common.h File Reference

header for HyperDbg's general functions for reading and converting and etc More...

Go to the source code of this file.

Macros
#define	AssertReturn   return;
#define	AssertReturnFalse   return FALSE;
#define	AssertReturnOne   return 1;
#define	PAUSE_MESSAGE_IN_USER_DEBUGGER   "\nTo pause the target process, run the 'pause' command"
#define	ASSERT_MESSAGE_DRIVER_NOT_LOADED   "handle of the driver not found, probably the driver is not loaded. Did you use 'load' command?\n"
#define	ASSERT_MESSAGE_KD_NOT_LOADED   "the kd (kernel debugger) module is not loaded. Did you use 'load kd' command?\n"
#define	ASSERT_MESSAGE_VMM_NOT_LOADED   "the vmm (virtualization) module is not loaded. Did you use 'load vmm' command?\n"
#define	ASSERT_MESSAGE_HYPERTRACE_NOT_LOADED   "the trace (hypertrace) module is not loaded. Did you use 'load trace' command?\n"
#define	ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH
#define	ASSERT_MESSAGE_CANNOT_SPECIFY_PID
#define	AssertReturnStmt(expr, stmt, rc)
#define	AssertShowMessageReturnStmt(expr1, expr2, message1, message2, rc)
#define	PAGE_SIZE   0x1000
	Size of each page (4096 bytes).
#define	PAGE_ALIGN(Va)
	Aligning a page.
#define	CPUID_ADDR_WIDTH   0x80000008
	Cpuid to get virtual address width.
#define	DbgWaitForKernelResponse(KernelSyncObjectId)
#define	DbgWaitForUserResponse(UserSyncObjectId)
#define	DbgWaitSetKernelRequestData(KernelSyncObjectId, ReqData, ReqSize)
#define	DbgWaitSetUserRequestData(UserSyncObjectId, ReqData, ReqSize)
#define	DbgWaitGetKernelRequestData(KernelSyncObjectId, ReqData, ReqSize)
#define	DbgWaitGetUserRequestData(UserSyncObjectId, ReqData, ReqSize)
#define	DbgReceivedKernelResponse(KernelSyncObjectId)
#define	DbgReceivedUserResponse(UserSyncObjectId)

Functions
BOOLEAN	AsmVmxSupportDetection ()
VOID	SpinlockLock (volatile LONG *Lock)
	Tries to get the lock and won't return until successfully get the lock.
VOID	SpinlockLockWithCustomWait (volatile LONG *Lock, UINT32 MaximumWait)
	Tries to get the lock and won't return until successfully get the lock.
VOID	SpinlockUnlock (volatile LONG *Lock)
	Release the lock.
VOID	PrintBits (const UINT32 size, const VOID *ptr)
BOOL	Replace (std::string &str, const std::string &from, const std::string &to)
VOID	ReplaceAll (string &str, const string &from, const string &to)
const vector< string >	Split (const string &s, const CHAR &c)
BOOLEAN	IsNumber (const string &str)
UINT32	Log2Ceil (UINT32 n)
	Function to compute log2Ceil.
BOOLEAN	IsHexNotation (const string &s)
vector< CHAR >	HexToBytes (const string &hex)
BOOLEAN	ConvertStringToUInt64 (string TextToConvert, PUINT64 Result)
BOOLEAN	ConvertStringToUInt32 (string TextToConvert, PUINT32 Result)
BOOLEAN	ConvertTokenToUInt64 (CommandToken TargetToken, PUINT64 Result)
	add ` between 64 bit values and convert them to string
BOOLEAN	ConvertTokenToUInt32 (CommandToken TargetToken, PUINT32 Result)
	check and convert command token to a 32 bit unsigned integer
std::string	GetCaseSensitiveStringFromCommandToken (CommandToken TargetToken)
	Get case sensitive string from command token.
std::string	GetLowerStringFromCommandToken (CommandToken TargetToken)
	Get lower case string from command token.
BOOLEAN	CompareLowerCaseStrings (CommandToken TargetToken, const CHAR *StringToCompare)
	Compare lower case strings.
BOOLEAN	IsTokenBracketString (CommandToken TargetToken)
	Is token bracket string.
BOOLEAN	HasEnding (string const &fullString, string const &ending)
	checks whether the string ends with a special string or not
BOOLEAN	ValidateIP (const string &ip)
	Function to validate an IP address.
BOOL	SetPrivilege (HANDLE Token, LPCTSTR Privilege, BOOL EnablePrivilege)
	SetPrivilege enables/disables process token privilege.
VOID	Trim (std::string &s)
	trim from both ends and start of a string (in place)
std::string	RemoveSpaces (std::string str)
	Remove all the spaces in a string.
BOOLEAN	IsFileExistA (const CHAR *FileName)
	check if a file exist or not (ASCII)
BOOLEAN	IsFileExistW (const WCHAR *FileName)
	check if a file exist or not (wide-char)
VOID	GetConfigFilePath (PWCHAR ConfigPath)
	Get config path.
VOID	StringToWString (std::wstring &ws, const std::string &s)
	convert std::string to std::wstring
SIZE_T	FindCaseInsensitive (std::string Input, std::string ToSearch, SIZE_T Pos)
	Find case insensitive sub string in a given substring.
SIZE_T	FindCaseInsensitiveW (std::wstring Input, std::wstring ToSearch, SIZE_T Pos)
	Find case insensitive sub string in a given substring (unicode).
CHAR *	ConvertStringVectorToCharPointerArray (const std::string &s)
	Convert vector<string> to char*.
std::vector< std::string >	ListDirectory (const std::string &Directory, const std::string &Extension)
	Create a list of special files in a directory.
BOOLEAN	IsEmptyString (CHAR *Text)
	Is empty character.
VOID	CommonCpuidInstruction (UINT32 Func, UINT32 SubFunc, INT *CpuInfo)
	Get cpuid results.
BOOLEAN	CheckCpuSupportRtm ()
	Check whether the processor supports RTM or not.
UINT32	Getx86VirtualAddressWidth ()
	Get virtual address width for x86 processors.
BOOLEAN	CheckAccessValidityAndSafety (UINT64 TargetAddress, UINT32 Size)
	Check the safety to access the memory.
BOOLEAN	VmxSupportDetection ()
	Detect whether the VMX is supported or not.

