header for HyperDbg's general functions for reading and converting and etc More...

Macros
#define	AssertReturn return;

#define	AssertReturnFalse return FALSE;

#define	AssertReturnOne return 1;

#define	ASSERT_MESSAGE_DRIVER_NOT_LOADED "handle of the driver not found, probably the driver is not loaded. Did you use 'load' command?\n"

#define	ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH

#define	ASSERT_MESSAGE_CANNOT_SPECIFY_PID

#define	AssertReturnStmt(expr, stmt, rc)

#define	AssertShowMessageReturnStmt(expr, message, rc)

#define	PAGE_SIZE 0x1000
	Size of each page (4096 bytes)

#define	PAGE_ALIGN(Va) ((PVOID)((ULONG_PTR)(Va) & ~(PAGE_SIZE - 1)))
	Aligning a page.

#define	CPUID_ADDR_WIDTH 0x80000008
	Cpuid to get virtual address width.

Functions
bool	AsmVmxSupportDetection ()

void	SpinlockLock (volatile LONG *Lock)
	Tries to get the lock and won't return until successfully get the lock.

void	SpinlockLockWithCustomWait (volatile LONG *Lock, unsigned MaximumWait)
	Tries to get the lock and won't return until successfully get the lock.

void	SpinlockUnlock (volatile LONG *Lock)
	Release the lock.

VOID	PrintBits (const UINT32 size, const void *ptr)
	print bits and bytes for d* commands

BOOL	Replace (std::string &str, const std::string &from, const std::string &to)
	general replace all function

VOID	ReplaceAll (string &str, const string &from, const string &to)
	general replace all function

const vector< string >	Split (const string &s, const char &c)
	general split command

BOOLEAN	IsNumber (const string &str)
	check if given string is a numeric string or not

UINT32	Log2Ceil (UINT32 n)
	Function to compute log2Ceil.

vector< string >	SplitIp (const string &str, char delim)

BOOLEAN	IsHexNotation (const string &s)
	check whether the string is hex or not

vector< char >	HexToBytes (const string &hex)
	converts hex to bytes

BOOLEAN	ConvertStringToUInt64 (string TextToConvert, PUINT64 Result)
	check and convert string to a 64 bit unsigned integer and also check for special notations like 0x, 0n, etc.

BOOLEAN	ConvertStringToUInt32 (string TextToConvert, PUINT32 Result)
	check and convert string to a 32 bit unsigned it and also check for special notations like 0x etc.

BOOLEAN	HasEnding (string const &fullString, string const &ending)
	checks whether the string ends with a special string or not

BOOLEAN	ValidateIP (const string &ip)
	Function to validate an IP address.

BOOL	SetPrivilege (HANDLE Token, LPCTSTR Privilege, BOOL EnablePrivilege)
	SetPrivilege enables/disables process token privilege.

void	Trim (std::string &s)
	trim from both ends and start of a string (in place)

std::string	RemoveSpaces (std::string str)
	Remove all the spaces in a string.

BOOLEAN	IsFileExistA (const char *FileName)
	check if a file exist or not (ASCII)

BOOLEAN	IsFileExistW (const wchar_t *FileName)
	check if a file exist or not (wide-char)

VOID	GetConfigFilePath (PWCHAR ConfigPath)
	Get config path.

VOID	StringToWString (std::wstring &ws, const std::string &s)
	convert std::string to std::wstring

VOID	SplitPathAndArgs (std::vector< std::string > &Qargs, const std::string &Command)
	Split path and arguments and handle strings between quotes.

size_t	FindCaseInsensitive (std::string Input, std::string ToSearch, size_t Pos)
	Find case insensitive sub string in a given substring.

size_t	FindCaseInsensitiveW (std::wstring Input, std::wstring ToSearch, size_t Pos)
	Find case insensitive sub string in a given substring (unicode)

char *	ConvertStringVectorToCharPointerArray (const std::string &s)
	Convert vector<string> to char*.

std::vector< std::string >	ListDirectory (const std::string &Directory, const std::string &Extension)
	Create a list of special files in a directory.

BOOLEAN	IsEmptyString (char *Text)
	Is empty character.

VOID	CommonCpuidInstruction (UINT32 Func, UINT32 SubFunc, int *CpuInfo)
	Get cpuid results.

BOOLEAN	CheckCpuSupportRtm ()
	Check whether the processor supports RTM or not.

UINT32	Getx86VirtualAddressWidth ()
	Get virtual address width for x86 processors.

