SpeialEventResponse)
continue the debuggee, this function guarantees that all other cores are continued (except current co...
Definition Kd.c:583
_Use_decl_annotations_ BYTE KdComputeDataChecksum(PVOID Buffer, UINT32 Length)
calculate the checksum of received buffer from debugger
Definition Kd.c:270
VOID KdCustomDebuggerBreakSpinlockLock(PROCESSOR_DEBUGGING_STATE *DbgState, volatile LONG *Lock)
Tries to get the lock and won't return until successfully get the lock.
Definition Kd.c:993
BOOLEAN KdPerformRegisterEvent(PDEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET EventDetailHeader, DEBUGGER_EVENT_AND_ACTION_RESULT *DebuggerEventAndActionResult)
Send event registration buffer to user-mode to register the event.
Definition Kd.c:1584
VOID KdCloseConnectionAndUnloadDebuggee()
Notify user-mode to unload the debuggee and close the connections.
Definition Kd.c:827
_Use_decl_annotations_ BOOLEAN KdReadRegisters(PROCESSOR_DEBUGGING_STATE *DbgState, PDEBUGGEE_REGISTER_READ_DESCRIPTION ReadRegisterRequest)
read registers
Definition Kd.c:639
VOID KdDispatchAndPerformCommandsFromDebugger(PROCESSOR_DEBUGGING_STATE *DbgState)
This function applies commands from the debugger to the debuggee.
Definition Kd.c:2292
BOOLEAN KdPerformAddActionToEvent(PDEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET ActionDetailHeader, DEBUGGER_EVENT_AND_ACTION_RESULT *DebuggerEventAndActionResult)
Send action buffer to user-mode to be added to the event.
Definition Kd.c:1636
VOID KdDummyDPC(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
A test function for DPC.
Definition Kd.c:184
VOID KdFireDpc(PVOID Routine, PVOID Parameter)
Add a DPC to dpc queue.
Definition Kd.c:202
BOOLEAN KdSwitchCore(PROCESSOR_DEBUGGING_STATE *DbgState, DEBUGGEE_CHANGE_CORE_PACKET *ChangeCorePacket)
change the current operating core to new core
Definition Kd.c:736
VOID KdQuerySystemState()
Query state of the system.
Definition Kd.c:1762
VOID KdRegularStepOver(PROCESSOR_DEBUGGING_STATE *DbgState, BOOLEAN IsNextInstructionACall, UINT32 CallLength)
Regular step-over | step one instruction to the debuggee if there is a call then it jumps the call.
Definition Kd.c:1536
VOID KdBroadcastHaltOnAllCores()
routines for broadcast system halt
Definition Kd.c:3361
VOID KdApplyTasksPostContinueCore(PROCESSOR_DEBUGGING_STATE *DbgState)
before continue any core, all the tasks will be applied to all cores including the main core
Definition Kd.c:556
BOOLEAN KdCheckAllCoresAreLocked()
Check whether all cores are locked or not.
Definition Kd.c:1701
BOOLEAN KdCheckImmediateMessagingMechanism(UINT32 OperationCode)
Checks whether the immediate messaging mechism is needed or not.
Definition Kd.c:120
VOID KdSendFormatsFunctionResult(UINT64 Value)
Notify user-mode to unload the debuggee and close the connections.
Definition Kd.c:900
struct _DEBUGGEE_REQUEST_TO_CHANGE_PROCESS DEBUGGEE_REQUEST_TO_CHANGE_PROCESS
request to change the process
VOID KdHandleHaltsWhenNmiReceivedFromVmxRoot(_Inout_ PROCESSOR_DEBUGGING_STATE *DbgState)
struct _HARDWARE_DEBUG_REGISTER_DETAILS HARDWARE_DEBUG_REGISTER_DETAILS
store the details of a hardware debug register to ignore any trigger for other threads
struct _DEBUGGEE_REQUEST_TO_IGNORE_BREAKS_UNTIL_AN_EVENT * PDEBUGGEE_REQUEST_TO_IGNORE_BREAKS_UNTIL_AN_EVENT
VOID KdHandleRegisteredMtfCallback(_In_ UINT32 CoreId)
VOID KdSendCommandFinishedSignal(UINT32 CoreId)
Notify debugger that the execution of command finished.
Definition Kd.c:924
VOID KdHandleNmi(_Inout_ PROCESSOR_DEBUGGING_STATE *DbgState)
struct _DEBUGGEE_REQUEST_TO_CHANGE_THREAD DEBUGGEE_REQUEST_TO_CHANGE_THREAD
request to change the thread
VOID KdHandleBreakpointAndDebugBreakpointsCallback(_In_ UINT32 CoreId, _In_ DEBUGGEE_PAUSING_REASON Reason, PDEBUGGER_TRIGGERED_EVENT_DETAILS EventDetails)
BOOLEAN KdCheckGuestOperatingModeChanges(UINT16 PreviousCsSelector, UINT16 CurrentCsSelector)
Check if the execution mode (kernel-mode to user-mode or user-mode to kernel-mode) changed.