Detailed Description

header for HyperDbg's general functions for reading and converting and etc

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-05-27

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH

#define ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH

Value:

"the handshaking process was successful; however, there is a mismatch between " \
"the version/build of the debuggee and the debugger. please use the same "      \
"version/build for both the debuggee and debugger\n"

#define ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH "the handshaking process was successful; however, there is a mismatch between " \
                                                    "the version/build of the debuggee and the debugger. please use the same "      \
                                                    "version/build for both the debuggee and debugger\n"

ASSERT_MESSAGE_CANNOT_SPECIFY_PID

#define ASSERT_MESSAGE_CANNOT_SPECIFY_PID

Value:

"err, since HyperDbg won't context-switch to keep the system in a halted state, "                       \
"you cannot specify 'pid' for this command in the debugger mode. You can switch to the target process " \
"memory layout using the '.process' or the '.thread' command. After that, you can use "                 \
"this command without specifying the process ID. Alternatively, you can modify the current "            \
"CR3 register to achieve the same functionality\n"

#define ASSERT_MESSAGE_CANNOT_SPECIFY_PID "err, since HyperDbg won't context-switch to keep the system in a halted state, "                       \
                                          "you cannot specify 'pid' for this command in the debugger mode. You can switch to the target process " \
                                          "memory layout using the '.process' or the '.thread' command. After that, you can use "                 \
                                          "this command without specifying the process ID. Alternatively, you can modify the current "            \
                                          "CR3 register to achieve the same functionality\n"

ASSERT_MESSAGE_DRIVER_NOT_LOADED

#define ASSERT_MESSAGE_DRIVER_NOT_LOADED   "handle of the driver not found, probably the driver is not loaded. Did you use 'load' command?\n"

ASSERT_MESSAGE_HYPERTRACE_NOT_LOADED

#define ASSERT_MESSAGE_HYPERTRACE_NOT_LOADED   "the trace (hypertrace) module is not loaded. Did you use 'load trace' command?\n"

ASSERT_MESSAGE_KD_NOT_LOADED

#define ASSERT_MESSAGE_KD_NOT_LOADED   "the kd (kernel debugger) module is not loaded. Did you use 'load kd' command?\n"

ASSERT_MESSAGE_VMM_NOT_LOADED

#define ASSERT_MESSAGE_VMM_NOT_LOADED   "the vmm (virtualization) module is not loaded. Did you use 'load vmm' command?\n"

AssertReturn

#define AssertReturn   return;

AssertReturnFalse

#define AssertReturnFalse   return FALSE;

AssertReturnOne

#define AssertReturnOne   return 1;

AssertReturnStmt

#define AssertReturnStmt	(		expr,
			stmt,
			rc )

Value:

do                                   \
{                                    \
    if (expr)                        \
    {                                \
        /* likely */                 \
    }                                \
    else                             \
    {                                \
        stmt;                        \
        rc;                          \
    }                                \
} while (0)

#define AssertReturnStmt(expr, stmt, rc) \
    do                                   \
    {                                    \
        if (expr)                        \
        {                                \
            /* likely */                 \
        }                                \
        else                             \
        {                                \
            stmt;                        \
            rc;                          \
        }                                \
    } while (0)

AssertShowMessageReturnStmt

#define AssertShowMessageReturnStmt	(		expr1,
			expr2,
			message1,
			message2,
			rc )

Value:

do                                                                     \
{                                                                      \
    if (expr1 && expr2)                                                \
    {                                                                  \
        /* likely */                                                   \
    }                                                                  \
    else                                                               \
    {                                                                  \
        if (!expr1)                                                    \
            ShowMessages(message1);                                    \
        else if (!expr2)                                               \
            ShowMessages(message2);                                    \
        rc;                                                            \
    }                                                                  \
} while (0)

#define AssertShowMessageReturnStmt(expr1, expr2, message1, message2, rc) \
    do                                                                     \
    {                                                                      \
        if (expr1 && expr2)                                                \
        {                                                                  \
            /* likely */                                                   \
        }                                                                  \
        else                                                               \
        {                                                                  \
            if (!expr1)                                                    \
                ShowMessages(message1);                                    \
            else if (!expr2)                                               \
                ShowMessages(message2);                                    \
            rc;                                                            \
        }                                                                  \
    } while (0)

CPUID_ADDR_WIDTH

#define CPUID_ADDR_WIDTH   0x80000008

Cpuid to get virtual address width.