BOOLEAN	CheckAccessValidityAndSafety (UINT64 TargetAddress, UINT32 Size)
	Check the safety to access the memory.

BOOLEAN	VmxSupportDetection ()
	Detect whether the VMX is supported or not.

Detailed Description

header for HyperDbg's general functions for reading and converting and etc

Author: Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version: 0.1

Date: 2020-05-27

Copyright: This project is released under the GNU Public License v3.

Macro Definition Documentation

◆ ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH

#define ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH

Value:

                                                    "the handshaking process was successful; however, there is a mismatch between " \
                                                    "the version/build of the debuggee and the debugger. please use the same "      \
                                                    "version/build for both the debuggee and debugger\n"

#define ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH "the handshaking process was successful; however, there is a mismatch between " \
                                                    "the version/build of the debuggee and the debugger. please use the same "      \
                                                    "version/build for both the debuggee and debugger\n"

◆ ASSERT_MESSAGE_CANNOT_SPECIFY_PID

#define ASSERT_MESSAGE_CANNOT_SPECIFY_PID

Value:

                                          "err, since HyperDbg won't context-switch to keep the system in a halted state, "                       \
                                          "you cannot specify 'pid' for this command in the debugger mode. You can switch to the target process " \
                                          "memory layout using the '.process' or the '.thread' command. After that, you can use "                 \
                                          "this command without specifying the process ID. Alternatively, you can modify the current "            \
                                          "CR3 register to achieve the same functionality\n"

#define ASSERT_MESSAGE_CANNOT_SPECIFY_PID "err, since HyperDbg won't context-switch to keep the system in a halted state, "                       \
                                          "you cannot specify 'pid' for this command in the debugger mode. You can switch to the target process " \
                                          "memory layout using the '.process' or the '.thread' command. After that, you can use "                 \
                                          "this command without specifying the process ID. Alternatively, you can modify the current "            \
                                          "CR3 register to achieve the same functionality\n"

◆ ASSERT_MESSAGE_DRIVER_NOT_LOADED

#define ASSERT_MESSAGE_DRIVER_NOT_LOADED "handle of the driver not found, probably the driver is not loaded. Did you use 'load' command?\n"

◆ AssertReturn

#define AssertReturn return;

◆ AssertReturnFalse

#define AssertReturnFalse return FALSE;

◆ AssertReturnOne

#define AssertReturnOne return 1;

◆ AssertReturnStmt

#define AssertReturnStmt	(	expr,
		stmt,
		rc )

Value:

    do                                   \
    {                                    \
        if (expr)                        \
        {                                \
            /* likely */                 \
        }                                \
        else                             \
        {                                \
            stmt;                        \
            rc;                          \
        }                                \
    } while (0)

#define AssertReturnStmt(expr, stmt, rc) \
    do                                   \
    {                                    \
        if (expr)                        \
        {                                \
            /* likely */                 \
        }                                \
        else                             \
        {                                \
            stmt;                        \
            rc;                          \
        }                                \
    } while (0)

◆ AssertShowMessageReturnStmt

#define AssertShowMessageReturnStmt	(	expr,
		message,
		rc )

Value:

    do                                                 \
    {                                                  \
        if (expr)                                      \
        {                                              \
            /* likely */                               \
        }                                              \
        else                                           \
        {                                              \
            ShowMessages(message);                     \
            rc;                                        \
        }                                              \
    } while (0)

#define AssertShowMessageReturnStmt(expr, message, rc) \
    do                                                 \
    {                                                  \
        if (expr)                                      \
        {                                              \
            /* likely */                               \
        }                                              \
        else                                           \
        {                                              \
            ShowMessages(message);                     \
            rc;                                        \
        }                                              \
    } while (0)

◆ CPUID_ADDR_WIDTH

#define CPUID_ADDR_WIDTH 0x80000008

Cpuid to get virtual address width.

◆ PAGE_ALIGN

#define PAGE_ALIGN ( Va ) ((PVOID)((ULONG_PTR)(Va) & ~(PAGE_SIZE - 1)))

Aligning a page.

◆ PAGE_SIZE

#define PAGE_SIZE 0x1000

Size of each page (4096 bytes)

Function Documentation

◆ AsmVmxSupportDetection()

bool AsmVmxSupportDetection ( )

extern

◆ CheckAccessValidityAndSafety()

BOOLEAN CheckAccessValidityAndSafety	(	UINT64	TargetAddress,
		UINT32	Size )

Check the safety to access the memory.

