HyperDbg Debugger
Loading...
Searching...
No Matches
kd.h
Go to the documentation of this file.
1
12#pragma once
13
15// Display Windows Details //
17
18#ifdef _WIN32
19// HKEY / RegCloseKey are Windows registry APIs; this RAII helper is Windows-only
20struct HKeyHolder
21{
22private:
23 HKEY m_Key;
24
25public:
26 HKeyHolder() :
27 m_Key(nullptr) { }
28
29 HKeyHolder(const HKeyHolder &) = delete;
30 HKeyHolder & operator=(const HKeyHolder &) = delete;
31
32 ~HKeyHolder()
33 {
34 if (m_Key != nullptr)
35 RegCloseKey(m_Key);
36 }
37
38 operator HKEY() const { return m_Key; }
39
40 HKEY * operator&() { return &m_Key; }
41};
42#endif // _WIN32
43
45// Functions //
47
52
57 CHAR * Buffer,
58 UINT32 BufferLength);
59
62 BOOLEAN IsNamedPipe,
63 BOOLEAN PauseAfterConnection);
64
66KdPrepareAndConnectDebugPort(const CHAR * PortName,
67 DWORD Baudrate,
68 UINT32 Port,
69 BOOLEAN IsPreparing,
70 BOOLEAN IsNamedPipe,
71 BOOLEAN PauseAfterConnection);
72
74KdSendPacketToDebuggee(const CHAR * Buffer, UINT32 Length, BOOLEAN SendEndOfBuffer);
75
77KdReceivePacketFromDebuggee(CHAR * BufferToSave, UINT32 * LengthReceived);
78
80KdReceivePacketFromDebugger(CHAR * BufferToSave, UINT32 * LengthReceived);
81
83KdCheckForTheEndOfTheBuffer(PUINT32 CurrentLoopIndex, BYTE * Buffer);
84
87
90
93 UINT64 Tag,
94 DEBUGGER_MODIFY_EVENTS_TYPE TypeOfAction,
95 BOOLEAN * IsEnabled);
96
99
101KdSendCallStackPacketToDebuggee(UINT64 BaseAddress,
102 UINT32 Size,
104 BOOLEAN Is32Bit);
105
108
111
114
117
120
123
126
129 UINT32 EventBufferLength);
130
133 UINT32 GeneralActionLength);
134
137 UINT32 NewPid,
138 UINT64 NewProcess,
139 BOOLEAN SetChangeByClockInterrupt,
140 PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS SymDetailsForProcessList);
141
144 UINT32 NewTid,
145 UINT64 NewThread,
146 BOOLEAN CheckByClockInterrupt,
147 PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS SymDetailsForThreadList);
148
151
154
156KdSendApicActionPacketsToDebuggee(PDEBUGGER_APIC_REQUEST ApicRequest, UINT32 ExpectedRequestSize);
157
159KdSendSmiPacketsToDebuggee(PSMI_OPERATION_PACKETS SmiOperationRequest, UINT32 ExpectedRequestSize);
160
162KdSendHyperTraceLbrdumpPacketsToDebuggee(PHYPERTRACE_LBR_DUMP_PACKETS HyperTraceLbrdumpRequest, UINT32 ExpectedRequestSize);
163
165KdSendHyperTracePtPacketsToDebuggee(PHYPERTRACE_PT_OPERATION_PACKETS HyperTracePtOperationRequest, UINT32 ExpectedRequestSize);
166
169
172
175
178 PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET ListOrModifyPacket);
179
181KdSendScriptPacketToDebuggee(UINT64 BufferAddress, UINT32 BufferLength, UINT32 Pointer, BOOLEAN IsFormat);
182
184KdSendUserInputPacketToDebuggee(const CHAR * Sendbuf, INT Len, BOOLEAN IgnoreBreakingAgain);
185
187KdSendSearchRequestPacketToDebuggee(UINT64 * SearchRequestBuffer, UINT32 SearchRequestBufferSize);
188
191
192BYTE
193KdComputeDataChecksum(PVOID Buffer, UINT32 Length);
194
197 UINT32 Length);
198
201 UINT32 Length);
202
204KdSendModifyEventInDebuggee(PDEBUGGER_MODIFY_EVENTS ModifyEvent, BOOLEAN SendTheResultBackToDebugger);
205
209 PVOID Buffer,
210 UINT32 BufferLength,
211 BOOLEAN PauseDebuggeeWhenSent);
212
215