DbgReceivedKernelResponse

#define DbgReceivedKernelResponse

(

KernelSyncObjectId

)

Value:

do                                                                     \
{                                                                      \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =      \
        &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId]; \
                                                                       \
    SyncronizationObject->IsOnWaitingState = FALSE;                    \
    SetEvent(SyncronizationObject->EventHandle);                       \
} while (FALSE);

#define DbgReceivedKernelResponse(KernelSyncObjectId)                      \
    do                                                                     \
    {                                                                      \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =      \
            &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId]; \
                                                                           \
        SyncronizationObject->IsOnWaitingState = FALSE;                    \
        SetEvent(SyncronizationObject->EventHandle);                       \
    } while (FALSE);

DbgReceivedUserResponse

#define DbgReceivedUserResponse

(

UserSyncObjectId

)

Value:

do                                                                 \
{                                                                  \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =  \
        &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId]; \
                                                                   \
    SyncronizationObject->IsOnWaitingState = FALSE;                \
    SetEvent(SyncronizationObject->EventHandle);                   \
} while (FALSE);

#define DbgReceivedUserResponse(UserSyncObjectId)                      \
    do                                                                 \
    {                                                                  \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =  \
            &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId]; \
                                                                       \
        SyncronizationObject->IsOnWaitingState = FALSE;                \
        SetEvent(SyncronizationObject->EventHandle);                   \
    } while (FALSE);

DbgWaitForKernelResponse

#define DbgWaitForKernelResponse

(

KernelSyncObjectId

)

Value:

do                                                                     \
{                                                                      \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =      \
        &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId]; \
                                                                       \
    SyncronizationObject->IsOnWaitingState = TRUE;                     \
    PlatformWaitForSingleObject(SyncronizationObject->EventHandle, INFINITE); \
                                                                       \
} while (FALSE);

#define DbgWaitForKernelResponse(KernelSyncObjectId)                       \
    do                                                                     \
    {                                                                      \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =      \
            &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId]; \
                                                                           \
        SyncronizationObject->IsOnWaitingState = TRUE;                     \
        PlatformWaitForSingleObject(SyncronizationObject->EventHandle, INFINITE); \
                                                                           \
    } while (FALSE);

DbgWaitForUserResponse

#define DbgWaitForUserResponse

(

UserSyncObjectId

)

Value:

do                                                                    \
{                                                                     \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =     \
        &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId];    \
                                                                      \
    SyncronizationObject->IsOnWaitingState = TRUE;                    \
    PlatformWaitForSingleObject(SyncronizationObject->EventHandle, INFINITE); \
                                                                      \
} while (FALSE);

#define DbgWaitForUserResponse(UserSyncObjectId)                          \
    do                                                                    \
    {                                                                     \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =     \
            &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId];    \
                                                                          \
        SyncronizationObject->IsOnWaitingState = TRUE;                    \
        PlatformWaitForSingleObject(SyncronizationObject->EventHandle, INFINITE); \
                                                                          \
    } while (FALSE);

DbgWaitGetKernelRequestData

#define DbgWaitGetKernelRequestData	(		KernelSyncObjectId,
			ReqData,
			ReqSize )

Value:

do                                                                         \
{                                                                          \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =          \
        &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId];     \
                                                                           \
    *ReqData                          = SyncronizationObject->RequestData; \
    *ReqSize                          = SyncronizationObject->RequestSize; \
    SyncronizationObject->RequestData = NULL;                              \
    SyncronizationObject->RequestSize = NULL_ZERO;                         \
                                                                           \
} while (FALSE);

#define DbgWaitGetKernelRequestData(KernelSyncObjectId, ReqData, ReqSize)      \
    do                                                                         \
    {                                                                          \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =          \
            &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId];     \
                                                                               \
        *ReqData                          = SyncronizationObject->RequestData; \
        *ReqSize                          = SyncronizationObject->RequestSize; \
        SyncronizationObject->RequestData = NULL;                              \
        SyncronizationObject->RequestSize = NULL_ZERO;                         \
                                                                               \
    } while (FALSE);

DbgWaitGetUserRequestData

#define DbgWaitGetUserRequestData	(		UserSyncObjectId,
			ReqData,
			ReqSize )

Value:

do                                                                         \
{                                                                          \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =          \
        &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId];         \
                                                                           \
    *ReqData                          = SyncronizationObject->RequestData; \
    *ReqSize                          = SyncronizationObject->RequestSize; \
    SyncronizationObject->RequestData = NULL;                              \
    SyncronizationObject->RequestSize = NULL_ZERO;                         \
                                                                           \
} while (FALSE);

#define DbgWaitGetUserRequestData(UserSyncObjectId, ReqData, ReqSize)          \
    do                                                                         \
    {                                                                          \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =          \
            &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId];         \
                                                                               \
        *ReqData                          = SyncronizationObject->RequestData; \
        *ReqSize                          = SyncronizationObject->RequestSize; \
        SyncronizationObject->RequestData = NULL;                              \
        SyncronizationObject->RequestSize = NULL_ZERO;                         \
                                                                               \
    } while (FALSE);

DbgWaitSetKernelRequestData

#define DbgWaitSetKernelRequestData	(		KernelSyncObjectId,
			ReqData,
			ReqSize )