Parameters

TargetAddress
Size

Returns: BOOLEAN

{
    CR3_TYPE GuestCr3;
    UINT64   OriginalCr3;
    BOOLEAN  IsKernelAddress;
    BOOLEAN  Result = FALSE;
 
    //
    // First, we check if the address is canonical based
    // on Intel processor's virtual address width
    //
    if (!CheckAddressCanonicality(TargetAddress, &IsKernelAddress))
    {
        //
        // No need for further check, address is invalid
        //
        Result = FALSE;
        goto Return;
    }
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3 = __readcr3();
    __writecr3(GuestCr3.Flags);
 
    //
    // We'll only check address with TSX if the address is a kernel-mode
    // address because an exception is thrown if we access user-mode code
    // from vmx-root mode, thus, TSX will fail the transaction and the
    // result is not true, so we check each pages' page-table for user-mode
    // codes in both user-mode and kernel-mode
    //
    // if (g_RtmSupport && IsKernelAddress)
    // {
    //     //
    //     // The guest supports Intel TSX
    //     //
    //     UINT64 AlignedPage = (UINT64)PAGE_ALIGN(TargetAddress);
    //     UINT64 PageCount   = ((TargetAddress - AlignedPage) + Size) / PAGE_SIZE;
    //
    //     for (size_t i = 0; i <= PageCount; i++)
    //     {
    //         UINT64 CheckAddr = AlignedPage + (PAGE_SIZE * i);
    //         if (!CheckAddressValidityUsingTsx(CheckAddr))
    //         {
    //             //
    //             // Address is not valid
    //             //
    //             Result = FALSE;
    //
    //             goto RestoreCr3;
    //         }
    //     }
    // }
 
    //
    // We've realized that using TSX for address checking is not faster
    // than the legacy memory checking (traversing the page-tables),
    // based on our resultsm it's ~50 TSC clock cycles for a valid address
    // and ~180 TSC clock cycles for an invalid address slower to use TSX
    // for memory checking, that's why it is deprecated now
    //
 
    //
    // Check if memory is safe and present
    //
    UINT64 AddressToCheck = (CHAR *)TargetAddress + Size - ((CHAR *)PAGE_ALIGN(TargetAddress));
 
    if (AddressToCheck > PAGE_SIZE)
    {
        //
        // Address should be accessed in more than one page
        //
        UINT64 ReadSize = AddressToCheck;
 
        while (Size != 0)
        {
            ReadSize = (UINT64)PAGE_ALIGN(TargetAddress + PAGE_SIZE) - TargetAddress;
 
            if (ReadSize == PAGE_SIZE && Size < PAGE_SIZE)
            {
                ReadSize = Size;
            }
 
            if (!MemoryMapperCheckIfPageIsPresentByCr3((PVOID)TargetAddress, GuestCr3))
            {
                //
                // Address is not valid
                //
                Result = FALSE;
 
                goto RestoreCr3;
            }
 
            /*
            LogInfo("Addr From : %llx to Addr To : %llx | ReadSize : %llx\n",
                    TargetAddress,
                    TargetAddress + ReadSize,
                    ReadSize);
            */
 
            //
            // Apply the changes to the next addresses (if any)
            //
            Size          = (UINT32)(Size - ReadSize);
            TargetAddress = TargetAddress + ReadSize;
        }
    }
    else
    {
        if (!MemoryMapperCheckIfPageIsPresentByCr3((PVOID)TargetAddress, GuestCr3))
        {
            //
            // Address is not valid
            //
            Result = FALSE;
 
            goto RestoreCr3;
        }
    }
 
    //
    // If we've reached here, the address was valid
    //
    Result = TRUE;
 
RestoreCr3:
 
    //
    // Move back to original cr3
    //
    __writecr3(OriginalCr3);
 
Return:
    return Result;
}

◆ CheckCpuSupportRtm()

BOOLEAN CheckCpuSupportRtm ( )

Check whether the processor supports RTM or not.

Returns: BOOLEAN

{
    int     Regs1[4];
    int     Regs2[4];
    BOOLEAN Result;
 
    //
    // TSX is controlled via MSR_IA32_TSX_CTRL.  However, support for this
    // MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES.
    //
    // TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
    // microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
    // bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
    // MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
    // tsx= cmdline requests will do nothing on CPUs without
    // MSR_IA32_TSX_CTRL support.
    //
 
    CommonCpuidInstruction(0, 0, Regs1);
    CommonCpuidInstruction(7, 0, Regs2);
 
    //
    // Check RTM and MPX extensions in order to filter out TSX on Haswell CPUs
    //
    Result = Regs1[0] >= 0x7 && (Regs2[1] & 0x4800) == 0x4800;
 
    return Result;
}

◆ CommonCpuidInstruction()

VOID CommonCpuidInstruction	(	UINT32	Func,
		UINT32	SubFunc,
		int *	CpuInfo )

Get cpuid results.