217KdReloadSymbolsInDebuggee(BOOLEAN PauseDebuggee, UINT32 UserProcessId);
218
221
224
227
228VOID
230
231VOID
232KdSendUsermodePrints(CHAR * Input, UINT32 Length);
233
234VOID
236 UINT32 CurrentSymbolInfoIndex,
237 UINT32 TotalSymbols);
238
239VOID
241
242VOID
244
245VOID
247
248VOID
250
251VOID
POOL_TYPE SIZE_T ULONG Tag
Definition Hooks.h:89
UCHAR BOOLEAN
Definition BasicTypes.h:35
void * PVOID
Definition BasicTypes.h:56
int INT
Definition BasicTypes.h:43
unsigned char BYTE
Definition BasicTypes.h:40
unsigned int * PUINT32
Definition BasicTypes.h:54
unsigned long DWORD
Definition BasicTypes.h:38
unsigned int UINT32
Definition BasicTypes.h:54
char CHAR
Definition BasicTypes.h:33
enum _DEBUGGER_REMOTE_PACKET_TYPE DEBUGGER_REMOTE_PACKET_TYPE
enum for different packet types in HyperDbg packets
enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION
enum for requested action for HyperDbg packet
struct _DEBUGGEE_USER_INPUT_PACKET DEBUGGEE_USER_INPUT_PACKET
The structure of user-input packet in HyperDbg.
struct _DEBUGGER_GENERAL_EVENT_DETAIL * PDEBUGGER_GENERAL_EVENT_DETAIL
struct _DEBUGGER_MODIFY_EVENTS * PDEBUGGER_MODIFY_EVENTS
struct _DEBUGGER_EVENT_AND_ACTION_RESULT * PDEBUGGER_EVENT_AND_ACTION_RESULT
enum _DEBUGGER_MODIFY_EVENTS_TYPE DEBUGGER_MODIFY_EVENTS_TYPE
different types of modifying events request (enable/disable/clear)
struct _DEBUGGER_GENERAL_ACTION * PDEBUGGER_GENERAL_ACTION
struct _DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS * PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS
struct _DEBUGGEE_REGISTER_WRITE_DESCRIPTION * PDEBUGGEE_REGISTER_WRITE_DESCRIPTION
struct _DEBUGGER_APIC_REQUEST * PDEBUGGER_APIC_REQUEST
struct _HYPERTRACE_PT_OPERATION_PACKETS * PHYPERTRACE_PT_OPERATION_PACKETS
struct _DEBUGGEE_THREAD_LIST_NEEDED_DETAILS * PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS
struct _DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS * PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS
struct _DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET * PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET
struct _DEBUGGEE_REGISTER_READ_DESCRIPTION * PDEBUGGEE_REGISTER_READ_DESCRIPTION
enum _DEBUGGER_TEST_QUERY_STATE DEBUGGER_TEST_QUERY_STATE
test query used for test purposed
enum _DEBUGGER_CALLSTACK_DISPLAY_METHOD DEBUGGER_CALLSTACK_DISPLAY_METHOD
callstack showing method
struct _DEBUGGEE_BP_PACKET * PDEBUGGEE_BP_PACKET
struct _SMI_OPERATION_PACKETS * PSMI_OPERATION_PACKETS
enum _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE
Debugger thread switch and thread details.
struct _DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET * PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET
struct _DEBUGGER_PAGE_IN_REQUEST * PDEBUGGER_PAGE_IN_REQUEST
enum _DEBUGGER_REMOTE_STEPPING_REQUEST DEBUGGER_REMOTE_STEPPING_REQUEST
stepping and tracking types
struct _HYPERTRACE_LBR_DUMP_PACKETS * PHYPERTRACE_LBR_DUMP_PACKETS
struct _DEBUGGER_EDIT_MEMORY * PDEBUGGER_EDIT_MEMORY
struct _DEBUGGER_READ_MEMORY * PDEBUGGER_READ_MEMORY
enum _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE
Debugger process switch and process details.
