libhyperdbg.h File Reference

headers for libhyperdbg More...

Go to the source code of this file.

Functions
BOOLEAN	HyperDbgIsAnyModuleLoaded ()
	check if any module is loaded (KD, VMM, HyperTrace, etc.)
INT	HyperDbgUnloadAllModules ()
	unload all modules (KD, VMM, HyperTrace, etc.)
INT	HyperDbgInitHyperTraceModule ()
	Initialize VMM module.
INT	HyperDbgUnloadVmm ()
	Unload VMM module.
INT	HyperDbgUnloadHyperTrace ()
	Unload HyperTrace module.
INT	HyperDbgUnloadKd ()
	Unload KD driver.
INT	HyperDbgInstallKdDriver ()
	Install KD (Kernel Debugger) driver.
INT	HyperDbgUninstallKdDriver ()
	Remove the KD (Kernel Debugger) driver.
INT	HyperDbgLoadKdModule ()
	load kd module
INT	HyperDbgLoadVmmModule ()
	load vmm module
INT	HyperDbgLoadHyperTraceModule ()
	load hypertrace module
INT	HyperDbgLoadAllModules ()
	load all modules (KD, VMM, HyperTrace, etc.)
INT	HyperDbgStartKdDriver ()
	Start KD driver.
INT	HyperDbgStopKdDriver ()
	Stop KD driver.
INT	HyperDbgInterpreter (CHAR *Command)
	Interpret commands.
INT	HyperDbgScriptReadFileAndExecuteCommandline (INT argc, CHAR *argv[])
	Parsing the command line options for scripts.
GENERIC_PROCESSOR_VENDOR	HyperDbgGetProcessorVendor ()
	Get the vendor of the current processor.
BOOLEAN	HyperDbgTestCommandParser (CHAR *Command, UINT32 NumberOfTokens, CHAR **TokensList, UINT32 *FailedTokenNum, UINT32 *FailedTokenPosition)
	Parse the command (used for testing purposes).
VOID	HyperDbgTestCommandParserShowTokens (CHAR *Command)
	Parse the command and show tokens (used for testing purposes).
VOID	HyperDbgShowSignature ()
	Show signature of HyperDbg.

Detailed Description

headers for libhyperdbg

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.10

Date

2024-06-24

Copyright

This project is released under the GNU Public License v3.

Function Documentation

HyperDbgGetProcessorVendor()

GENERIC_PROCESSOR_VENDOR HyperDbgGetProcessorVendor

(

)

Get the vendor of the current processor.

Returns

GENERIC_PROCESSOR_VENDOR the vendor of the processor

{
    CHAR CpuId[13] = {0};
 
    //
    // Read the vendor string
    //
    CpuReadVendorString(CpuId);
 
    // ShowMessages("current processor vendor is : %s\n", CpuId);
 
    if (strcmp(CpuId, "GenuineIntel") == 0)
    {
        return GENERIC_PROCESSOR_VENDOR_INTEL;
    }
    else if (strcmp(CpuId, "AuthenticAMD") == 0)
    {
        return GENERIC_PROCESSOR_VENDOR_AMD;
    }
    else
    {
        return GENERIC_PROCESSOR_VENDOR_OTHERS;
    }
}

HyperDbgInitHyperTraceModule()

INT HyperDbgInitHyperTraceModule

(

)

Initialize VMM module.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL                            Status;
    DWORD                           BytesReturned;
    DEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTracePacket = {0};
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    //
    // Send IOCTL to initialize HyperTrace module
    //
    Status = DeviceIoControl(g_DeviceHandle,                         // Handle to device
                             IOCTL_INIT_HYPERTRACE,                  // IO Control Code (IOCTL)
                             &InitHyperTracePacket,                  // Input Buffer to driver.
                             SIZEOF_DEBUGGER_INIT_HYPERTRACE_PACKET, // Length of input buffer in bytes.
                             &InitHyperTracePacket,                  // Output Buffer from driver.
                             SIZEOF_DEBUGGER_INIT_HYPERTRACE_PACKET, // Length of output buffer in bytes.
                             &BytesReturned,                         // Bytes placed in buffer.
                             NULL                                    // synchronous call
    );
 