Value:

do                                                                     \
{                                                                      \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =      \
        &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId]; \
                                                                       \
    SyncronizationObject->RequestData = (PVOID)ReqData;                \
    SyncronizationObject->RequestSize = (UINT32)ReqSize;               \
                                                                       \
} while (FALSE);

#define DbgWaitSetKernelRequestData(KernelSyncObjectId, ReqData, ReqSize)  \
    do                                                                     \
    {                                                                      \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =      \
            &g_KernelSyncronizationObjectsHandleTable[KernelSyncObjectId]; \
                                                                           \
        SyncronizationObject->RequestData = (PVOID)ReqData;                \
        SyncronizationObject->RequestSize = (UINT32)ReqSize;               \
                                                                           \
    } while (FALSE);

DbgWaitSetUserRequestData

#define DbgWaitSetUserRequestData	(		UserSyncObjectId,
			ReqData,
			ReqSize )

Value:

do                                                                 \
{                                                                  \
    DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =  \
        &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId]; \
                                                                   \
    SyncronizationObject->RequestData = (PVOID)ReqData;            \
    SyncronizationObject->RequestSize = (UINT32)ReqSize;           \
                                                                   \
} while (FALSE);

#define DbgWaitSetUserRequestData(UserSyncObjectId, ReqData, ReqSize)  \
    do                                                                 \
    {                                                                  \
        DEBUGGER_SYNCRONIZATION_EVENTS_STATE * SyncronizationObject =  \
            &g_UserSyncronizationObjectsHandleTable[UserSyncObjectId]; \
                                                                       \
        SyncronizationObject->RequestData = (PVOID)ReqData;            \
        SyncronizationObject->RequestSize = (UINT32)ReqSize;           \
                                                                       \
    } while (FALSE);

PAGE_ALIGN

#define PAGE_ALIGN

(

Va

)

Value:

((PVOID)((ULONG_PTR)(Va) & ~(PAGE_SIZE - 1)))

Aligning a page.

PAGE_SIZE

#define PAGE_SIZE   0x1000

Size of each page (4096 bytes).

PAUSE_MESSAGE_IN_USER_DEBUGGER

#define PAUSE_MESSAGE_IN_USER_DEBUGGER   "\nTo pause the target process, run the 'pause' command"

Function Documentation

AsmVmxSupportDetection()

BOOLEAN AsmVmxSupportDetection ( )

extern

CheckAccessValidityAndSafety()

BOOLEAN CheckAccessValidityAndSafety	(	UINT64	TargetAddress,
		UINT32	Size )

Check the safety to access the memory.

Parameters

TargetAddress
Size

Returns

BOOLEAN

{
    return CheckAccessValidityAndSafetyWrapper(TargetAddress, Size, NULL_ZERO);
}

CheckCpuSupportRtm()

BOOLEAN CheckCpuSupportRtm

(

)

Check whether the processor supports RTM or not.

Returns

BOOLEAN

{
    INT     Regs1[4];
    INT     Regs2[4];
    BOOLEAN Result;
 
    //
    // TSX is controlled via MSR_IA32_TSX_CTRL.  However, support for this
    // MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
    //
    // TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
    // microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
    // bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
    // MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
    // tsx= cmdline requests will do nothing on CPUs without
    // MSR_IA32_TSX_CTRL support.
    //
 
    CommonCpuidInstruction(0, 0, Regs1);
    CommonCpuidInstruction(7, 0, Regs2);
 
    //
    // Check RTM and MPX extensions in order to filter out TSX on Haswell CPUs
    //
    Result = Regs1[0] >= 0x7 && (Regs2[1] & 0x4800) == 0x4800;
 
    return Result;
}

CommonCpuidInstruction()

VOID CommonCpuidInstruction	(	UINT32	Func,
		UINT32	SubFunc,
		INT *	CpuInfo )

Get cpuid results.

Parameters

Func
SubFunc
CpuInfo

Returns

VOID

{
    CpuCpuIdEx(CpuInfo, Func, SubFunc);
}

CompareLowerCaseStrings()

BOOLEAN CompareLowerCaseStrings	(	CommandToken	TargetToken,
		const CHAR *	StringToCompare )

Compare lower case strings.

Parameters

TargetToken	the target command token
StringToCompare	the string to compare

Returns

BOOLEAN shows whether text is equal or not

{
    //
    // Extract the token type and value from the tuple
    //
    std::string TargetTokenValue = std::get<2>(TargetToken); // the second index is lower case
 
    //
    // Convert the token value to 64 bit unsigned integer
    //
    return _stricmp(TargetTokenValue.c_str(), StringToCompare) == 0;
}

ConvertStringToUInt32()

BOOLEAN ConvertStringToUInt32	(	string	TextToConvert,
		PUINT32	Result )

ConvertStringToUInt64()

BOOLEAN ConvertStringToUInt64	(	string	TextToConvert,
		PUINT64	Result )

ConvertStringVectorToCharPointerArray()

CHAR * ConvertStringVectorToCharPointerArray

(

const std::string &

s

)

Convert vector<string> to char*.

use it like : std::transform(vs.begin(), vs.end(), std::back_inserter(vc), ConvertStringVectorToCharPointerArray); from: https://stackoverflow.com/questions/7048888/stdvectorstdstring-to-char-array

Parameters

s

Returns

CHAR*

{
    CHAR * Pc = new CHAR[s.size() + 1];
    std::strcpy(Pc, s.c_str());
    return Pc;
}

