HyperDbg Debugger
Loading...
Searching...
No Matches
load.cpp File Reference

load command More...

#include "pch.h"

Functions

VOID CommandLoadHelp ()
 help of the load command
VOID CommandLoad (vector< CommandToken > CommandTokens, string Command)
 load command handler

Variables

BOOLEAN g_IsConnectedToHyperDbgLocally
 Shows whether the user is allowed to use 'load' command to load modules locally in VMI (virtual machine introspection) mode.
BOOLEAN g_IsKdModuleLoaded
 shows whether the kernel debugger (KD) module is loaded or not
BOOLEAN g_IsVmmModuleLoaded
 shows whether the VMM module is loaded or not
BOOLEAN g_IsHyperTraceModuleLoaded
 shows whether the HyperTrace module is loaded or not

Detailed Description

load command

Author
Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)
Version
0.1
Date
2020-05-27
Copyright
This project is released under the GNU Public License v3.

Function Documentation

◆ CommandLoad()

VOID CommandLoad ( vector< CommandToken > CommandTokens,
string Command )

load command handler

Parameters
CommandTokens
Command
Returns
VOID
51{
52 if (CommandTokens.size() != 2)
53 {
54 ShowMessages("incorrect use of the '%s'\n\n",
55 GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
56 CommandLoadHelp();
57 return;
58 }
59
60 if (!g_IsConnectedToHyperDbgLocally)
61 {
62 ShowMessages("you're not connected to any instance of HyperDbg, did you "
63 "use '.connect'? \n");
64 return;
65 }
66
67 //
68 // Check for the module
69 //
70 if (CompareLowerCaseStrings(CommandTokens.at(1), "all") || CompareLowerCaseStrings(CommandTokens.at(1), "."))
71 {
72 //
73 // Load aa Modules
74 //
75 ShowMessages("loading the all modules\n");
76
77 if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadAllModules() == 1)
78 {
79 ShowMessages("failed to install or load drivers\n");
80 return;
81 }
82
83 //
84 // If in vmi-mode then initialize and load symbols (pdb)
85 // for previously downloaded symbols
86 // When the VMM module is loaded, we use the current
87 // process (HyperDbg's process) as the base for user-mode
88 // symbols
89 //
90 SymbolLocalReload(GetCurrentProcessId());
91 }
92 else if (CompareLowerCaseStrings(CommandTokens.at(1), "vmm") ||
93 CompareLowerCaseStrings(CommandTokens.at(1), "vm"))
94 {
95 //
96 // Check to make sure that the driver is not already loaded
97 //
98 if (g_IsVmmModuleLoaded)
99 {
100 ShowMessages("the vmm module is already running, if you use 'load' before, please "
101 "first unload it using the 'unload' command\n");
102 return;
103 }
104
105 //
106 // Load the VMM Module
107 //
108 ShowMessages("loading the vmm module\n");
109
110 if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadVmmModule() == 1)
111 {
112 ShowMessages("failed to install or load the driver\n");
113 return;
114 }
115
116 //
117 // If in vmi-mode then initialize and load symbols (pdb)
118 // for previously downloaded symbols
119 // When the VMM module is loaded, we use the current
120 // process (HyperDbg's process) as the base for user-mode
121 // symbols
122 //
123 SymbolLocalReload(GetCurrentProcessId());
124 }
125 else if (CompareLowerCaseStrings(CommandTokens.at(1), "trace") ||
126 CompareLowerCaseStrings(CommandTokens.at(1), "hypertrace"))
127 {
128 //
129 // Check to make sure that the driver is not already loaded
130 //
131 if (g_IsHyperTraceModuleLoaded)
132 {
133 ShowMessages("the trace module is already running, if you use 'load' before, please "
134 "first unload it using the 'unload' command\n");
135 return;
136 }
137
138 //
139 // Load the HyperTrace Module
140 //
141 ShowMessages("loading the trace module\n");
142
143 if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadHyperTraceModule() == 1)
144 {
145 ShowMessages("failed to install or load the driver\n");
146 return;
147 }
148 }
149 else if (CompareLowerCaseStrings(CommandTokens.at(1), "kd") ||
150 CompareLowerCaseStrings(CommandTokens.at(1), "dbg") ||
151 CompareLowerCaseStrings(CommandTokens.at(1), "debugger") ||
152 CompareLowerCaseStrings(CommandTokens.at(1), "debug") ||
153 CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebugger") ||
154 CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebug"))
155 {
156 //
157 // Check to make sure that the driver is not already loaded
158 //
159 if (g_IsKdModuleLoaded)
160 {
161 ShowMessages("the kd module is already running, if you use 'load' before, please "
162 "first unload it using the 'unload' command\n");
163 return;
164 }
165
166 //
167 // Load the KD Module
168 //
169 ShowMessages("loading the kd module\n");
170
171 if (HyperDbgInstallKdDriver() == 1 || HyperDbgLoadKdModule() == 1)
172 {
173 ShowMessages("failed to install or load the driver\n");
174 return;
175 }
176 }
177 else
178 {
179 //
180 // Module not found
181 //
182 ShowMessages("err, module not found\n");
183 }
184}
GetCaseSensitiveStringFromCommandToken
std::string GetCaseSensitiveStringFromCommandToken(CommandToken TargetToken)
Get case sensitive string from command token.
Definition common.cpp:467
CompareLowerCaseStrings
BOOLEAN CompareLowerCaseStrings(CommandToken TargetToken, const CHAR *StringToCompare)
Compare lower case strings.
Definition common.cpp:503
g_IsConnectedToHyperDbgLocally
BOOLEAN g_IsConnectedToHyperDbgLocally
Shows whether the user is allowed to use 'load' command to load modules locally in VMI (virtual machi...
Definition globals.h:89
g_IsHyperTraceModuleLoaded
BOOLEAN g_IsHyperTraceModuleLoaded
shows whether the HyperTrace module is loaded or not
Definition lbrdump.cpp:19
HyperDbgLoadAllModules
INT HyperDbgLoadAllModules()
load all modules (KD, VMM, HyperTrace, etc.)
Definition libhyperdbg.cpp:908
g_IsKdModuleLoaded
BOOLEAN g_IsKdModuleLoaded
shows whether the kernel debugger (KD) module is loaded or not
Definition globals.h:22
HyperDbgInstallKdDriver
INT HyperDbgInstallKdDriver()
Install KD (Kernel Debugger) driver.
Definition libhyperdbg.cpp:81
HyperDbgLoadHyperTraceModule
INT HyperDbgLoadHyperTraceModule()
load hypertrace module
Definition libhyperdbg.cpp:838
HyperDbgLoadVmmModule
INT HyperDbgLoadVmmModule()
load vmm module
Definition libhyperdbg.cpp:749
g_IsVmmModuleLoaded
BOOLEAN g_IsVmmModuleLoaded
shows whether the VMM module is loaded or not
Definition globals.h:28
HyperDbgLoadKdModule
INT HyperDbgLoadKdModule()
load kd module
Definition libhyperdbg.cpp:665
CommandLoadHelp
VOID CommandLoadHelp()
help of the load command
Definition load.cpp:28
SymbolLocalReload
BOOLEAN SymbolLocalReload(UINT32 UserProcessId)
Locally reload the symbol table.
Definition symbol.cpp:49