    //
    // Check if the IOCTL was successful, if not show the error message and return
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // Check the kernel status
    //
    if (InitHyperTracePacket.KernelStatus != DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowErrorMessage(InitHyperTracePacket.KernelStatus);
        return 1;
    }
 
    return 0;
}

HyperDbgInstallKdDriver()

INT HyperDbgInstallKdDriver

(

)

Install KD (Kernel Debugger) driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    //
    // Check if the driver is already loaded, if that's the case, we shouldn't try to load it again
    //
    if (g_IsKdModuleLoaded)
    {
        //
        // The driver is already loaded, so we shouldn't try to load it again
        // but we can consider it as success and return zero
        //
        return 0;
    }
 
    //
    // The driver is not started yet so let us the install driver
    // First setup full path to driver name
    //
 
    //
    // If the user has not specified a custom driver location, then we
    // need to find the driver in the same directory as the executable
    //
    if (!g_UseCustomDriverLocation)
    {
        if (!SetupPathForFileName(KERNEL_DEBUGGER_DRIVER_NAME_AND_EXTENSION, g_DriverLocation, sizeof(g_DriverLocation), TRUE))
        {
            return 1;
        }
 
        //
        // Use default driver name
        //
        strcpy_s(g_DriverName, KERNEL_DEBUGGER_DRIVER_NAME);
    }
 
    if (HyperDbgStartDriver() != 0)
    {
        ShowMessages("unable to install KD driver\n");
 
        return 1;
    }
 
    return 0;
}

HyperDbgInterpreter()

INT HyperDbgInterpreter

(

CHAR *

Command

)

Interpret commands.

Parameters

Command

The text of command

Returns

INT returns return zero if it was successful or non-zero if there was error

{
    BOOLEAN               HelpCommand       = FALSE;
    UINT64                CommandAttributes = NULL;
    CommandType::iterator Iterator;
    CommandParser         Parser;
 
    //
    // Check if it's the first command and whether the mapping of command is
    // initialized or not
    //
    if (!g_IsCommandListInitialized)
    {
        //
        // Initialize the debugger
        //
        InitializeDebugger();
 
        g_IsCommandListInitialized = TRUE;
    }
 
    //
    // Save the command into log open file
    //
    if (g_LogOpened && !g_ExecutingScript)
    {
        LogopenSaveToFile(Command);
        LogopenSaveToFile("\n");
    }
 
    //
    // Convert to string
    //
    string CommandString(Command);
 
    //
    // Tokenize the command string
    //
    auto Tokens = Parser.Parse(CommandString);
 
    //
    // Print the tokens
    //
    // Parser.PrintTokens(Tokens);
 
    //
    // Check if user entered an empty input
    //
    if (Tokens.empty())
    {
        ShowMessages("\n");
        return 0;
    }
 
    //
    // Get the first command (lower case)
    //
    string FirstCommand = GetLowerStringFromCommandToken(Tokens.front());
 
    //
    // Read the command's attributes
    //
    CommandAttributes = GetCommandAttributes(FirstCommand);
 
    //
    // Check if the command needs to be continued by pressing enter
    //
    if (CommandAttributes & DEBUGGER_COMMAND_ATTRIBUTE_REPEAT_ON_ENTER)
    {
        g_ShouldPreviousCommandBeContinued = TRUE;
    }
    else
    {
        g_ShouldPreviousCommandBeContinued = FALSE;
    }
 
    //
    // Check and send remote command and also we check whether this
    // is a command that should be handled in this command or we can
    // send it to the remote computer, it is because in a remote connection
    // still some of the commands should be handled in the local HyperDbg
    //
    if (g_IsConnectedToRemoteDebuggee &&
        !(CommandAttributes & DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_REMOTE_CONNECTION))
    {
        //
        // Check it here because generally, we use this variable in host
        // for showing the correct signature but we won't try to block
        // other commands, the only thing is events which is blocked
        // by the remote computer itself
        //
        if (g_BreakPrintingOutput)
        {
            g_BreakPrintingOutput = FALSE;
        }
 
        //
        // It's a connection over network (VMI-Mode)
        //
        RemoteConnectionSendCommand(Command, (UINT32)strlen(Command) + 1);
 