Definition Kd.c:1453
struct _DEBUGGEE_REQUEST_TO_CHANGE_PROCESS * PDEBUGGEE_REQUEST_TO_CHANGE_PROCESS
BOOLEAN KdIsGuestOnUsermode32Bit()
determines if the guest was in 32-bit user-mode or 64-bit (long mode)
Definition Kd.c:3107
VOID KdManageSystemHaltOnVmxRoot(PROCESSOR_DEBUGGING_STATE *DbgState, PDEBUGGER_TRIGGERED_EVENT_DETAILS EventDetails)
manage system halt on vmx-root mode
Definition Kd.c:3162
BOOLEAN KdCheckAndHandleNmiCallback(_In_ UINT32 CoreId)
VOID KdUninitializeKernelDebugger()
uninitialize kernel debugger
Definition Kd.c:81
VOID KdInitializeKernelDebugger()
initialize kernel debugger
Definition Kd.c:22
volatile LONG DebuggerHandleBreakpointLock
Vmx-root lock for handling breaks to debugger.
Definition Kd.h:28
VOID KdHandleNmiBroadcastDebugBreaks(UINT32 CoreId, BOOLEAN IsOnVmxNmiHandler)
Handle broadcast NMIs for halting cores in vmx-root mode.
Definition Kd.c:1062
struct _HARDWARE_DEBUG_REGISTER_DETAILS * PHARDWARE_DEBUG_REGISTER_DETAILS
BOOLEAN KdCheckTheHaltedCore(PROCESSOR_DEBUGGING_STATE *DbgState)
check the lock state of the target core
Definition Kd.c:1825
VOID KdHaltSystem(PDEBUGGER_PAUSE_PACKET_RECEIVED PausePacket)
Halt the system.
Definition Kd.c:3376
volatile LONG DebuggerResponseLock
Vmx-root lock for sending response of debugger.
Definition Kd.h:22
BOOLEAN KdQueryDebuggerQueryThreadOrProcessTracingDetailsByCoreId(UINT32 CoreId, DEBUGGER_THREAD_PROCESS_TRACING TracingType)
Query for process/thread interception status.
Definition Kd.c:219
struct _DEBUGGEE_REQUEST_TO_CHANGE_THREAD * PDEBUGGEE_REQUEST_TO_CHANGE_THREAD
VOID KdUnlockTheHaltedCore(PROCESSOR_DEBUGGING_STATE *DbgState)
unlock the target core
Definition Kd.c:1812
VOID KdInitializeInstantEventPools()
Initialize the required pools for instant events.
Definition Kd.c:131
BOOLEAN KdResponsePacketToDebugger(_In_ _Strict_type_match_ DEBUGGER_REMOTE_PACKET_TYPE PacketType, _In_ _Strict_type_match_ DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION Response, _In_reads_bytes_opt_(OptionalBufferLength) CHAR *OptionalBuffer, _In_ UINT32 OptionalBufferLength)
BOOLEAN KdLoggingResponsePacketToDebugger(_In_reads_bytes_(OptionalBufferLength) CHAR *OptionalBuffer, _In_ UINT32 OptionalBufferLength, _In_ UINT32 OperationCode)
VOID KdHandleBreakpointAndDebugBreakpoints(_Inout_ PROCESSOR_DEBUGGING_STATE *DbgState, _In_ DEBUGGEE_PAUSING_REASON Reason, PDEBUGGER_TRIGGERED_EVENT_DETAILS EventDetails)
struct _DEBUGGEE_REQUEST_TO_IGNORE_BREAKS_UNTIL_AN_EVENT DEBUGGEE_REQUEST_TO_IGNORE_BREAKS_UNTIL_AN_EVENT
request to pause and halt the system
VOID KdHandleDebugEventsWhenKernelDebuggerIsAttached(PROCESSOR_DEBUGGING_STATE *DbgState, BOOLEAN TrapSetByDebugger)
Handles debug events when kernel-debugger is attached.
Definition Kd.c:426
RequestedActionOfThePacket Value(0x1) 00000000
The structure of changing core packet in HyperDbg.
Definition RequestStructures.h:599
The structure of user-input packet in HyperDbg.
Definition DataTypes.h:156
Register Descriptor Structure to use in r command.
Definition RequestStructures.h:1156
request to change the process
Definition Kd.h:39
UINT32 ProcessId
Definition Kd.h:40
PVOID Process
Definition Kd.h:41
request to change the thread
Definition Kd.h:50
PVOID Thread
Definition Kd.h:52
UINT32 ThreadId
Definition Kd.h:51
request to pause and halt the system
Definition Kd.h:61
volatile BOOLEAN PauseBreaksUntilSpecialMessageSent
Definition Kd.h:62
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION SpeialEventResponse
Definition Kd.h:63
The structure of .sym reload packet in HyperDbg.
Definition RequestStructures.h:1047
The structure of user-input packet in HyperDbg.
Definition DataTypes.h:140
Status of register buffers.
Definition Events.h:423
request for modifying events (enable/disable/clear)
Definition Events.h:242
request to pause and halt the system
Definition DataTypes.h:178
The structure of detail of a triggered event in HyperDbg.
Definition DataTypes.h:192
store the details of a hardware debug register to ignore any trigger for other threads
Definition Kd.h:73
UINT32 ThreadId
Definition Kd.h:76
UINT64 Address
Definition Kd.h:74
UINT32 ProcessId
Definition Kd.h:75
Saves the debugger state.
Definition State.h:165
Definition BasicTypes.h:70