struct _DEBUGGEE_BP_LIST_OR_MODIFY_PACKET * PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET
struct _DEBUGGER_VA2PA_AND_PA2VA_COMMANDS * PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS
struct _INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS * PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS
struct _MODULE_SYMBOL_DETAIL * PMODULE_SYMBOL_DETAIL
BOOLEAN KdSendUserInputPacketToDebuggee(const CHAR *Sendbuf, INT Len, BOOLEAN IgnoreBreakingAgain)
Sends user input packet to the debuggee.
Definition kd.cpp:1295
PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendAddActionToEventPacketToDebuggee(PDEBUGGER_GENERAL_ACTION GeneralAction, UINT32 GeneralActionLength)
Send an add action to event request to the debuggee.
Definition kd.cpp:737
BOOLEAN KdSendReadMemoryPacketToDebuggee(PDEBUGGER_READ_MEMORY ReadMem, UINT32 RequestSize)
Send a Read memory packet to the debuggee.
Definition kd.cpp:597
BOOLEAN KdSendEventQueryAndModifyPacketToDebuggee(UINT64 Tag, DEBUGGER_MODIFY_EVENTS_TYPE TypeOfAction, BOOLEAN *IsEnabled)
Sends a query or request to enable/disable/clear for event.
Definition kd.cpp:265
VOID KdSendSymbolDetailPacket(PMODULE_SYMBOL_DETAIL SymbolDetailPacket, UINT32 CurrentSymbolInfoIndex, UINT32 TotalSymbols)
Send each packet of debugging information (PDB) to the debugger.
Definition kd.cpp:3424
BOOLEAN KdSendListOrModifyPacketToDebuggee(PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET ListOrModifyPacket)
Sends a breakpoint list or modification packet to the debuggee.
Definition kd.cpp:1198
BOOLEAN KdPrepareAndConnectDebugPort(const CHAR *PortName, DWORD Baudrate, UINT32 Port, BOOLEAN IsPreparing, BOOLEAN IsNamedPipe, BOOLEAN PauseAfterConnection)
Prepare and initialize COM port.
Definition kd.cpp:2468
BOOLEAN KdRegisterEventInDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL EventRegBuffer, UINT32 Length)
Register an event in the debuggee.
Definition kd.cpp:3144
BOOLEAN KdSendQueryIdtPacketsToDebuggee(PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtRequest)
Send requests for IDT packet to the debuggee.
Definition kd.cpp:1135
BOOLEAN KdSendSmiPacketsToDebuggee(PSMI_OPERATION_PACKETS SmiOperationRequest, UINT32 ExpectedRequestSize)
Send requests for SMI operation packet to the debuggee.
Definition kd.cpp:1031
BOOLEAN KdSendPageinPacketToDebuggee(PDEBUGGER_PAGE_IN_REQUEST PageinPacket)
Sends a page-in or '.pagein' command packet to the debuggee.
Definition kd.cpp:936
BOOLEAN KdSendVa2paAndPa2vaPacketToDebuggee(PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS Va2paAndPa2vaPacket)
Sends VA2PA and PA2VA packest, or '!va2pa' and '!pa2va' commands packet to the debuggee.
Definition kd.cpp:965
BOOLEAN KdSendModifyEventInDebuggee(PDEBUGGER_MODIFY_EVENTS ModifyEvent, BOOLEAN SendTheResultBackToDebugger)
Modify the event ioctl in the debuggee.
Definition kd.cpp:3248
BOOLEAN KdSendSymbolReloadPacketToDebuggee(UINT32 ProcessId)
Send symbol reload packet to the debuggee.
Definition kd.cpp:493
VOID KdBreakControlCheckAndContinueDebugger()
check if the debuggee needs to be continued
Definition kd.cpp:2091
BOOLEAN KdSendFlushPacketToDebuggee()
Send a flush request to the debuggee.
Definition kd.cpp:314
BOOLEAN KdSendTestQueryPacketToDebuggee(DEBUGGER_TEST_QUERY_STATE Type)
Send a test query request to the debuggee.