Parameters

UINT32	Func
UINT32	SubFunc
int	* CpuInfo

Returns: VOID

{
    __cpuidex(CpuInfo, Func, SubFunc);
}

◆ ConvertStringToUInt32()

BOOLEAN ConvertStringToUInt32	(	string	TextToConvert,
		PUINT32	Result )

check and convert string to a 32 bit unsigned it and also check for special notations like 0x etc.

Parameters

TextToConvert	the target string
Result	result will be save to the pointer

Returns: BOOLEAN shows whether the conversion was successful or not

{
    BOOLEAN IsDecimal = FALSE; // By default everything is hex
 
    if (TextToConvert.rfind("0x", 0) == 0 || TextToConvert.rfind("0X", 0) == 0 ||
        TextToConvert.rfind("\\x", 0) == 0 ||
        TextToConvert.rfind("\\X", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
    }
    else if (TextToConvert.rfind('x', 0) == 0 ||
             TextToConvert.rfind('X', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
    }
    else if (TextToConvert.rfind("0n", 0) == 0 || TextToConvert.rfind("0N", 0) == 0 ||
             TextToConvert.rfind("\\n", 0) == 0 ||
             TextToConvert.rfind("\\N", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
        IsDecimal     = TRUE;
    }
    else if (TextToConvert.rfind('n', 0) == 0 ||
             TextToConvert.rfind('N', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
        IsDecimal     = TRUE;
    }
 
    TextToConvert.erase(remove(TextToConvert.begin(), TextToConvert.end(), '`'),
                        TextToConvert.end());
 
    if (IsDecimal)
    {
        if (!IsDecimalNotation(TextToConvert))
        {
            return FALSE;
        }
        else
        {
            try
            {
                int i   = std::stoi(TextToConvert);
                *Result = i;
                return TRUE;
            }
            catch (std::invalid_argument const &)
            {
                //
                // Bad input: std::invalid_argument thrown
                //
                return FALSE;
            }
            catch (std::out_of_range const &)
            {
                //
                // Integer overflow: std::out_of_range thrown
                //
                return FALSE;
            }
 
            return FALSE;
        }
    }
    else
    {
        //
        // It's not decimal
        //
        if (!IsHexNotation(TextToConvert))
        {
            return FALSE;
        }
        else
        {
            //
            // It's hex number
            //
            UINT32 TempResult;
            TempResult = stoi(TextToConvert, nullptr, 16);
 
            //
            // Apply the results
            //
            *Result = TempResult;
 
            return TRUE;
        }
    }
}

◆ ConvertStringToUInt64()

BOOLEAN ConvertStringToUInt64	(	string	TextToConvert,
		PUINT64	Result )

check and convert string to a 64 bit unsigned integer and also check for special notations like 0x, 0n, etc.

Parameters

TextToConvert	the target string
Result	result will be save to the pointer

Returns: BOOLEAN shows whether the conversion was successful or not

{
    BOOLEAN IsDecimal = FALSE; // By default everything is hex
 
    if (TextToConvert.rfind("0x", 0) == 0 || TextToConvert.rfind("0X", 0) == 0 ||
        TextToConvert.rfind("\\x", 0) == 0 ||
        TextToConvert.rfind("\\X", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
    }
    else if (TextToConvert.rfind('x', 0) == 0 ||
             TextToConvert.rfind('X', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
    }
    else if (TextToConvert.rfind("0n", 0) == 0 || TextToConvert.rfind("0N", 0) == 0 ||
             TextToConvert.rfind("\\n", 0) == 0 ||
             TextToConvert.rfind("\\N", 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 2);
        IsDecimal     = TRUE;
    }
    else if (TextToConvert.rfind('n', 0) == 0 ||
             TextToConvert.rfind('N', 0) == 0)
    {
        TextToConvert = TextToConvert.erase(0, 1);
        IsDecimal     = TRUE;
    }
 
    //
    // Remove '`' (if any)
    //
    TextToConvert.erase(remove(TextToConvert.begin(), TextToConvert.end(), '`'),
                        TextToConvert.end());
 
    if (IsDecimal)
    {
        if (!IsDecimalNotation(TextToConvert))
        {
            //
            // Not decimal
            //
            return FALSE;
        }
        else
        {
            errno                                 = 0;
            char *                       unparsed = NULL;
            const char *                 s        = TextToConvert.c_str();
            const unsigned long long int n        = strtoull(s, &unparsed, 10);
 
            if (errno || (!n && s == unparsed))
            {
                // fflush(stdout);
                // perror(s);
                return FALSE;
            }
 
