HyperDbg Debugger
All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Pages
objects.h File Reference

Header for routines related to objects. More...

Go to the source code of this file.

Functions

BOOLEAN ObjectShowProcessesOrThreadList (BOOLEAN IsProcess, PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS SymDetailsForProcessList, UINT64 Eprocess, PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS SymDetailsForThreadList)
 Get details about processes or threads.
 
BOOLEAN ObjectShowProcessesOrThreadDetails (BOOLEAN IsProcess)
 Get details about processes or threads.
 

Detailed Description

Header for routines related to objects.

Author
Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)
Version
0.1
Date
2022-05-06

Function Documentation

◆ ObjectShowProcessesOrThreadDetails()

BOOLEAN ObjectShowProcessesOrThreadDetails ( BOOLEAN IsProcess)

Get details about processes or threads.

Parameters
IsProcess
Returns
BOOLEAN
27{
28 BOOLEAN Status;
29 ULONG ReturnedLength;
30 DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET GetInformationProcess = {0};
31 DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET GetInformationThread = {0};
32
33 if (IsProcess)
34 {
35 //
36 // *** Show process details ***
37 //
38
39 //
40 // Send the request to the kernel
41 //
42 Status = DeviceIoControl(
43 g_DeviceHandle, // Handle to device
44 IOCTL_QUERY_CURRENT_PROCESS, // IO Control
45 // code
46 &GetInformationProcess, // Input Buffer to driver.
48 &GetInformationProcess, // Output Buffer from driver.
50 // buffer in bytes.
51 &ReturnedLength, // Bytes placed in buffer.
52 NULL // synchronous call
53 );
54
55 if (!Status)
56 {
57 ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
58 return FALSE;
59 }
60
61 //
62 // Query was successful
63 //
64 if (GetInformationProcess.Result == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
65 {
66 ShowMessages("process id: %x\nprocess (_EPROCESS): %s\nprocess name (16-Byte): %s\n",
67 GetInformationProcess.ProcessId,
68 SeparateTo64BitValue(GetInformationProcess.Process).c_str(),
69 GetInformationProcess.ProcessName);
70
71 return TRUE;
72 }
73 else
74 {
75 ShowErrorMessage(GetInformationProcess.Result);
76 return FALSE;
77 }
78 }
79 else
80 {
81 //
82 // *** Show threads details ***
83 //
84
85 //
86 // Send the request to the kernel
87 //
88 Status = DeviceIoControl(
89 g_DeviceHandle, // Handle to device
90 IOCTL_QUERY_CURRENT_THREAD, // IO Control
91 // code
92 &GetInformationThread, // Input Buffer to driver.
94 &GetInformationThread, // Output Buffer from driver.
96 // buffer in bytes.
97 &ReturnedLength, // Bytes placed in buffer.
98 NULL // synchronous call
99 );
100
101 if (!Status)
102 {
103 ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
104 return FALSE;
105 }
106
107 //
108 // Query was successful
109 //
110 if (GetInformationThread.Result == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
111 {
112 ShowMessages("thread id: %x (pid: %x)\nthread (_ETHREAD): %s\nprocess (_EPROCESS): %s\nprocess name (16-Byte): %s\n",
113 GetInformationThread.ThreadId,
114 GetInformationThread.ProcessId,
115 SeparateTo64BitValue(GetInformationThread.Thread).c_str(),
116 SeparateTo64BitValue(GetInformationThread.Process).c_str(),
117 GetInformationThread.ProcessName);
118 return TRUE;
119 }
120 else
121 {
122 ShowErrorMessage(GetInformationThread.Result);
123 return FALSE;
124 }
125 }
126}
UCHAR BOOLEAN
Definition BasicTypes.h:39
#define TRUE
Definition BasicTypes.h:55
#define FALSE
Definition BasicTypes.h:54
unsigned long ULONG
Definition BasicTypes.h:37
#define DEBUGGER_OPERATION_WAS_SUCCESSFUL
General value to indicate that the operation or request was successful.
Definition ErrorCodes.h:23
#define IOCTL_QUERY_CURRENT_THREAD
ioctl, query the current thread details
Definition Ioctls.h:268
#define IOCTL_QUERY_CURRENT_PROCESS
ioctl, query the current process details
Definition Ioctls.h:261
#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET
Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET.
Definition RequestStructures.h:980
#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET
Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET.
Definition RequestStructures.h:942
string SeparateTo64BitValue(UINT64 Value)
add ` between 64 bit values and convert them to string
Definition common.cpp:27
BOOLEAN ShowErrorMessage(UINT32 Error)
shows the error message
Definition debugger.cpp:38
HANDLE g_DeviceHandle
Holds the global handle of device which is used to send the request to the kernel by IOCTL,...
Definition globals.h:471
VOID ShowMessages(const char *Fmt,...)
Show messages.
Definition libhyperdbg.cpp:96
The structure of changing process and show process packet in HyperDbg.
Definition RequestStructures.h:924
UINT32 ProcessId
Definition RequestStructures.h:926
UINT64 Process
Definition RequestStructures.h:927
UINT32 Result
Definition RequestStructures.h:931
UCHAR ProcessName[16]
Definition RequestStructures.h:929
The structure of changing thead and show thread packet in HyperDbg.
Definition RequestStructures.h:963
UINT64 Thread
Definition RequestStructures.h:967
UINT64 Process
Definition RequestStructures.h:968
UINT32 ProcessId
Definition RequestStructures.h:966
UCHAR ProcessName[16]
Definition RequestStructures.h:970
UINT32 ThreadId
Definition RequestStructures.h:965
UINT32 Result
Definition RequestStructures.h:972