        ShowMessages("\n");
 
        //
        // Indicate that we sent the command to the target system
        //
        return 2;
    }
    else if (g_IsSerialConnectedToRemoteDebuggee &&
             !(CommandAttributes &
               DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE))
    {
        //
        // It's a connection over serial (Debugger-Mode)
        //
 
        if (CommandAttributes & DEBUGGER_COMMAND_ATTRIBUTE_WONT_STOP_DEBUGGER_AGAIN)
        {
            KdSendUserInputPacketToDebuggee(Command, (UINT32)strlen(Command) + 1, TRUE);
 
            //
            // Set the debuggee to show that it's running
            //
            KdSetStatusAndWaitForPause();
        }
        else
        {
            //
            // Disable the breakpoints and events while executing the command in the remote computer
            //
            KdSendTestQueryPacketToDebuggee(TEST_BREAKPOINT_TURN_OFF_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER);
            KdSendUserInputPacketToDebuggee(Command, (UINT32)strlen(Command) + 1, FALSE);
            KdSendTestQueryPacketToDebuggee(TEST_BREAKPOINT_TURN_ON_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER);
        }
 
        //
        // Indicate that we sent the command to the target system
        //
        return 2;
    }
 
    //
    // Detect whether it's a .help command or not
    //
    if (!FirstCommand.compare(".help") || !FirstCommand.compare("help") ||
        !FirstCommand.compare(".hh") || !FirstCommand.compare("!help"))
    {
        if (Tokens.size() == 2)
        {
            //
            // Show that it's a help command
            //
            HelpCommand  = TRUE;
            FirstCommand = GetLowerStringFromCommandToken(Tokens.at(1));
        }
        else
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Tokens.at(0)).c_str());
            CommandHelpHelp();
            return 0;
        }
    }
 
    //
    // Start parsing commands
    //
    string CaseSensitiveCommandString(Command);
    Iterator = g_CommandsList.find(FirstCommand);
 
    if (Iterator == g_CommandsList.end())
    {
        //
        //  Command doesn't exist
        //
        if (!HelpCommand)
        {
            ShowMessages("err, couldn't resolve command at '%s'\n",
                         GetCaseSensitiveStringFromCommandToken(Tokens.front()).c_str());
        }
        else
        {
            ShowMessages("err, couldn't find the help for the command at '%s'\n",
                         GetCaseSensitiveStringFromCommandToken(Tokens.at(1)).c_str());
        }
    }
    else
    {
        if (HelpCommand)
        {
            Iterator->second.CommandHelpFunction();
        }
        else
        {
            //
            // Call the parser with tokens
            //
            Iterator->second.CommandFunctionNewParser(Tokens, CaseSensitiveCommandString);
        }
    }
 
    //
    // Save the command into log open file
    //
    if (g_LogOpened && !g_ExecutingScript)
    {
        LogopenSaveToFile("\n");
    }
 
    return 0;
}

HyperDbgIsAnyModuleLoaded()

BOOLEAN HyperDbgIsAnyModuleLoaded

(

)

check if any module is loaded (KD, VMM, HyperTrace, etc.)

Returns

BOOLEAN return TRUE if any module is loaded, otherwise return FALSE

{
    INT RetVal = 0;
 
    //
    // Check if any module is loaded (KD, VMM, HyperTrace, etc.)
    //
    if (g_IsKdModuleLoaded || g_IsVmmModuleLoaded || g_IsHyperTraceModuleLoaded)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

HyperDbgLoadAllModules()

INT HyperDbgLoadAllModules

(

)

load all modules (KD, VMM, HyperTrace, etc.)