            *Result = n;
            return TRUE;
        }
    }
    else
    {
        //
        // It's not decimal
        //
        if (!IsHexNotation(TextToConvert))
        {
            //
            // Not decimal and not hex!
            //
            return FALSE;
        }
        else
        {
            //
            // It's a hex number
            //
            const char * Text         = TextToConvert.c_str();
            errno                     = 0;
            unsigned long long result = strtoull(Text, NULL, 16);
 
            *Result = result;
 
            if (errno == EINVAL)
            {
                return FALSE;
            }
            else if (errno == ERANGE)
            {
                return TRUE;
            }
 
            return TRUE;
        }
    }
}

◆ ConvertStringVectorToCharPointerArray()

char * ConvertStringVectorToCharPointerArray ( const std::string & s )

Convert vector<string> to char*.

use it like : std::transform(vs.begin(), vs.end(), std::back_inserter(vc), ConvertStringVectorToCharPointerArray); from: https://stackoverflow.com/questions/7048888/stdvectorstdstring-to-char-array

Parameters

Input
ToSearch
Pos

Returns: size_t

{
    char * pc = new char[s.size() + 1];
    std::strcpy(pc, s.c_str());
    return pc;
}

◆ FindCaseInsensitive()

size_t FindCaseInsensitive	(	std::string	Input,
		std::string	ToSearch,
		size_t	Pos )

Find case insensitive sub string in a given substring.

Parameters

Input
ToSearch
Pos

Returns: size_t

{
    // Convert complete given String to lower case
    std::transform(Input.begin(), Input.end(), Input.begin(), ::tolower);
    // Convert complete given Sub String to lower case
    std::transform(ToSearch.begin(), ToSearch.end(), ToSearch.begin(), ::tolower);
    // Find sub string in given string
    return Input.find(ToSearch, Pos);
}

◆ FindCaseInsensitiveW()

size_t FindCaseInsensitiveW	(	std::wstring	Input,
		std::wstring	ToSearch,
		size_t	Pos )

Find case insensitive sub string in a given substring (unicode)

Parameters

Input
ToSearch
Pos

Returns: size_t

{
    // Convert complete given String to lower case
    std::transform(Input.begin(), Input.end(), Input.begin(), ::tolower);
    // Convert complete given Sub String to lower case
    std::transform(ToSearch.begin(), ToSearch.end(), ToSearch.begin(), ::tolower);
    // Find sub string in given string
    return Input.find(ToSearch, Pos);
}

◆ GetConfigFilePath()

VOID GetConfigFilePath ( PWCHAR ConfigPath )

Get config path.

Parameters

ConfigPath

{
    WCHAR CurrentPath[MAX_PATH] = {0};
 
    //
    // Get path file of current exe
    //
    GetModuleFileNameW(NULL, CurrentPath, MAX_PATH);
 
    //
    // Remove exe file name
    //
    PathRemoveFileSpecW(CurrentPath);
 
    //
    // Combine current exe path with config file name
    //
    PathCombineW(ConfigPath, CurrentPath, CONFIG_FILE_NAME);
}

◆ Getx86VirtualAddressWidth()

UINT32 Getx86VirtualAddressWidth ( )

Get virtual address width for x86 processors.

Returns: UINT32

{
    int Regs[4];
 
    CommonCpuidInstruction(CPUID_ADDR_WIDTH, 0, Regs);
 
    //
    // Extracting bit 15:8 from eax register
    //
    return ((Regs[0] >> 8) & 0x0ff);
}

◆ HasEnding()

BOOLEAN HasEnding	(	string const &	fullString,
		string const &	ending )

checks whether the string ends with a special string or not

Parameters

fullString
ending

Returns: BOOLEAN if true then it shows that string ends with another string and if false then it shows that this string is not ended with the target string

{
    if (fullString.length() >= ending.length())
    {
        return (0 == fullString.compare(fullString.length() - ending.length(),
                                        ending.length(),
                                        ending));
    }
    else
    {
        return FALSE;
    }
}

◆ HexToBytes()

vector< char > HexToBytes ( const string & hex )

converts hex to bytes

Parameters

hex

Returns: vector<char>

{
    vector<char> Bytes;
 
    for (unsigned int i = 0; i < hex.length(); i += 2)
    {
        std::string byteString = hex.substr(i, 2);
        char        byte       = (char)strtol(byteString.c_str(), NULL, 16);
        Bytes.push_back(byte);
    }
 
    return Bytes;
}

◆ IsEmptyString()

BOOLEAN IsEmptyString ( char * Text )

Is empty character.