◆ ObjectShowProcessesOrThreadList()

BOOLEAN ObjectShowProcessesOrThreadList ( BOOLEAN IsProcess,
PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS SymDetailsForProcessList,
UINT64 Eprocess,
PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS SymDetailsForThreadList )

Get details about processes or threads.

Parameters
IsProcess
SymDetailsForProcessList
Eprocess
SymDetailsForThreadList
Returns
BOOLEAN
142{
143 BOOLEAN Status;
144 ULONG ReturnedLength;
145 DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS QueryCountOfActiveThreadsOrProcessesRequest = {0};
146 UINT32 SizeOfBufferForThreadsAndProcessDetails = NULL;
147 PVOID Entries = NULL;
150
151 //
152 // Check if driver is loaded
153 //
155
156 //
157 // We wanna query the count of active processes or threads
158 //
159 if (IsProcess)
160 {
161 //
162 // It's a process
163 //
164 QueryCountOfActiveThreadsOrProcessesRequest.QueryType = DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT;
165 }
166 else
167 {
168 //
169 // It's a thread
170 //
171 QueryCountOfActiveThreadsOrProcessesRequest.QueryType = DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT;
172 }
173
174 //
175 // The action is counting the process or thread
176 //
177 QueryCountOfActiveThreadsOrProcessesRequest.QueryAction = DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT;
178
179 if (IsProcess)
180 {
181 //
182 // Copy items needed for getting the details of processes
183 //
184 RtlCopyMemory(&QueryCountOfActiveThreadsOrProcessesRequest.ProcessListNeededDetails,
185 SymDetailsForProcessList,
187 }
188 else
189 {
190 //
191 // Copy items needed for getting the details of threads
192 //
193 RtlCopyMemory(&QueryCountOfActiveThreadsOrProcessesRequest.ThreadListNeededDetails,
194 SymDetailsForThreadList,
196 }
197
198 //
199 // Send the request to the kernel
200 //
201 Status = DeviceIoControl(
202 g_DeviceHandle, // Handle to device
204 // code
205 &QueryCountOfActiveThreadsOrProcessesRequest, // Input Buffer to driver.
207 &QueryCountOfActiveThreadsOrProcessesRequest, // Output Buffer from driver.
209 // buffer in bytes.
210 &ReturnedLength, // Bytes placed in buffer.
211 NULL // synchronous call
212 );
213
214 if (!Status)
215 {
216 ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
217 return FALSE;
218 }
219
220 //
221 // Query was successful
222 //
223 if (QueryCountOfActiveThreadsOrProcessesRequest.Result == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
224 {
225 if (QueryCountOfActiveThreadsOrProcessesRequest.Count == 0)
226 {
227 ShowMessages("err, unable to get count of active processes or threads\n");
228 }
229 else
230 {
231 //
232 // *** We should send another IOCTL and get the list of processes or threads ***
233 //
234
235 //
236 // Add some spaces for new processes or threads as new objects might be available
237 //
238 QueryCountOfActiveThreadsOrProcessesRequest.Count = QueryCountOfActiveThreadsOrProcessesRequest.Count + 5;
