libhyperdbg.cpp File Reference

Main interface to connect applications to driver. More...

#include "pch.h"

Functions
INT	HyperDbgStartDriver ()
	Install (start) VMM driver.
INT	HyperDbgStopDriver (LPCTSTR DriverName)
	Stop the driver.
INT	HyperDbgInstallKdDriver ()
	Install KD (Kernel Debugger) driver.
INT	HyperDbgStartKdDriver ()
	Start KD driver.
INT	HyperDbgStopKdDriver ()
	Stop KD driver.
INT	HyperDbgUninstallDriver (LPCTSTR DriverName)
	Remove the driver.
INT	HyperDbgUninstallKdDriver ()
	Remove the KD (Kernel Debugger) driver.
INT	HyperDbgInitHyperTraceModule ()
	Initialize VMM module.
INT	HyperDbgInitVmmModule ()
	Initialize VMM module.
INT	HyperDbgCreateHandleFromKdModule ()
	Create handle from KD (HyperKD) module.
INT	HyperDbgUnloadVmm ()
	Unload VMM module.
INT	HyperDbgUnloadHyperTrace ()
	Unload HyperTrace module.
INT	HyperDbgUnloadKd ()
	Unload KD driver.
BOOLEAN	HyperDbgIsAnyModuleLoaded ()
	check if any module is loaded (KD, VMM, HyperTrace, etc.)
INT	HyperDbgUnloadAllModules ()
	unload all modules (KD, VMM, HyperTrace, etc.)
INT	HyperDbgLoadKdModule ()
	load kd module
GENERIC_PROCESSOR_VENDOR	HyperDbgGetProcessorVendor ()
	Get the vendor of the current processor.
INT	HyperDbgLoadVmmModule ()
	load vmm module
INT	HyperDbgLoadHyperTraceModule ()
	load hypertrace module
INT	HyperDbgLoadAllModules ()
	load all modules (KD, VMM, HyperTrace, etc.)

Variables
HANDLE	g_DeviceHandle
	Holds the global handle of device which is used to send the request to the kernel by IOCTL, this handle is not used for IRP Pending of message tracing this handle is used in KD VMM.
HANDLE	g_IsDriverLoadedSuccessfully
	Handle to show that if the debugger is loaded successfully.
BOOLEAN	g_IsMessageLoggingWindowClosed
	Shows whether the message logging window is closed or not.
TCHAR	g_DriverLocation [MAX_PATH]
	Holds the location driver to install it.
TCHAR	g_DriverName [MAX_PATH]
	Holds the name of the driver to install it.
BOOLEAN	g_UseCustomDriverLocation
	Whether the user wants to use a custom driver location or not.
LIST_ENTRY	g_EventTrace
	Holds a list of events in kernel and the state of events and the commands to show the state of each command (disabled/enabled).
BOOLEAN	g_IsKdModuleLoaded
	shows whether the kernel debugger (KD) module is loaded or not
BOOLEAN	g_IsVmmModuleLoaded
	shows whether the VMM module is loaded or not
BOOLEAN	g_IsHyperTraceModuleLoaded
	shows whether the HyperTrace module is loaded or not

Detailed Description

Main interface to connect applications to driver.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

HyperDbgCreateHandleFromKdModule()

INT HyperDbgCreateHandleFromKdModule

(

)

Create handle from KD (HyperKD) module.