ConvertTokenToUInt32()

BOOLEAN ConvertTokenToUInt32	(	CommandToken	TargetToken,
		PUINT32	Result )

check and convert command token to a 32 bit unsigned integer

Parameters

TargetToken	the target command token
Result	result will be save to the pointer

Returns

BOOLEAN shows whether the conversion was successful or not

{
    //
    // Extract the token type and value from the tuple
    //
    std::string TargetTokenValue = std::get<1>(TargetToken);
 
    //
    // Convert the token value to 32 bit unsigned integer
    //
    return ConvertStringToUInt32(TargetTokenValue, Result);
}

ConvertTokenToUInt64()

BOOLEAN ConvertTokenToUInt64	(	CommandToken	TargetToken,
		PUINT64	Result )

add ` between 64 bit values and convert them to string

Parameters

Value

Returns

string */ string SeparateTo64BitValue(UINT64 Value) { ostringstream OstringStream; string Temp;

OstringStream << setw(16) << setfill('0') << hex << Value; Temp = OstringStream.str();

Temp.insert(8, 1, '`'); return Temp; }

/**

print bits and bytes for d* commands

Parameters

Size
Ptr

Returns

VOID */ VOID PrintBits(const UINT32 Size, const VOID * Ptr) { UCHAR * Buf = (UCHAR *)Ptr; UCHAR Byte; INT i, j;

for (i = Size - 1; i >= 0; i–) { for (j = 7; j >= 0; j–) { Byte = (Buf[i] >> j) & 1; ShowMessages("%u", Byte); } ShowMessages(" ", Byte); } }

/**

general replace all function

Parameters

str
from
to

Returns

VOID */ BOOL Replace(std::string & str, const std::string & from, const std::string & to) { SIZE_T StartPos = str.find(from); if (StartPos == std::string::npos) return FALSE; str.replace(StartPos, from.size(), to); return TRUE; }

/**

general replace all function

Parameters

str
from
to

Returns

VOID */ VOID ReplaceAll(string & str, const string & from, const string & to) { SIZE_T SartPos = 0;

if (from.empty()) return;

while ((SartPos = str.find(from, SartPos)) != std::string::npos) { str.replace(SartPos, from.length(), to); // // In case 'to' contains 'from', like replacing // 'x' with 'yx' // SartPos += to.length(); } }

/**

general split command

Parameters

s	target string
c	splitter (delimiter)

Returns

const vector<string> */ const vector<string> Split(const string & s, const CHAR & c) { string buff {""}; vector<string> v;

for (auto n : s) { if (n != c) buff += n; else if (n == c && !buff.empty()) { v.push_back(buff); buff.clear(); } } if (!buff.empty()) v.push_back(buff);

return v; }

/**

check if given string is a numeric string or not

Parameters

str

Returns

BOOLEAN */ BOOLEAN IsNumber(const string & str) { // // std::find_first_not_of searches the string for the first character // that does not match any of the characters specified in its arguments // return !str.empty() && (str.find_first_not_of("[0123456789]") == std::string::npos); }

/**

check whether the string is hex or not

Parameters

s

Returns

BOOLEAN */ BOOLEAN IsHexNotation(const string & s) { BOOLEAN IsAnyThing = FALSE;

for (auto & CptrChar : s) { IsAnyThing = TRUE;

if (!isxdigit(CptrChar)) { return FALSE; } } if (IsAnyThing) { return TRUE; } return FALSE; }

/**

check whether the string is decimal or not

Parameters

s

Returns

BOOLEAN */ BOOLEAN IsDecimalNotation(const string & s) { BOOLEAN IsAnyThing = FALSE;

for (auto & CptrChar : s) { IsAnyThing = TRUE;

if (!isdigit(CptrChar)) { return FALSE; } } if (IsAnyThing) { return TRUE; } return FALSE; }

/**

converts hex to bytes

Parameters

hex

Returns

vector<CHAR> */ vector<CHAR> HexToBytes(const string & hex) { vector<CHAR> Bytes;

for (UINT32 i = 0; i < hex.length(); i += 2) { std::string byteString = hex.substr(i, 2); CHAR Byte = (CHAR)strtol(byteString.c_str(), NULL, 16); Bytes.push_back(Byte); }

return Bytes; }

/**

check and convert string to a 64 bit unsigned integer and also check for special notations like 0x, 0n, etc.

Parameters

TextToConvert	the target string
Result	result will be save to the pointer

Returns

BOOLEAN shows whether the conversion was successful or not */ BOOLEAN ConvertStringToUInt64(string TextToConvert, PUINT64 Result) { BOOLEAN IsDecimal = FALSE; // By default everything is hex

if (TextToConvert.rfind("0x", 0) == 0 || TextToConvert.rfind("0X", 0) == 0 || TextToConvert.rfind("\\x", 0) == 0 || TextToConvert.rfind("\\X", 0) == 0) { TextToConvert = TextToConvert.erase(0, 2); } else if (TextToConvert.rfind('x', 0) == 0 || TextToConvert.rfind('X', 0) == 0) { TextToConvert = TextToConvert.erase(0, 1); } else if (TextToConvert.rfind("0n", 0) == 0 || TextToConvert.rfind("0N", 0) == 0 || TextToConvert.rfind("\\n", 0) == 0 || TextToConvert.rfind("\\N", 0) == 0) { TextToConvert = TextToConvert.erase(0, 2); IsDecimal = TRUE; } else if (TextToConvert.rfind('n', 0) == 0 || TextToConvert.rfind('N', 0) == 0) { TextToConvert = TextToConvert.erase(0, 1); IsDecimal = TRUE; }