Parameters

Text

{
    size_t Len;
 
    if (Text == NULL || Text[0] == '\0')
    {
        return TRUE;
    }
 
    Len = strlen(Text);
    for (size_t i = 0; i < Len; i++)
    {
        if (Text[i] != ' ' && Text[i] != '\t' && Text[i] != '\n')
        {
            return FALSE;
        }
    }
 
    return TRUE;
}

◆ IsFileExistA()

BOOLEAN IsFileExistA ( const char * FileName )

check if a file exist or not (ASCII)

Parameters

FileName path of file

Returns: BOOLEAN shows whether the file exist or not

{
    struct stat buffer;
    return (stat(FileName, &buffer) == 0);
}

◆ IsFileExistW()

BOOLEAN IsFileExistW ( const wchar_t * FileName )

check if a file exist or not (wide-char)

Parameters

FileName path of file

Returns: BOOLEAN shows whether the file exist or not

{
    struct _stat64i32 buffer;
    return (_wstat(FileName, &buffer) == 0);
}

◆ IsHexNotation()

BOOLEAN IsHexNotation ( const string & s )

check whether the string is hex or not

Parameters

s

Returns: BOOLEAN

{
    BOOLEAN IsAnyThing = FALSE;
 
    for (auto & CptrChar : s)
    {
        IsAnyThing = TRUE;
 
        if (!isxdigit(CptrChar))
        {
            return FALSE;
        }
    }
    if (IsAnyThing)
    {
        return TRUE;
    }
    return FALSE;
}

◆ IsNumber()

BOOLEAN IsNumber ( const string & str )

check if given string is a numeric string or not

Parameters

str

Returns: BOOLEAN

{
    //
    // std::find_first_not_of searches the string for the first character
    // that does not match any of the characters specified in its arguments
    //
    return !str.empty() &&
           (str.find_first_not_of("[0123456789]") == std::string::npos);
}

◆ ListDirectory()

std::vector< std::string > ListDirectory	(	const std::string &	Directory,
		const std::string &	Extension )

Create a list of special files in a directory.

Parameters

Directory
Extension

Returns: std::vector<std::string>

{
    WIN32_FIND_DATAA         FindData;
    HANDLE                   Find     = INVALID_HANDLE_VALUE;
    std::string              FullPath = Directory + "\\" + Extension;
    std::vector<std::string> DirList;
 
    Find = FindFirstFileA(FullPath.c_str(), &FindData);
 
    if (Find == INVALID_HANDLE_VALUE)
        throw std::runtime_error("invalid handle value! please check your path...");
 
    while (FindNextFileA(Find, &FindData) != 0)
    {
        DirList.push_back(Directory + "\\" + std::string(FindData.cFileName));
    }
 
    FindClose(Find);
 
    return DirList;
}

◆ Log2Ceil()

UINT32 Log2Ceil ( UINT32 n )

Function to compute log2Ceil.

Parameters

n

Returns: UINT32

{
    if (n == 0)
        return 0; // log2Ceil(0) is undefined, returning 0 for safety.
 
    n--; // Decrease by 1 to check if it is a power of 2
    UINT32 log2Floor = 0;
    while (n >>= 1)
    {
        log2Floor++;
    }
    return log2Floor + 1;
}

◆ PrintBits()

VOID PrintBits	(	const UINT32	Size,
		const void *	Ptr )

print bits and bytes for d* commands

Parameters

Size
Ptr

Returns: VOID

{
    unsigned char * Buf = (unsigned char *)Ptr;
    unsigned char   Byte;
    int             i, j;
 
    for (i = Size - 1; i >= 0; i--)
    {
        for (j = 7; j >= 0; j--)
        {
            Byte = (Buf[i] >> j) & 1;
            ShowMessages("%u", Byte);
        }
        ShowMessages(" ", Byte);
    }
}

◆ RemoveSpaces()

std::string RemoveSpaces ( std::string str )

Remove all the spaces in a string.