Returns

INT return zero if it was successful or non-zero if there was error

lpSecurityAttirbutes

lpTemplateFile

{
    DWORD ErrorNum;
    DWORD ThreadId;
 
    if (g_DeviceHandle)
    {
        ShowMessages("handle of the driver found, if you use the 'load' command before, please "
                     "unload it using the 'unload' command\n");
        return 1;
    }
 
    //
    // Make sure that this variable is false, because it might be set to
    // true as the result of a previous load
    //
    g_IsMessageLoggingWindowClosed = FALSE;
 
    //
    // Init entering vmx
    //
    g_DeviceHandle = CreateFileA(
        "\\\\.\\HyperDbgDebuggerDevice",
        GENERIC_READ | GENERIC_WRITE,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL, 
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL); 
 
    if (g_DeviceHandle == INVALID_HANDLE_VALUE)
    {
        ErrorNum = GetLastError();
        if (ErrorNum == ERROR_ACCESS_DENIED)
        {
            ShowMessages("err, access denied\nare you sure you have administrator "
                         "rights?\n");
        }
        else if (ErrorNum == ERROR_GEN_FAILURE)
        {
            ShowMessages("err, a device attached to the system is not functioning\n"
                         "vmx feature might be disabled from BIOS or VBS/HVCI is active\n");
        }
        else
        {
            ShowMessages("err, CreateFile failed (%x)\n", ErrorNum);
        }
 
        g_DeviceHandle = NULL;
        return 1;
    }
 
    //
    // Initialize the list of events
    //
    InitializeListHead(&g_EventTrace);
 
#if !UseDbgPrintInsteadOfUsermodeMessageTracking
    HANDLE Thread = CreateThread(NULL, 0, IrpBasedBufferThread, NULL, 0, &ThreadId);
 
    // if (Thread)
    // {
    // ShowMessages("thread Created successfully\n");
    // }
 
#endif
 
    return 0;
}

HyperDbgGetProcessorVendor()

GENERIC_PROCESSOR_VENDOR HyperDbgGetProcessorVendor

(

)

Get the vendor of the current processor.

Returns

GENERIC_PROCESSOR_VENDOR the vendor of the processor

{
    CHAR CpuId[13] = {0};
 
    //
    // Read the vendor string
    //
    CpuReadVendorString(CpuId);
 
    // ShowMessages("current processor vendor is : %s\n", CpuId);
 
    if (strcmp(CpuId, "GenuineIntel") == 0)
    {
        return GENERIC_PROCESSOR_VENDOR_INTEL;
    }
    else if (strcmp(CpuId, "AuthenticAMD") == 0)
    {
        return GENERIC_PROCESSOR_VENDOR_AMD;
    }
    else
    {
        return GENERIC_PROCESSOR_VENDOR_OTHERS;
    }
}

HyperDbgInitHyperTraceModule()

INT HyperDbgInitHyperTraceModule

(

)

Initialize VMM module.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL                            Status;
    DWORD                           BytesReturned;
    DEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTracePacket = {0};
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    //
    // Send IOCTL to initialize HyperTrace module
    //
    Status = DeviceIoControl(g_DeviceHandle,                         // Handle to device
                             IOCTL_INIT_HYPERTRACE,                  // IO Control Code (IOCTL)
                             &InitHyperTracePacket,                  // Input Buffer to driver.
                             SIZEOF_DEBUGGER_INIT_HYPERTRACE_PACKET, // Length of input buffer in bytes.
                             &InitHyperTracePacket,                  // Output Buffer from driver.
                             SIZEOF_DEBUGGER_INIT_HYPERTRACE_PACKET, // Length of output buffer in bytes.
                             &BytesReturned,                         // Bytes placed in buffer.
                             NULL                                    // synchronous call
    );
 
    //
    // Check if the IOCTL was successful, if not show the error message and return
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // Check the kernel status
    //
    if (InitHyperTracePacket.KernelStatus != DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowErrorMessage(InitHyperTracePacket.KernelStatus);
        return 1;
    }
 
    return 0;
}

HyperDbgInitVmmModule()

INT HyperDbgInitVmmModule

(

)

Initialize VMM module.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL                     Status;
    DWORD                    BytesReturned;
    DEBUGGER_INIT_VMM_PACKET InitVmmPacket = {0};
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    //
    // Create event to show if the kd module is loaded or not
    //
    g_IsDriverLoadedSuccessfully = CreateEvent(NULL, FALSE, FALSE, NULL);
 