Definition kd.cpp:425
BOOLEAN KdSendPtePacketToDebuggee(PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PtePacket)
Sends a PTE or '!pte' command packet to the debuggee.
Definition kd.cpp:907
BYTE KdComputeDataChecksum(PVOID Buffer, UINT32 Length)
calculate the checksum of received buffer from debugger
Definition Kd.c:275
BOOLEAN KdSendStepPacketToDebuggee(DEBUGGER_REMOTE_STEPPING_REQUEST StepRequestType)
Sends p (step out) and t (step in) packet to the debuggee.
Definition kd.cpp:1381
BOOLEAN KdCloseConnection()
Send close packet to the debuggee and debugger.
Definition kd.cpp:3056
VOID KdBreakControlCheckAndPauseDebugger(BOOLEAN SignalRunningFlag)
check if the debuggee needs to be paused
Definition kd.cpp:2040
BOOLEAN KdReceivePacketFromDebugger(CHAR *BufferToSave, UINT32 *LengthReceived)
Receive packet from the debugger.
Definition kd.cpp:1661
BOOLEAN KdSendSwitchThreadPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType, UINT32 NewTid, UINT64 NewThread, BOOLEAN CheckByClockInterrupt, PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS SymDetailsForThreadList)
Sends a change thread or show threads detail packet to the debuggee.
Definition kd.cpp:858
BOOLEAN KdCheckForTheEndOfTheBuffer(PUINT32 CurrentLoopIndex, BYTE *Buffer)
compares the buffer with a string
Definition kd.cpp:56
VOID KdSetStatusAndWaitForPause()
Set the status of the debuggee to wait for the pause.
Definition kd.cpp:2072
BOOLEAN KdCommandPacketToDebuggee(DEBUGGER_REMOTE_PACKET_TYPE PacketType, DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction)
Sends a HyperDbg packet to the debuggee.
Definition kd.cpp:1923
BOOLEAN KdSendResponseOfThePingPacket()
Respond to the debuggee with the version and build date of the debugger.
Definition kd.cpp:2121
BOOLEAN KdSendPcitreePacketToDebuggee(PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET PcitreePacket)
Sends '!pcitree' command, including buffer, to the debuggee.
Definition kd.cpp:3592
BOOLEAN KdSendSearchRequestPacketToDebuggee(UINT64 *SearchRequestBuffer, UINT32 SearchRequestBufferSize)
Sends search query request packet to the debuggee.
Definition kd.cpp:1353
VOID KdTheRemoteSystemIsRunning()
wait for a event to be triggered and if the debuggee is running it just halts the system
Definition kd.cpp:2151
BOOLEAN KdSendPcidevinfoPacketToDebuggee(PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET PcidevinfoPacket)
Request PCI device info (CAM). Current consumers include '!pcicam'.
Definition kd.cpp:3621
BOOLEAN KdSendScriptPacketToDebuggee(UINT64 BufferAddress, UINT32 BufferLength, UINT32 Pointer, BOOLEAN IsFormat)
Sends a script packet to the debuggee.
Definition kd.cpp:1231
BOOLEAN KdSendTestQueryPacketWithContextToDebuggee(DEBUGGER_TEST_QUERY_STATE Type, UINT64 Context)
Send a test query request to the debuggee with the specified context.
Definition kd.cpp:460
PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendRegisterEventPacketToDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL Event, UINT32 EventBufferLength)
Send a register event request to the debuggee.
Definition kd.cpp:670
VOID KdHandleUserInputInDebuggee(DEBUGGEE_USER_INPUT_PACKET *Descriptor)
Handle user-input in debuggee.
Definition kd.cpp:3308
BOOLEAN KdSendShortCircuitingEventToDebuggee(BOOLEAN IsEnabled)
Sends a short-circuiting event request to debuggee.
Definition kd.cpp:226
BOOLEAN KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType, UINT32 NewPid, UINT64 NewProcess, BOOLEAN SetChangeByClockInterrupt, PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS SymDetailsForProcessList)
Sends a change process or show process details packet to the debuggee.
Definition kd.cpp:805
BOOLEAN KdReceivePacketFromDebuggee(CHAR *BufferToSave, UINT32 *LengthReceived)
Receive packet from the debuggee.