Returns

INT return zero if it was successful or non-zero if there was error

{
    INT RetVal = 0;
 
    //
    // Load KD module if not loaded
    //
    if (!g_IsKdModuleLoaded && HyperDbgLoadKdModule() != 0)
    {
        return 1;
    }
 
    //
    // Load VMM module if not loaded
    //
    if (!g_IsVmmModuleLoaded && HyperDbgLoadVmmModule() != 0)
    {
        return 1;
    }
 
    //
    // Load HyperTrace module if not loaded
    //
    if (!g_IsHyperTraceModuleLoaded && HyperDbgLoadHyperTraceModule() != 0)
    {
        return 1;
    }
 
    return 0;
}

HyperDbgLoadHyperTraceModule()

INT HyperDbgLoadHyperTraceModule

(

)

load hypertrace module

Returns

int return zero if it was successful or non-zero if there was error

{
    //
    // Check if the module is already loaded, if that's the case, we don't
    // need to handle anymore
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        //
        // Return zero to indicate that the module is loaded successfully,
        //  and we no need to re-load it anymore
        //
        return 0;
    }
 
    //
    // Enable Debug privilege to the current token
    //
    if (!WindowsSetDebugPrivilege())
    {
        ShowMessages("err, couldn't set debug privilege\n");
        return 1;
    }
 
    //
    // Check if the processor is a genuine Intel processor (required for HyperTrace)
    //
    if (HyperDbgGetProcessorVendor() != GENERIC_PROCESSOR_VENDOR_INTEL)
    {
        ShowMessages("err, this program is not designed to run in a non-Intel "
                     "environment as it needs Intel PT (Processor Trace) and Intel LBR "
                     "(Last Branch Record). It needs an Intel processor.\n");
        return 1;
    }
 
    //
    // Load the KD module and create handle to it
    //
    if (HyperDbgLoadKdModule() == 1)
    {
        return 1;
    }
 
    //
    // Initialize HyperTrace module
    //
    if (HyperDbgInitHyperTraceModule() == 1)
    {
        ShowMessages("err, initializing hypertrace module\n");
 
        return 1;
    }
 
    //
    // If we reach here so the module are loaded
    //
    g_IsHyperTraceModuleLoaded = TRUE;
 
    ShowMessages("hypertrace (trace) module is running...\n");
 
    return 0;
}

HyperDbgLoadKdModule()

INT HyperDbgLoadKdModule

(

)

load kd module

Returns

int return zero if it was successful or non-zero if there

{
    //
    // Check if the module is already loaded, if that's the case, we don't
    // need to handle anymore
    //
    if (g_IsKdModuleLoaded)
    {
        //
        // Return zero to indicate that the module is loaded successfully,
        //  and we no need to re-load it anymore
        //
        return 0;
    }
 
    //
    // Enable Debug privilege to the current token
    //
    if (!WindowsSetDebugPrivilege())
    {
        ShowMessages("err, couldn't set debug privilege\n");
        return 1;
    }
 
    //
    // Create handle from the KD module
    //
    if (HyperDbgCreateHandleFromKdModule() == 1)
    {
        //
        // No need to handle anymore
        //
        return 1;
    }
 
    //
    // KD module is loaded at this point
    //
 
    //
    // If we reach here so the module are loaded
    //
    g_IsKdModuleLoaded = TRUE;
 
    return 0;
}

HyperDbgLoadVmmModule()

INT HyperDbgLoadVmmModule

(

)

load vmm module

Returns

int return zero if it was successful or non-zero if there

{
    //
    // Check if the module is already loaded, if that's the case, we don't
    // need to handle anymore
    //
    if (g_IsVmmModuleLoaded)
    {
        //
        // Return zero to indicate that the module is loaded successfully,
        //  and we no need to re-load it anymore
        //
        return 0;
    }
 
    //
    // Check if the HyperTrace module is loaded or not
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        ShowMessages(
            "err, the trace module is currently loaded and should be unloaded before loading the vmm module\n"
            "Note that HyperTrace (trace) uses the hypervisor (vmm) features when it is loaded after the vmm module, "
            "however, HyperTrace can also operate without the vmm module, although hypervisor-specific features will not be available\n"
            "to solve this problem, first unload the trace module using the 'unload trace' command, next, load "
            "the vmm module and then load the trace module again. This way, the trace module is reloaded with hypervisor APIs\n");
        return 1;
    }
 
    //
    // Check if the processor is a genuine Intel processor (required for VT-x)
    //
    if (HyperDbgGetProcessorVendor() != GENERIC_PROCESSOR_VENDOR_INTEL)
    {
        ShowMessages("err, this program is not designed to run in a non-VT-x "
                     "environment. It needs an Intel processor.\n");
        return 1;
    }
 