    //
    // Send IOCTL to initialize VMM module
    //
    Status = DeviceIoControl(g_DeviceHandle,                  // Handle to device
                             IOCTL_INIT_VMM,                  // IO Control Code (IOCTL)
                             &InitVmmPacket,                  // Input Buffer to driver.
                             SIZEOF_DEBUGGER_INIT_VMM_PACKET, // Length of input buffer in bytes.
                             &InitVmmPacket,                  // Output Buffer from driver.
                             SIZEOF_DEBUGGER_INIT_VMM_PACKET, // Length of output buffer in bytes.
                             &BytesReturned,                  // Bytes placed in buffer.
                             NULL                             // synchronous call
    );
 
    //
    // check if the IOCTL was successful, if not show the error message and return
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        CloseHandle(g_IsDriverLoadedSuccessfully);
        return 1;
    }
 
    //
    // Check the kernel status for early errors (e.g., HyperTrace already loaded)
    //
    if (InitVmmPacket.KernelStatus != DEBUGGER_OPERATION_WAS_SUCCESSFUL &&
        InitVmmPacket.KernelStatus != 0)
    {
        ShowErrorMessage(InitVmmPacket.KernelStatus);
        CloseHandle(g_IsDriverLoadedSuccessfully);
        return 1;
    }
 
    //
    // We wait for the first message from the kernel debugger to continue
    //
    WaitForSingleObject(
        g_IsDriverLoadedSuccessfully,
        INFINITE);
 
    //
    // No need to handle anymore
    //
    CloseHandle(g_IsDriverLoadedSuccessfully);
 
    //
    // VMM module is initialized at this point
    //
    return 0;
}

HyperDbgInstallKdDriver()

INT HyperDbgInstallKdDriver

(

)

Install KD (Kernel Debugger) driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    //
    // Check if the driver is already loaded, if that's the case, we shouldn't try to load it again
    //
    if (g_IsKdModuleLoaded)
    {
        //
        // The driver is already loaded, so we shouldn't try to load it again
        // but we can consider it as success and return zero
        //
        return 0;
    }
 
    //
    // The driver is not started yet so let us the install driver
    // First setup full path to driver name
    //
 
    //
    // If the user has not specified a custom driver location, then we
    // need to find the driver in the same directory as the executable
    //
    if (!g_UseCustomDriverLocation)
    {
        if (!SetupPathForFileName(KERNEL_DEBUGGER_DRIVER_NAME_AND_EXTENSION, g_DriverLocation, sizeof(g_DriverLocation), TRUE))
        {
            return 1;
        }
 
        //
        // Use default driver name
        //
        strcpy_s(g_DriverName, KERNEL_DEBUGGER_DRIVER_NAME);
    }
 
    if (HyperDbgStartDriver() != 0)
    {
        ShowMessages("unable to install KD driver\n");
 
        return 1;
    }
 
    return 0;
}

HyperDbgIsAnyModuleLoaded()

BOOLEAN HyperDbgIsAnyModuleLoaded

(

)

check if any module is loaded (KD, VMM, HyperTrace, etc.)

Returns

BOOLEAN return TRUE if any module is loaded, otherwise return FALSE

{
    INT RetVal = 0;
 
    //
    // Check if any module is loaded (KD, VMM, HyperTrace, etc.)
    //
    if (g_IsKdModuleLoaded || g_IsVmmModuleLoaded || g_IsHyperTraceModuleLoaded)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

HyperDbgLoadAllModules()

INT HyperDbgLoadAllModules

(

)

load all modules (KD, VMM, HyperTrace, etc.)