Definition kd.cpp:1558
VOID KdUninitializeConnection()
Uninitialize everything in both debuggee and debugger.
Definition kd.cpp:3474
BOOLEAN KdReloadSymbolsInDebuggee(BOOLEAN PauseDebuggee, UINT32 UserProcessId)
Send the packets of reloading symbols to build a new symbol table to the debugger and send the finish...
Definition kd.cpp:3015
VOID KdSendUsermodePrints(CHAR *Input, UINT32 Length)
Send result of user-mode ShowMessages to debuggee.
Definition kd.cpp:3364
BOOLEAN KdSendReadRegisterPacketToDebuggee(PDEBUGGEE_REGISTER_READ_DESCRIPTION RegDes, UINT32 RegBuffSize)
Send a read register packet to the debuggee.
Definition kd.cpp:527
BOOLEAN KdSendApicActionPacketsToDebuggee(PDEBUGGER_APIC_REQUEST ApicRequest, UINT32 ExpectedRequestSize)
Send requests for APIC packet to the debuggee.
Definition kd.cpp:995
BOOLEAN KdSendEditMemoryPacketToDebuggee(PDEBUGGER_EDIT_MEMORY EditMem, UINT32 Size)
Send an Edit memory packet to the debuggee.
Definition kd.cpp:633
BOOLEAN KdCommandPacketAndBufferToDebuggee(DEBUGGER_REMOTE_PACKET_TYPE PacketType, DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction, CHAR *Buffer, UINT32 BufferLength)
Sends a HyperDbg packet + a buffer to the debuggee.
Definition kd.cpp:1970
BOOLEAN KdSendHyperTraceLbrdumpPacketsToDebuggee(PHYPERTRACE_LBR_DUMP_PACKETS HyperTraceLbrdumpRequest, UINT32 ExpectedRequestSize)
Send requests for HyperTrace LBR dump packet to the debuggee.
Definition kd.cpp:1066
BOOLEAN KdSendGeneralBuffersFromDebuggeeToDebugger(DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction, PVOID Buffer, UINT32 BufferLength, BOOLEAN PauseDebuggeeWhenSent)
Send general buffer from debuggee to debugger.
Definition kd.cpp:2911
BOOLEAN KdSendHyperTracePtPacketsToDebuggee(PHYPERTRACE_PT_OPERATION_PACKETS HyperTracePtOperationRequest, UINT32 ExpectedRequestSize)
Send requests for HyperTrace PT operation packet to the debuggee.
Definition kd.cpp:1101
BOOLEAN KdPrepareSerialConnectionToRemoteSystem(HANDLE SerialHandle, BOOLEAN IsNamedPipe, BOOLEAN PauseAfterConnection)
Prepare serial to connect to the remote server.
Definition kd.cpp:2175
BOOLEAN KdAddActionToEventInDebuggee(PDEBUGGER_GENERAL_ACTION ActionAddingBuffer, UINT32 Length)
Add action to an event in the debuggee.
Definition kd.cpp:3198
BOOLEAN KdSendBpPacketToDebuggee(PDEBUGGEE_BP_PACKET BpPacket)
Sends a breakpoint set or 'bp' command packet to the debuggee.
Definition kd.cpp:1169
BOOLEAN KdSendPacketToDebuggee(const CHAR *Buffer, UINT32 Length, BOOLEAN SendEndOfBuffer)
Sends a special packet to the debuggee.
Definition kd.cpp:1783
BOOLEAN KdSendWriteRegisterPacketToDebuggee(PDEBUGGEE_REGISTER_WRITE_DESCRIPTION RegDes)
Send a write register packet to the debuggee.
Definition kd.cpp:562
BOOLEAN KdSendSwitchCorePacketToDebuggee(UINT32 NewCore)
Sends a change core or '~ x' command packet to the debuggee.
Definition kd.cpp:181
BOOLEAN KdSendCallStackPacketToDebuggee(UINT64 BaseAddress, UINT32 Size, DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod, BOOLEAN Is32Bit)
Send a callstack request to the debuggee.
Definition kd.cpp:348