// // Remove '`' (if any)

TextToConvert.erase(remove(TextToConvert.begin(), TextToConvert.end(), '`'), TextToConvert.end());

if (IsDecimal) { if (!IsDecimalNotation(TextToConvert)) { // // Not decimal // return FALSE; } else { errno = 0; CHAR * Unparsed = NULL; const CHAR * S = TextToConvert.c_str(); const UINT64 N = strtoull(S, &Unparsed, 10);

if (errno || (!N && S == Unparsed)) { // fflush(stdout); // perror(s); return FALSE; }

*Result = N; return TRUE; } } else { // // It's not decimal // if (!IsHexNotation(TextToConvert)) { // // Not decimal and not hex! // return FALSE; } else { // // It's a hex number // const CHAR * Text = TextToConvert.c_str(); errno = 0; UINT64 ResultValue = strtoull(Text, NULL, 16);

*Result = ResultValue;

if (errno == EINVAL) { return FALSE; } else if (errno == ERANGE) { return TRUE; }

return TRUE; } } }

/**

check and convert string to a 32 bit unsigned it and also check for special notations like 0x etc.

Parameters

TextToConvert	the target string
Result	result will be save to the pointer

Returns

BOOLEAN shows whether the conversion was successful or not */ BOOLEAN ConvertStringToUInt32(string TextToConvert, PUINT32 Result) { BOOLEAN IsDecimal = FALSE; // By default everything is hex

if (TextToConvert.rfind("0x", 0) == 0 || TextToConvert.rfind("0X", 0) == 0 || TextToConvert.rfind("\\x", 0) == 0 || TextToConvert.rfind("\\X", 0) == 0) { TextToConvert = TextToConvert.erase(0, 2); } else if (TextToConvert.rfind('x', 0) == 0 || TextToConvert.rfind('X', 0) == 0) { TextToConvert = TextToConvert.erase(0, 1); } else if (TextToConvert.rfind("0n", 0) == 0 || TextToConvert.rfind("0N", 0) == 0 || TextToConvert.rfind("\\n", 0) == 0 || TextToConvert.rfind("\\N", 0) == 0) { TextToConvert = TextToConvert.erase(0, 2); IsDecimal = TRUE; } else if (TextToConvert.rfind('n', 0) == 0 || TextToConvert.rfind('N', 0) == 0) { TextToConvert = TextToConvert.erase(0, 1); IsDecimal = TRUE; }

TextToConvert.erase(remove(TextToConvert.begin(), TextToConvert.end(), '`'), TextToConvert.end());

if (IsDecimal) { if (!IsDecimalNotation(TextToConvert)) { return FALSE; } else { try { INT I = std::stoi(TextToConvert); Result = I; return TRUE; } catch (std::invalid_argument const &) {

Bad input: std::invalid_argument thrown

            return FALSE;
        }
        catch (std::out_of_range const &)
        {

Integer overflow: std::out_of_range thrown

            return FALSE;
        }

        return FALSE;
    }
}
else
{

It's not decimal

    if (!IsHexNotation(TextToConvert))
    {
        return FALSE;
    }
    else
    {

It's hex number

        UINT32 TempResult;
        TempResult = stoi(TextToConvert, nullptr, 16);

Apply the results

         Result = TempResult;

        return TRUE;
    }
}

}

/**

check and convert command token to a 64 bit unsigned integer

Parameters

TargetToken	the target command token
Result	result will be save to the pointer

Returns

BOOLEAN shows whether the conversion was successful or not

{
    //
    // Extract the token type and value from the tuple
    //
    std::string TargetTokenValue = std::get<1>(TargetToken);
 
    //
    // Convert the token value to 64 bit unsigned integer
    //
    return ConvertStringToUInt64(TargetTokenValue, Result);
}

FindCaseInsensitive()

SIZE_T FindCaseInsensitive	(	std::string	Input,
		std::string	ToSearch,
		SIZE_T	Pos )

Find case insensitive sub string in a given substring.

Parameters

Input
ToSearch
Pos

Returns

SIZE_T

{
    // Convert complete given String to lower case
    std::transform(Input.begin(), Input.end(), Input.begin(), ::tolower);
    // Convert complete given Sub String to lower case
    std::transform(ToSearch.begin(), ToSearch.end(), ToSearch.begin(), ::tolower);
    // Find sub string in given string
    return Input.find(ToSearch, Pos);
}

FindCaseInsensitiveW()

SIZE_T FindCaseInsensitiveW	(	std::wstring	Input,
		std::wstring	ToSearch,
		SIZE_T	Pos )

Find case insensitive sub string in a given substring (unicode).

Parameters

Input
ToSearch
Pos

Returns

SIZE_T

{
    // Convert complete given String to lower case
    std::transform(Input.begin(), Input.end(), Input.begin(), ::tolower);
    // Convert complete given Sub String to lower case
    std::transform(ToSearch.begin(), ToSearch.end(), ToSearch.begin(), ::tolower);
    // Find sub string in given string
    return Input.find(ToSearch, Pos);
}

GetCaseSensitiveStringFromCommandToken()

std::string GetCaseSensitiveStringFromCommandToken

(

CommandToken

TargetToken

)

Get case sensitive string from command token.