Returns

INT return zero if it was successful or non-zero if there was error

{
    INT RetVal = 0;
 
    //
    // Load KD module if not loaded
    //
    if (!g_IsKdModuleLoaded && HyperDbgLoadKdModule() != 0)
    {
        return 1;
    }
 
    //
    // Load VMM module if not loaded
    //
    if (!g_IsVmmModuleLoaded && HyperDbgLoadVmmModule() != 0)
    {
        return 1;
    }
 
    //
    // Load HyperTrace module if not loaded
    //
    if (!g_IsHyperTraceModuleLoaded && HyperDbgLoadHyperTraceModule() != 0)
    {
        return 1;
    }
 
    return 0;
}

HyperDbgLoadHyperTraceModule()

INT HyperDbgLoadHyperTraceModule

(

)

load hypertrace module

Returns

int return zero if it was successful or non-zero if there was error

{
    //
    // Check if the module is already loaded, if that's the case, we don't
    // need to handle anymore
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        //
        // Return zero to indicate that the module is loaded successfully,
        //  and we no need to re-load it anymore
        //
        return 0;
    }
 
    //
    // Enable Debug privilege to the current token
    //
    if (!WindowsSetDebugPrivilege())
    {
        ShowMessages("err, couldn't set debug privilege\n");
        return 1;
    }
 
    //
    // Check if the processor is a genuine Intel processor (required for HyperTrace)
    //
    if (HyperDbgGetProcessorVendor() != GENERIC_PROCESSOR_VENDOR_INTEL)
    {
        ShowMessages("err, this program is not designed to run in a non-Intel "
                     "environment as it needs Intel PT (Processor Trace) and Intel LBR "
                     "(Last Branch Record). It needs an Intel processor.\n");
        return 1;
    }
 
    //
    // Load the KD module and create handle to it
    //
    if (HyperDbgLoadKdModule() == 1)
    {
        return 1;
    }
 
    //
    // Initialize HyperTrace module
    //
    if (HyperDbgInitHyperTraceModule() == 1)
    {
        ShowMessages("err, initializing hypertrace module\n");
 
        return 1;
    }
 
    //
    // If we reach here so the module are loaded
    //
    g_IsHyperTraceModuleLoaded = TRUE;
 
    ShowMessages("hypertrace (trace) module is running...\n");
 
    return 0;
}

HyperDbgLoadKdModule()

INT HyperDbgLoadKdModule

(

)

load kd module

Returns

int return zero if it was successful or non-zero if there

{
    //
    // Check if the module is already loaded, if that's the case, we don't
    // need to handle anymore
    //
    if (g_IsKdModuleLoaded)
    {
        //
        // Return zero to indicate that the module is loaded successfully,
        //  and we no need to re-load it anymore
        //
        return 0;
    }
 
    //
    // Enable Debug privilege to the current token
    //
    if (!WindowsSetDebugPrivilege())
    {
        ShowMessages("err, couldn't set debug privilege\n");
        return 1;
    }
 
    //
    // Create handle from the KD module
    //
    if (HyperDbgCreateHandleFromKdModule() == 1)
    {
        //
        // No need to handle anymore
        //
        return 1;
    }
 
    //
    // KD module is loaded at this point
    //
 
    //
    // If we reach here so the module are loaded
    //
    g_IsKdModuleLoaded = TRUE;
 
    return 0;
}

HyperDbgLoadVmmModule()

INT HyperDbgLoadVmmModule

(

)

load vmm module

Returns

int return zero if it was successful or non-zero if there

{
    //
    // Check if the module is already loaded, if that's the case, we don't
    // need to handle anymore
    //
    if (g_IsVmmModuleLoaded)
    {
        //
        // Return zero to indicate that the module is loaded successfully,
        //  and we no need to re-load it anymore
        //
        return 0;
    }
 