Parameters

str

{
    str.erase(remove(str.begin(), str.end(), ' '), str.end());
    return str;
}

◆ Replace()

BOOL Replace	(	std::string &	str,
		const std::string &	from,
		const std::string &	to )

general replace all function

Parameters

str
from
to

Returns: VOID

{
    size_t start_pos = str.find(from);
    if (start_pos == std::string::npos)
        return FALSE;
    str.replace(start_pos, from.size(), to);
    return TRUE;
}

◆ ReplaceAll()

VOID ReplaceAll	(	string &	str,
		const string &	from,
		const string &	to )

general replace all function

Parameters

str
from
to

Returns: VOID

{
    size_t SartPos = 0;
 
    if (from.empty())
        return;
 
    while ((SartPos = str.find(from, SartPos)) != std::string::npos)
    {
        str.replace(SartPos, from.length(), to);
        //
        // In case 'to' contains 'from', like replacing
        // 'x' with 'yx'
        //
        SartPos += to.length();
    }
}

◆ SetPrivilege()

BOOL SetPrivilege	(	HANDLE	Token,
		LPCTSTR	Privilege,
		BOOL	EnablePrivilege )

SetPrivilege enables/disables process token privilege.

Parameters

Token
Privilege
EnablePrivilege

Returns: BOOL

{
    TOKEN_PRIVILEGES Tp;
    LUID             Luid;
 
    if (!LookupPrivilegeValue(NULL,      // lookup privilege on local system
                              Privilege, // privilege to lookup
                              &Luid))    // receives LUID of privilege
    {
        ShowMessages("err, in LookupPrivilegeValue (%x)\n", GetLastError());
        return FALSE;
    }
 
    Tp.PrivilegeCount     = 1;
    Tp.Privileges[0].Luid = Luid;
    if (EnablePrivilege)
        Tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        Tp.Privileges[0].Attributes = 0;
 
    //
    // Enable the privilege or disable all privileges.
    //
    if (!AdjustTokenPrivileges(Token, FALSE, &Tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL))
    {
        ShowMessages("err, in AdjustTokenPrivileges (%x)\n", GetLastError());
        return FALSE;
    }
 
    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
    {
        ShowMessages("err, the token does not have the specified privilege (ACCESS DENIED!)\n");
        ShowMessages("make sure to run it with administrator privileges\n");
        return FALSE;
    }
 
    return TRUE;
}

◆ SpinlockLock()

void SpinlockLock ( volatile LONG * Lock )

Tries to get the lock and won't return until successfully get the lock.

Parameters

LONG	Lock variable

{
    unsigned wait = 1;
 
    while (!SpinlockTryLock(Lock))
    {
        for (unsigned i = 0; i < wait; ++i)
        {
            _mm_pause();
        }
 
        //
        // Don't call "pause" too many times. If the wait becomes too big,
        // clamp it to the MaxWait.
        //
 
        if (wait * 2 > MaxWait)
        {
            wait = MaxWait;
        }
        else
        {
            wait = wait * 2;
        }
    }
}

◆ SpinlockLockWithCustomWait()

void SpinlockLockWithCustomWait	(	volatile LONG *	Lock,
		unsigned	MaximumWait )

Tries to get the lock and won't return until successfully get the lock.

Parameters

LONG	Lock variable
LONG	MaxWait Maximum wait (pause) count

{
    unsigned wait = 1;
 
    while (!SpinlockTryLock(Lock))
    {
        for (unsigned i = 0; i < wait; ++i)
        {
            _mm_pause();
        }
 
        //
        // Don't call "pause" too many times. If the wait becomes too big,
        // clamp it to the MaxWait.
        //
 
        if (wait * 2 > MaximumWait)
        {
            wait = MaximumWait;
        }
        else
        {
            wait = wait * 2;
        }
    }
}

◆ SpinlockUnlock()

void SpinlockUnlock ( volatile LONG * Lock )

Release the lock.

Parameters

LONG	Lock variable

{
    *Lock = 0;
}

◆ Split()

const vector< string > Split	(	const string &	s,
		const char &	c )

general split command

Parameters

s	target string
c	splitter (delimiter)

Returns: const vector<string>

{
    string         buff {""};
    vector<string> v;
 
    for (auto n : s)
    {
        if (n != c)
            buff += n;
        else if (n == c && !buff.empty())
        {
            v.push_back(buff);
            buff.clear();
        }
    }
    if (!buff.empty())
        v.push_back(buff);
 
    return v;
}

◆ SplitIp()

vector< string > SplitIp	(	const string &	str,
		char	delim )

◆ SplitPathAndArgs()

VOID SplitPathAndArgs	(	std::vector< std::string > &	Qargs,
		const std::string &	Command )

Split path and arguments and handle strings between quotes.