    ShowMessages("virtualization technology is vt-x\n");
 
    if (VmxSupportDetection())
    {
        ShowMessages("vmx operation is supported by your processor\n");
    }
    else
    {
#ifdef HYPERDBG_ENV_WINDOWS
        ShowMessages("vmx operation is not supported by your processor "
                     "(if you are using an Intel processor, it might be because VBS is not disabled!)\n");
#endif
        return 1;
    }
 
    //
    // Load the KD module and create handle to it
    //
    if (HyperDbgLoadKdModule() == 1)
    {
        return 1;
    }
 
    //
    // Initialize VMM module
    //
    if (HyperDbgInitVmmModule() == 1)
    {
        ShowMessages("err, initializing VMM module\n");
 
        return 1;
    }
 
    //
    // If we reach here so the module are loaded
    //
    g_IsVmmModuleLoaded = TRUE;
 
    ShowMessages("vmm module is running...\n");
 
    return 0;
}

HyperDbgScriptReadFileAndExecuteCommandline()

INT HyperDbgScriptReadFileAndExecuteCommandline	(	INT	argc,
		CHAR *	argv[] )

Parsing the command line options for scripts.

Parameters

argc
argv

Returns

INT

{
    vector<string> Args;
 
    //
    // Convert it to the array
    //
    for (SIZE_T i = 2; i < argc; i++)
    {
        std::string TempStr(argv[i]);
        Args.push_back(TempStr);
    }
 
    //
    // Check if the target path and args for script is not empty
    //
    if (!Args.empty())
    {
        HyperDbgScriptReadFileAndExecuteCommand(Args);
        printf("\n");
    }
    else
    {
        printf("err, invalid command line options passed to the HyperDbg!\n");
        return FALSE;
    }
 
    return TRUE;
}

HyperDbgShowSignature()

VOID HyperDbgShowSignature

(

)

Show signature of HyperDbg.

Returns

VOID

{
    if (g_IsConnectedToRemoteDebuggee)
    {
        //
        // Remote debugging over tcp (vmi-mode)
        //
        ShowMessages("[%s:%s] HyperDbg> ", g_ServerIp.c_str(), g_ServerPort.c_str());
    }
    else if (g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Debugging a special process
        //
        ShowMessages("%x:%x %s u%sHyperDbg> ",
                     g_ActiveProcessDebuggingState.ProcessId,
                     g_ActiveProcessDebuggingState.ThreadId,
                     g_ActiveProcessDebuggingState.IsPaused ? "(paused)" : "(running)",
                     g_ActiveProcessDebuggingState.Is32Bit ? "86" : "64");
    }
    else if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Remote debugging over serial (debugger-mode)
        //
        ShowMessages("%x: kHyperDbg> ", g_CurrentRemoteCore);
    }
    else
    {
        //
        // Anything other than above scenarios including local debugging
        // in vmi-mode
        //
        ShowMessages("HyperDbg> ");
    }
}

HyperDbgStartKdDriver()

INT HyperDbgStartKdDriver

(

)

Start KD driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    return HyperDbgStartDriver();
}

HyperDbgStopKdDriver()

INT HyperDbgStopKdDriver

(

)

Stop KD driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    return HyperDbgStopDriver(g_DriverName);
}

HyperDbgTestCommandParser()

BOOLEAN HyperDbgTestCommandParser	(	CHAR *	Command,
		UINT32	NumberOfTokens,
		CHAR **	TokensList,
		UINT32 *	FailedTokenNum,
		UINT32 *	FailedTokenPosition )

Parse the command (used for testing purposes).