Parameters

TargetToken

the target command token

Returns

string the string value of the token

{
    //
    // Extract the token type and value from the tuple
    //
    std::string TargetTokenValue = std::get<1>(TargetToken); // the first index is case sensitive
 
    return TargetTokenValue;
}

GetConfigFilePath()

VOID GetConfigFilePath

(

PWCHAR

ConfigPath

)

Get config path.

Parameters

ConfigPath

{
    WCHAR CurrentPath[MAX_PATH] = {0};
 
    //
    // Get path file of current exe
    //
    GetModuleFileNameW(NULL, CurrentPath, MAX_PATH);
 
    //
    // Remove exe file name
    //
    PathRemoveFileSpecW(CurrentPath);
 
    //
    // Combine current exe path with config file name
    //
    PathCombineW(ConfigPath, CurrentPath, CONFIG_FILE_NAME);
}

GetLowerStringFromCommandToken()

std::string GetLowerStringFromCommandToken

(

CommandToken

TargetToken

)

Get lower case string from command token.

Parameters

TargetToken

the target command token

Returns

string the string value of the token

{
    //
    // Extract the token type and value from the tuple
    //
    std::string TargetTokenValue = std::get<2>(TargetToken); // the second index is lower case
 
    return TargetTokenValue;
}

Getx86VirtualAddressWidth()

UINT32 Getx86VirtualAddressWidth

(

)

Get virtual address width for x86 processors.

Returns

UINT32

{
    INT Regs[4];
 
    CommonCpuidInstruction(CPUID_ADDR_WIDTH, 0, Regs);
 
    //
    // Extracting bit 15:8 from eax register
    //
    return ((Regs[0] >> 8) & 0x0ff);
}

HasEnding()

BOOLEAN HasEnding	(	string const &	fullString,
		string const &	ending )

checks whether the string ends with a special string or not

Parameters

fullString
ending

Returns

BOOLEAN if true then it shows that string ends with another string and if false then it shows that this string is not ended with the target string

{
    if (fullString.length() >= ending.length())
    {
        return (0 == fullString.compare(fullString.length() - ending.length(),
                                        ending.length(),
                                        ending));
    }
    else
    {
        return FALSE;
    }
}

HexToBytes()

vector< CHAR > HexToBytes

(

const string &

hex

)

IsEmptyString()

BOOLEAN IsEmptyString

(

CHAR *

Text

)

Is empty character.

Parameters

Text

{
    SIZE_T Len;
 
    if (Text == NULL || Text[0] == '\0')
    {
        return TRUE;
    }
 
    Len = strlen(Text);
    for (SIZE_T i = 0; i < Len; i++)
    {
        if (Text[i] != ' ' && Text[i] != '\t' && Text[i] != '\n')
        {
            return FALSE;
        }
    }
 
    return TRUE;
}

IsFileExistA()

BOOLEAN IsFileExistA

(

const CHAR *

FileName

)

check if a file exist or not (ASCII)

Parameters

FileName

path of file

Returns

BOOLEAN shows whether the file exist or not

{
    struct stat buffer;
    return (stat(FileName, &buffer) == 0);
}

IsFileExistW()

BOOLEAN IsFileExistW

(

const WCHAR *

FileName

)

check if a file exist or not (wide-char)

Parameters

FileName

path of file

Returns

BOOLEAN shows whether the file exist or not

{
    struct _stat64i32 buffer;
    return (_wstat(FileName, &buffer) == 0);
}

IsHexNotation()

BOOLEAN IsHexNotation

(

const string &

s

)

IsNumber()

BOOLEAN IsNumber

(

const string &

str

)

IsTokenBracketString()

BOOLEAN IsTokenBracketString

(

CommandToken

TargetToken

)

Is token bracket string.

Parameters

TargetToken

the target command token

Returns

BOOLEAN shows whether the token is bracket string or not

{
    //
    // Extract the token type and value from the tuple
    //
    CommandParsingTokenType TargetTokenValue = std::get<0>(TargetToken);
 
    //
    // Check if the token is a bracket string
    //
    return TargetTokenValue == CommandParsingTokenType::BracketString;
}

ListDirectory()

std::vector< std::string > ListDirectory	(	const std::string &	Directory,
		const std::string &	Extension )

Create a list of special files in a directory.

Parameters

Directory
Extension

Returns

std::vector<std::string>

{
    WIN32_FIND_DATAA         FindData;
    HANDLE                   Find     = INVALID_HANDLE_VALUE;
    std::string              FullPath = Directory + "\\" + Extension;
    std::vector<std::string> DirList;
 
    Find = FindFirstFileA(FullPath.c_str(), &FindData);
 
    if (Find == INVALID_HANDLE_VALUE)
        throw std::runtime_error("invalid handle value! please check your path...");
 
    while (FindNextFileA(Find, &FindData) != 0)
    {
        DirList.push_back(Directory + "\\" + std::string(FindData.cFileName));
    }
 
    FindClose(Find);
 
    return DirList;
}

Log2Ceil()

UINT32 Log2Ceil

(

UINT32

n

)

Function to compute log2Ceil.