    //
    // Check if the HyperTrace module is loaded or not
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        ShowMessages(
            "err, the trace module is currently loaded and should be unloaded before loading the vmm module\n"
            "Note that HyperTrace (trace) uses the hypervisor (vmm) features when it is loaded after the vmm module, "
            "however, HyperTrace can also operate without the vmm module, although hypervisor-specific features will not be available\n"
            "to solve this problem, first unload the trace module using the 'unload trace' command, next, load "
            "the vmm module and then load the trace module again. This way, the trace module is reloaded with hypervisor APIs\n");
        return 1;
    }
 
    //
    // Check if the processor is a genuine Intel processor (required for VT-x)
    //
    if (HyperDbgGetProcessorVendor() != GENERIC_PROCESSOR_VENDOR_INTEL)
    {
        ShowMessages("err, this program is not designed to run in a non-VT-x "
                     "environment. It needs an Intel processor.\n");
        return 1;
    }
 
    ShowMessages("virtualization technology is vt-x\n");
 
    if (VmxSupportDetection())
    {
        ShowMessages("vmx operation is supported by your processor\n");
    }
    else
    {
#ifdef HYPERDBG_ENV_WINDOWS
        ShowMessages("vmx operation is not supported by your processor "
                     "(if you are using an Intel processor, it might be because VBS is not disabled!)\n");
#endif
        return 1;
    }
 
    //
    // Load the KD module and create handle to it
    //
    if (HyperDbgLoadKdModule() == 1)
    {
        return 1;
    }
 
    //
    // Initialize VMM module
    //
    if (HyperDbgInitVmmModule() == 1)
    {
        ShowMessages("err, initializing VMM module\n");
 
        return 1;
    }
 
    //
    // If we reach here so the module are loaded
    //
    g_IsVmmModuleLoaded = TRUE;
 
    ShowMessages("vmm module is running...\n");
 
    return 0;
}

HyperDbgStartDriver()

INT HyperDbgStartDriver

(

)

Install (start) VMM driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    if (!ManageDriver(g_DriverName, g_DriverLocation, DRIVER_FUNC_INSTALL))
    {
        //
        // Error - remove driver
        //
        ManageDriver(g_DriverName, g_DriverLocation, DRIVER_FUNC_REMOVE);
 
        return 1;
    }
 
    return 0;
}

HyperDbgStartKdDriver()

INT HyperDbgStartKdDriver

(

)

Start KD driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    return HyperDbgStartDriver();
}

HyperDbgStopDriver()

INT HyperDbgStopDriver

(

LPCTSTR

DriverName

)

Stop the driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    //
    // Unload the driver if loaded
    //
    if (g_DriverLocation[0] != (TCHAR)0 && ManageDriver(DriverName, g_DriverLocation, DRIVER_FUNC_STOP))
    {
        return 0;
    }
    else
    {
        return 1;
    }
}

HyperDbgStopKdDriver()

INT HyperDbgStopKdDriver

(

)

Stop KD driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    return HyperDbgStopDriver(g_DriverName);
}

HyperDbgUninstallDriver()

INT HyperDbgUninstallDriver

(

LPCTSTR

DriverName

)

Remove the driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    //
    // Unload the driver if loaded.  Ignore any errors
    //
    if (g_DriverLocation[0] != (TCHAR)0 && ManageDriver(DriverName, g_DriverLocation, DRIVER_FUNC_REMOVE))
    {
        return 0;
    }
    else
    {
        return 1;
    }
}

HyperDbgUninstallKdDriver()

INT HyperDbgUninstallKdDriver

(

)

Remove the KD (Kernel Debugger) driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    return HyperDbgUninstallDriver(g_DriverName);
}

HyperDbgUnloadAllModules()

INT HyperDbgUnloadAllModules

(

)

unload all modules (KD, VMM, HyperTrace, etc.)