Parameters

Command	The text of command
NumberOfTokens	The number of tokens
TokensList	The tokens list
FailedTokenNum	The failed token number (if any)
FailedTokenPosition	The failed token position (if any)

Returns

BOOLEAN returns TRUE if the command was parsed successfully and FALSE if there was an error

{
    CommandParser Parser;
 
    //
    // Convert to string
    //
    string CommandString(Command);
 
    //
    // Tokenize the command string
    //
    std::vector<CommandToken> Tokens = Parser.Parse(CommandString);
 
    //
    // Check if the number of tokens is correct
    //
    if (Tokens.size() != NumberOfTokens)
    {
        ShowMessages("err, the number of tokens is not correct\n");
        return FALSE;
    }
 
    //
    // Check if the tokens are correct
    //
    for (UINT32 i = 0; i < Tokens.size(); i++)
    {
        auto Token = Tokens.at(i);
 
        auto CaseSensitiveText = std::get<1>(Token);
 
        if (strcmp(CaseSensitiveText.c_str(), TokensList[i]) != 0)
        {
            //
            // Set the failed token number
            //
            *FailedTokenNum      = i;
            *FailedTokenPosition = FindDifferencePosition(CaseSensitiveText.c_str(), TokensList[i]);
 
            ShowMessages("err, the token is not correct\n");
            return FALSE;
        }
    }
 
    //
    // Everything is correct
    //
    return TRUE;
}

HyperDbgTestCommandParserShowTokens()

VOID HyperDbgTestCommandParserShowTokens

(

CHAR *

Command

)

Parse the command and show tokens (used for testing purposes).

Parameters

Command

The text of command

Returns

VOID

{
    CommandParser Parser;
 
    //
    // Convert to string
    //
    string CommandString(Command);
 
    //
    // Tokenize the command string
    //
    std::vector<CommandToken> Tokens = Parser.Parse(CommandString);
 
    Parser.PrintTokens(Tokens);
}

HyperDbgUninstallKdDriver()

INT HyperDbgUninstallKdDriver

(

)

Remove the KD (Kernel Debugger) driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    return HyperDbgUninstallDriver(g_DriverName);
}

HyperDbgUnloadAllModules()

INT HyperDbgUnloadAllModules

(

)

unload all modules (KD, VMM, HyperTrace, etc.)

Returns

INT return zero if it was successful or non-zero if there was error

{
    INT RetVal = 0;
 
    //
    // Unload HyperTrace module if loaded
    //
    if (g_IsHyperTraceModuleLoaded && HyperDbgUnloadHyperTrace() != 0)
    {
        return 1;
    }
 
    //
    // Unload VMM module if loaded
    //
    if (g_IsVmmModuleLoaded && HyperDbgUnloadVmm() != 0)
    {
        return 1;
    }
 
    //
    // Unload KD module if loaded
    //
    if (g_IsKdModuleLoaded && HyperDbgUnloadKd() != 0)
    {
        return 1;
    }
 
    return 0;
}

HyperDbgUnloadHyperTrace()

INT HyperDbgUnloadHyperTrace

(

)

Unload HyperTrace module.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL  Status;
    DWORD BytesReturned;
 
    AssertShowMessageReturnStmt(g_IsHyperTraceModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_HYPERTRACE_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    ShowMessages("start terminating trace module...\n");
 
    //
    // Send IOCTL to unload HyperTrace module
    //
    Status = DeviceIoControl(g_DeviceHandle,                  // Handle to device
                             IOCTL_PERFORM_HYPERTRACE_UNLOAD, // IO Control Code (IOCTL)
                             NULL,                            // Input Buffer to driver.
                             0,                               // Length of input buffer in bytes. (x 2 is bcuz
                                                              // as the driver is x64 and has 64 bit values)
                             NULL,                            // Output Buffer from driver.
                             0,                               // Length of output buffer in bytes.
                             &BytesReturned,                  // Bytes placed in buffer.
                             NULL                             // synchronous call
    );
 
    //
    // wait to make sure we don't use an invalid handle in another Ioctl
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // HyperTrace module is not loaded anymore
    //
    g_IsHyperTraceModuleLoaded = FALSE;
 
    ShowMessages("the trace module is unloaded!\n");
 
    return 0;
}

HyperDbgUnloadKd()

INT HyperDbgUnloadKd

(

)

Unload KD driver.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL  Status;
    DWORD BytesReturned;
 
    AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    //
    // Check if HyperTrace module is loaded, if so we need to unload it before unloading KD because KD is used by HyperTrace
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        ShowMessages("err, unable to unload the kd module because the trace module is currently loaded "
                     "and uses the kd module, if you want to unload the kd module, please first unload "
                     "the trace module using the 'unload trace' command\n");
        return 1;
    }
 