Parameters

n

Returns

UINT32

{
    if (n == 0)
        return 0; // log2Ceil(0) is undefined, returning 0 for safety.
 
    n--; // Decrease by 1 to check if it is a power of 2
    UINT32 log2Floor = 0;
    while (n >>= 1)
    {
        log2Floor++;
    }
    return log2Floor + 1;
}

PrintBits()

VOID PrintBits	(	const UINT32	size,
		const VOID *	ptr )

RemoveSpaces()

std::string RemoveSpaces

(

std::string

str

)

Remove all the spaces in a string.

Parameters

str

{
    str.erase(remove(str.begin(), str.end(), ' '), str.end());
    return str;
}

Replace()

BOOL Replace	(	std::string &	str,
		const std::string &	from,
		const std::string &	to )

ReplaceAll()

VOID ReplaceAll	(	string &	str,
		const string &	from,
		const string &	to )

SetPrivilege()

BOOL SetPrivilege	(	HANDLE	Token,
		LPCTSTR	Privilege,
		BOOL	EnablePrivilege )

SetPrivilege enables/disables process token privilege.

Parameters

Token
Privilege
EnablePrivilege

Returns

BOOL

{
    TOKEN_PRIVILEGES Tp;
    LUID             Luid;
 
    if (!LookupPrivilegeValue(NULL,      // lookup privilege on local system
                              Privilege, // privilege to lookup
                              &Luid))    // receives LUID of privilege
    {
        ShowMessages("err, in LookupPrivilegeValue (%x)\n", GetLastError());
        return FALSE;
    }
 
    Tp.PrivilegeCount     = 1;
    Tp.Privileges[0].Luid = Luid;
    if (EnablePrivilege)
        Tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        Tp.Privileges[0].Attributes = 0;
 
    //
    // Enable the privilege or disable all privileges.
    //
    if (!AdjustTokenPrivileges(Token, FALSE, &Tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL))
    {
        ShowMessages("err, in AdjustTokenPrivileges (%x)\n", GetLastError());
        return FALSE;
    }
 
    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
    {
        ShowMessages("err, the token does not have the specified (debug) privilege (ACCESS DENIED!)\n");
        ShowMessages("make sure to run it with administrator privileges\n");
        return FALSE;
    }
 
    return TRUE;
}

SpinlockLock()

VOID SpinlockLock

(

volatile LONG *

Lock

)

Tries to get the lock and won't return until successfully get the lock.

Parameters

Lock	Lock variable

Returns

VOID

{
    UINT32 Wait = 1;
 
    while (!SpinlockTryLock(Lock))
    {
        for (UINT32 i = 0; i < Wait; ++i)
        {
            _mm_pause();
        }
 
        //
        // Don't call "pause" too many times. If the Wait becomes too big,
        // clamp it to the MaxWait.
        //
 
        if (Wait * 2 > g_MaxWait)
        {
            Wait = g_MaxWait;
        }
        else
        {
            Wait = Wait * 2;
        }
    }
}

SpinlockLockWithCustomWait()

VOID SpinlockLockWithCustomWait	(	volatile LONG *	Lock,
		UINT32	MaximumWait )

Tries to get the lock and won't return until successfully get the lock.

Parameters

Lock	Lock variable
MaximumWait	Maximum wait (pause) count

Returns

VOID

{
    UINT32 Wait = 1;
 
    while (!SpinlockTryLock(Lock))
    {
        for (UINT32 i = 0; i < Wait; ++i)
        {
            _mm_pause();
        }
 
        //
        // Don't call "pause" too many times. If the Wait becomes too big,
        // clamp it to the MaxWait.
        //
 
        if (Wait * 2 > MaximumWait)
        {
            Wait = MaximumWait;
        }
        else
        {
            Wait = Wait * 2;
        }
    }
}

SpinlockUnlock()

VOID SpinlockUnlock

(

volatile LONG *

Lock

)

Release the lock.

Parameters

Lock	Lock variable

Returns

VOID

{
    *Lock = 0;
}

Split()

const vector< string > Split	(	const string &	s,
		const CHAR &	c )

StringToWString()

VOID StringToWString	(	std::wstring &	ws,
		const std::string &	s )

convert std::string to std::wstring

Parameters

ws
s

Returns

VOID

{
    std::wstring WsTmp(s.begin(), s.end());
 
    ws = WsTmp;
}

Trim()

VOID Trim

(

std::string &

s

)

trim from both ends and start of a string (in place)

Parameters

s

{
    ltrim(s);
    rtrim(s);
}

ValidateIP()

BOOLEAN ValidateIP

(

const string &

ip

)

Function to validate an IP address.

Parameters

ip

Returns

BOOLEAN

{
    //
    // split the string into tokens
    //
    vector<string> list = Split(ip, '.');
 
    //
    // if token size is not equal to four
    //
    if (list.size() != 4)
        return FALSE;
 
    //
    // validate each token
    //
    for (string str : list)
    {
        //
        // verify that string is number or not and the numbers
        // are in the valid range
        //
        if (!IsNumber(str) || stoi(str) > 255 || stoi(str) < 0)
            return FALSE;
    }
 
    return TRUE;
}

VmxSupportDetection()

BOOLEAN VmxSupportDetection

(

)

Detect whether the VMX is supported or not.

Returns

true if vmx is supported

false if vmx is not supported

{
    //
    // Call assembly function
    //
    return AsmVmxSupportDetection();
}