Returns

INT return zero if it was successful or non-zero if there was error

{
    INT RetVal = 0;
 
    //
    // Unload HyperTrace module if loaded
    //
    if (g_IsHyperTraceModuleLoaded && HyperDbgUnloadHyperTrace() != 0)
    {
        return 1;
    }
 
    //
    // Unload VMM module if loaded
    //
    if (g_IsVmmModuleLoaded && HyperDbgUnloadVmm() != 0)
    {
        return 1;
    }
 
    //
    // Unload KD module if loaded
    //
    if (g_IsKdModuleLoaded && HyperDbgUnloadKd() != 0)
    {
        return 1;
    }
 
    return 0;
}

HyperDbgUnloadHyperTrace()

INT HyperDbgUnloadHyperTrace

(

)

Unload HyperTrace module.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL  Status;
    DWORD BytesReturned;
 
    AssertShowMessageReturnStmt(g_IsHyperTraceModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_HYPERTRACE_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    ShowMessages("start terminating trace module...\n");
 
    //
    // Send IOCTL to unload HyperTrace module
    //
    Status = DeviceIoControl(g_DeviceHandle,                  // Handle to device
                             IOCTL_PERFORM_HYPERTRACE_UNLOAD, // IO Control Code (IOCTL)
                             NULL,                            // Input Buffer to driver.
                             0,                               // Length of input buffer in bytes. (x 2 is bcuz
                                                              // as the driver is x64 and has 64 bit values)
                             NULL,                            // Output Buffer from driver.
                             0,                               // Length of output buffer in bytes.
                             &BytesReturned,                  // Bytes placed in buffer.
                             NULL                             // synchronous call
    );
 
    //
    // wait to make sure we don't use an invalid handle in another Ioctl
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // HyperTrace module is not loaded anymore
    //
    g_IsHyperTraceModuleLoaded = FALSE;
 
    ShowMessages("the trace module is unloaded!\n");
 
    return 0;
}

HyperDbgUnloadKd()

INT HyperDbgUnloadKd

(

)

Unload KD driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL  Status;
    DWORD BytesReturned;
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    //
    // Check if HyperTrace module is loaded, if so we need to unload it before unloading KD because KD is used by HyperTrace
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        ShowMessages("err, unable to unload the kd module because the trace module is currently loaded "
                     "and uses the kd module, if you want to unload the kd module, please first unload "
                     "the trace module using the 'unload trace' command\n");
        return 1;
    }
 
    //
    // Check if VMM module is loaded, if so we need to unload it before unloading KD because KD is used by VMM
    //
    if (g_IsVmmModuleLoaded)
    {
        ShowMessages("err, unable to unload the kd module because the vmm module is currently loaded "
                     "and uses the kd module, if you want to unload the kd module, please first unload "
                     "the vmm module using the 'unload vmm' command\n");
        return 1;
    }
 
    //
    // Indicate that the message logging window is closed
    //
    g_IsMessageLoggingWindowClosed = TRUE;
 
    //
    // Send IOCTL to mark complete all IRP Pending
    //
    Status = DeviceIoControl(
        g_DeviceHandle,                                      // Handle to device
        IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL, // IO Control Code (IOCTL)
        NULL,                                                // Input Buffer to driver.
        0,                                                   // Length of input buffer in bytes. (x 2 is bcuz as the
                                                             // driver is x64 and has 64 bit values)
        NULL,                                                // Output Buffer from driver.
        0,                                                   // Length of output buffer in bytes.
        &BytesReturned,                                      // Bytes placed in buffer.
        NULL                                                 // synchronous call
    );
 
    //
    // wait to make sure we don't use an invalid handle in another Ioctl
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // Wait for a while to make sure that all IRP pending are completed and the driver is ready to be unloaded
    //
    Sleep(1000);
 
    //
    // Send IRP_MJ_CLOSE to driver to terminate Vmxs
    //
    if (!CloseHandle(g_DeviceHandle))
    {
        ShowMessages("err, closing handle 0x%x\n", GetLastError());
        return 1;
    };
 
    //
    // Null the handle to indicate that the driver's device is not ready
    // to use
    //
    g_DeviceHandle = NULL;
 