◆ CommandLoadHelp()

VOID CommandLoadHelp ( )

help of the load command

Returns
VOID
29{
30 ShowMessages("load : installs drivers and load modules.\n\n");
31
32 ShowMessages("syntax : \tload [ModuleNameOrAll (string)]\n");
33
34 ShowMessages("\n");
35 ShowMessages("\t\te.g : load vmm\n");
36 ShowMessages("\t\te.g : load kd\n");
37 ShowMessages("\t\te.g : load trace\n");
38 ShowMessages("\t\te.g : load all\n");
39}

Variable Documentation

◆ g_IsConnectedToHyperDbgLocally

BOOLEAN g_IsConnectedToHyperDbgLocally
extern

Shows whether the user is allowed to use 'load' command to load modules locally in VMI (virtual machine introspection) mode.

◆ g_IsHyperTraceModuleLoaded

BOOLEAN g_IsHyperTraceModuleLoaded
extern

shows whether the HyperTrace module is loaded or not

◆ g_IsKdModuleLoaded

BOOLEAN g_IsKdModuleLoaded
extern

shows whether the kernel debugger (KD) module is loaded or not

◆ g_IsVmmModuleLoaded

BOOLEAN g_IsVmmModuleLoaded
extern

shows whether the VMM module is loaded or not