    //
    // Check if VMM module is loaded, if so we need to unload it before unloading KD because KD is used by VMM
    //
    if (g_IsVmmModuleLoaded)
    {
        ShowMessages("err, unable to unload the kd module because the vmm module is currently loaded "
                     "and uses the kd module, if you want to unload the kd module, please first unload "
                     "the vmm module using the 'unload vmm' command\n");
        return 1;
    }
 
    //
    // Indicate that the message logging window is closed
    //
    g_IsMessageLoggingWindowClosed = TRUE;
 
    //
    // Send IOCTL to mark complete all IRP Pending
    //
    Status = DeviceIoControl(
        g_DeviceHandle,                                      // Handle to device
        IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL, // IO Control Code (IOCTL)
        NULL,                                                // Input Buffer to driver.
        0,                                                   // Length of input buffer in bytes. (x 2 is bcuz as the
                                                             // driver is x64 and has 64 bit values)
        NULL,                                                // Output Buffer from driver.
        0,                                                   // Length of output buffer in bytes.
        &BytesReturned,                                      // Bytes placed in buffer.
        NULL                                                 // synchronous call
    );
 
    //
    // wait to make sure we don't use an invalid handle in another Ioctl
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // Wait for a while to make sure that all IRP pending are completed and the driver is ready to be unloaded
    //
    Sleep(1000);
 
    //
    // Send IRP_MJ_CLOSE to driver to terminate Vmxs
    //
    if (!CloseHandle(g_DeviceHandle))
    {
        ShowMessages("err, closing handle 0x%x\n", GetLastError());
        return 1;
    };
 
    //
    // Null the handle to indicate that the driver's device is not ready
    // to use
    //
    g_DeviceHandle = NULL;
 
    //
    // Debugger module is not loaded anymore
    //
    g_IsKdModuleLoaded = FALSE;
 
    //
    // Check if we found an already built symbol table
    //
    SymbolDeleteSymTable();
 
    ShowMessages("the debugger module is unloaded!\n");
 
    return 0;
}

HyperDbgUnloadVmm()

INT HyperDbgUnloadVmm

(

)

Unload VMM module.

Returns

INT return zero if it was successful or non-zero if there was error

{
    BOOL  Status;
    DWORD BytesReturned;
 
    AssertShowMessageReturnStmt(g_IsVmmModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_VMM_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
    ShowMessages("start terminating vmm...\n");
 
    //
    // Check if HyperTrace module is loaded, if so we need to unload it before unloading VMM
    //
    if (g_IsHyperTraceModuleLoaded)
    {
        ShowMessages(
            "the trace module is currently loaded and will be unloaded before the vmm module\nnote that hypertrace (trace) "
            "use the hypervisor (vmm) features when it is loaded after vmm, however, hypertrace can also operate without the vmm "
            "module, although hypervisor-specific features will not be available\n"
            "the 'trace' module will now be unloaded automatically. You can reload it later "
            "using the command 'load trace', which will load the trace module again without enabling hypervisor-dependent features\n");
 
        HyperDbgUnloadHyperTrace();
    }
 
    //
    // Uninitialize the user debugger if it's initialized
    //
    UdUninitializeUserDebugger();
 
    //
    // Send IOCTL terminate VMX
    //
    Status = DeviceIoControl(g_DeviceHandle,      // Handle to device
                             IOCTL_TERMINATE_VMX, // IO Control Code (IOCTL)
                             NULL,                // Input Buffer to driver.
                             0,                   // Length of input buffer in bytes. (x 2 is bcuz
                                                  // as the driver is x64 and has 64 bit values)
                             NULL,                // Output Buffer from driver.
                             0,                   // Length of output buffer in bytes.
                             &BytesReturned,      // Bytes placed in buffer.
                             NULL                 // synchronous call
    );
 
    //
    // wait to make sure we don't use an invalid handle in another Ioctl
    //
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return 1;
    }
 
    //
    // Hypervisor (VMM) module is not loaded anymore
    //
    g_IsVmmModuleLoaded = FALSE;
 
    ShowMessages("you're not on HyperDbg's hypervisor anymore!\n");
 
    return 0;
}