Parameters

Qargs
Command

Returns: VOID

{
    int  Len = (int)Command.length();
    bool Qot = false, Sqot = false;
    int  ArgLen;
 
    for (int i = 0; i < Len; i++)
    {
        int start = i;
        if (Command[i] == '\"')
        {
            Qot = true;
        }
        else if (Command[i] == '\'')
            Sqot = true;
 
        if (Qot)
        {
            i++;
            start++;
            while (i < Len && Command[i] != '\"')
                i++;
            if (i < Len)
                Qot = false;
            ArgLen = i - start;
            i++;
        }
        else if (Sqot)
        {
            i++;
            while (i < Len && Command[i] != '\'')
                i++;
            if (i < Len)
                Sqot = false;
            ArgLen = i - start;
            i++;
        }
        else
        {
            while (i < Len && Command[i] != ' ')
                i++;
            ArgLen = i - start;
        }
 
        string Temp = Command.substr(start, ArgLen);
        if (!Temp.empty() && Temp != " ")
        {
            Qargs.push_back(Temp);
        }
    }
 
    /*
    for (int i = 0; i < Qargs.size(); i++)
    {
        std::cout << Qargs[i] << std::endl;
    }
 
    std::cout << Qargs.size();
 
    if (Qot || Sqot)
        std::cout << "One of the quotes is open\n";
    */
}

◆ StringToWString()

VOID StringToWString	(	std::wstring &	ws,
		const std::string &	s )

convert std::string to std::wstring

Parameters

ws
s

Returns: VOID

{
    std::wstring WsTmp(s.begin(), s.end());
 
    ws = WsTmp;
}

◆ Trim()

void Trim ( std::string & s )

trim from both ends and start of a string (in place)

Parameters

s

{
    ltrim(s);
    rtrim(s);
}

◆ ValidateIP()

BOOLEAN ValidateIP ( const string & ip )

Function to validate an IP address.

Parameters

ip

Returns: BOOLEAN

{
    //
    // split the string into tokens
    //
    vector<string> list = Split(ip, '.');
 
    //
    // if token size is not equal to four
    //
    if (list.size() != 4)
        return FALSE;
 
    //
    // validate each token
    //
    for (string str : list)
    {
        //
        // verify that string is number or not and the numbers
        // are in the valid range
        //
        if (!IsNumber(str) || stoi(str) > 255 || stoi(str) < 0)
            return FALSE;
    }
 
    return TRUE;
}

◆ VmxSupportDetection()

BOOLEAN VmxSupportDetection ( )

Detect whether the VMX is supported or not.

Returns: true if vmx is supported; false if vmx is not supported

{
    //
    // Call assembly function
    //
    return AsmVmxSupportDetection();
}

Macros

Functions

Detailed Description

Macro Definition Documentation

◆ ASSERT_MESSAGE_BUILD_SIGNATURE_DOESNT_MATCH

◆ ASSERT_MESSAGE_CANNOT_SPECIFY_PID

◆ ASSERT_MESSAGE_DRIVER_NOT_LOADED

◆ AssertReturn

◆ AssertReturnFalse

◆ AssertReturnOne

◆ AssertReturnStmt

◆ AssertShowMessageReturnStmt

◆ CPUID_ADDR_WIDTH

◆ PAGE_ALIGN

◆ PAGE_SIZE

Function Documentation

◆ AsmVmxSupportDetection()

◆ CheckAccessValidityAndSafety()

◆ CheckCpuSupportRtm()

◆ CommonCpuidInstruction()

◆ ConvertStringToUInt32()

◆ ConvertStringToUInt64()

◆ ConvertStringVectorToCharPointerArray()

◆ FindCaseInsensitive()

◆ FindCaseInsensitiveW()

◆ GetConfigFilePath()

◆ Getx86VirtualAddressWidth()

◆ HasEnding()

◆ HexToBytes()

◆ IsEmptyString()

◆ IsFileExistA()

◆ IsFileExistW()

◆ IsHexNotation()

◆ IsNumber()

◆ ListDirectory()

◆ Log2Ceil()

◆ PrintBits()

◆ RemoveSpaces()

◆ Replace()

◆ ReplaceAll()

◆ SetPrivilege()

◆ SpinlockLock()

◆ SpinlockLockWithCustomWait()

◆ SpinlockUnlock()

◆ Split()

◆ SplitIp()

◆ SplitPathAndArgs()

◆ StringToWString()

◆ Trim()

◆ ValidateIP()

◆ VmxSupportDetection()