    //
    // Debugger module is not loaded anymore
    //
    g_IsKdModuleLoaded = FALSE;
 
    //
    // Check if we found an already built symbol table
    //
    SymbolDeleteSymTable();
 
    ShowMessages("the debugger module is unloaded!\n");
 
    return 0;
}

HyperDbgUnloadVmm()

INT HyperDbgUnloadVmm

(

)

Unload VMM module.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL  Status;
    DWORD BytesReturned;
 
    AssertShowMessageReturnStmt(g_IsVmmModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_VMM_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    ShowMessages("start terminating vmm...\n");
 
    //
    // Check if HyperTrace module is loaded, if so we need to unload it before unloading VMM
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        ShowMessages(
            "the trace module is currently loaded and will be unloaded before the vmm module\nnote that hypertrace (trace) "
            "use the hypervisor (vmm) features when it is loaded after vmm, however, hypertrace can also operate without the vmm "
            "module, although hypervisor-specific features will not be available\n"
            "the 'trace' module will now be unloaded automatically. You can reload it later "
            "using the command 'load trace', which will load the trace module again without enabling hypervisor-dependent features\n");
 
        HyperDbgUnloadHyperTrace();
    }
 
    //
    // Uninitialize the user debugger if it's initialized
    //
    UdUninitializeUserDebugger();
 
    //
    // Send IOCTL terminate VMX
    //
    Status = DeviceIoControl(g_DeviceHandle,      // Handle to device
                             IOCTL_TERMINATE_VMX, // IO Control Code (IOCTL)
                             NULL,                // Input Buffer to driver.
                             0,                   // Length of input buffer in bytes. (x 2 is bcuz
                                                  // as the driver is x64 and has 64 bit values)
                             NULL,                // Output Buffer from driver.
                             0,                   // Length of output buffer in bytes.
                             &BytesReturned,      // Bytes placed in buffer.
                             NULL                 // synchronous call
    );
 
    //
    // wait to make sure we don't use an invalid handle in another Ioctl
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // Hypervisor (VMM) module is not loaded anymore
    //
    g_IsVmmModuleLoaded = FALSE;
 
    ShowMessages("you're not on HyperDbg's hypervisor anymore!\n");
 
    return 0;
}

Variable Documentation

g_DeviceHandle

HANDLE g_DeviceHandle

extern

Holds the global handle of device which is used to send the request to the kernel by IOCTL, this handle is not used for IRP Pending of message tracing this handle is used in KD VMM.

g_DriverLocation

TCHAR g_DriverLocation[MAX_PATH]

extern

Holds the location driver to install it.

{0};

g_DriverName

TCHAR g_DriverName[MAX_PATH]

extern

Holds the name of the driver to install it.

{0};

g_EventTrace

LIST_ENTRY g_EventTrace

extern

Holds a list of events in kernel and the state of events and the commands to show the state of each command (disabled/enabled).

this list is not have any relation with the things that HyperDbg holds for each event in the kernel

{0};

g_IsDriverLoadedSuccessfully

HANDLE g_IsDriverLoadedSuccessfully

extern

Handle to show that if the debugger is loaded successfully.

g_IsHyperTraceModuleLoaded

BOOLEAN g_IsHyperTraceModuleLoaded

extern

shows whether the HyperTrace module is loaded or not

g_IsKdModuleLoaded

BOOLEAN g_IsKdModuleLoaded

extern

shows whether the kernel debugger (KD) module is loaded or not

g_IsMessageLoggingWindowClosed

BOOLEAN g_IsMessageLoggingWindowClosed

extern

Shows whether the message logging window is closed or not.

g_IsVmmModuleLoaded

BOOLEAN g_IsVmmModuleLoaded

extern

shows whether the VMM module is loaded or not

g_UseCustomDriverLocation

BOOLEAN g_UseCustomDriverLocation

extern

Whether the user wants to use a custom driver location or not.