239
240 //
241 // Allocate the storage for the pull details of threads and processes
242 //
243 if (IsProcess)
244 {
245 SizeOfBufferForThreadsAndProcessDetails =
246 QueryCountOfActiveThreadsOrProcessesRequest.Count * sizeof(DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY);
247 }
248 else
249 {
250 SizeOfBufferForThreadsAndProcessDetails =
251 QueryCountOfActiveThreadsOrProcessesRequest.Count * sizeof(DEBUGGEE_THREAD_LIST_DETAILS_ENTRY);
252 }
253
254 Entries = (PVOID)malloc(SizeOfBufferForThreadsAndProcessDetails);
255
256 RtlZeroMemory(Entries, SizeOfBufferForThreadsAndProcessDetails);
257
258 // ShowMessages("count of active processes/threads : %lld\n", QueryCountOfActiveThreadsOrProcessesRequest.Count);
259
260 if (IsProcess)
261 {
262 QueryCountOfActiveThreadsOrProcessesRequest.QueryType = DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST;
263 }
264 else
265 {
266 QueryCountOfActiveThreadsOrProcessesRequest.QueryType = DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST;
267 }
268
269 //
270 // Send the request to the kernel
271 //
272 Status = DeviceIoControl(
273 g_DeviceHandle, // Handle to device
274 IOCTL_GET_LIST_OF_THREADS_AND_PROCESSES, // IO Control Code (IOCTL)
275 &QueryCountOfActiveThreadsOrProcessesRequest, // Input Buffer to driver.
277 Entries, // Output Buffer from driver.
278 SizeOfBufferForThreadsAndProcessDetails, // Length of output buffer in bytes.
279 &ReturnedLength, // Bytes placed in buffer.
280 NULL // synchronous call
281 );
282
283 if (!Status)
284 {
285 ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
286 return FALSE;
287 }
288
289 if (IsProcess)
290 {
291 ProcessEntries = (PDEBUGGEE_PROCESS_LIST_DETAILS_ENTRY)Entries;
292 }
293 else
294 {
295 ThreadEntries = (PDEBUGGEE_THREAD_LIST_DETAILS_ENTRY)Entries;
296
297 ShowMessages("PROCESS\t%llx\tIMAGE\t%s\n",
298 ThreadEntries->Eprocess,
299 ThreadEntries->ImageFileName);
300 }
301
302 //
303 // Show list of active processes and threads
304 //
305 for (size_t i = 0; i < QueryCountOfActiveThreadsOrProcessesRequest.Count; i++)
306 {
307 //
308 // Details of process/thread should be shown
309 //
310 if (IsProcess)
311 {
312 if (ProcessEntries[i].Eprocess != NULL)
313 {
314 ShowMessages("PROCESS\t%llx\n\tProcess Id: %04x\tDirBase (Kernel Cr3): %016llx\tImage: %s\n\n",
315 ProcessEntries[i].Eprocess,
316 ProcessEntries[i].ProcessId,
317 ProcessEntries[i].Cr3,
318 ProcessEntries[i].ImageFileName);
319 }
320 }
321 else
322 {
323 if (ThreadEntries[i].Ethread != NULL)
324 {
325 ShowMessages("\tTHREAD\t%llx (%x.%x)\n",
326 ThreadEntries[i].Ethread,
327 ThreadEntries[i].ProcessId,
328 ThreadEntries[i].ThreadId);
329 }
330 }
331 }
332 }
333
334 //
335 // The operation of attaching was successful
336 //
337 return TRUE;
338 }
339 else
340 {
341 ShowErrorMessage((UINT32)QueryCountOfActiveThreadsOrProcessesRequest.Result);
342 return FALSE;
343 }
344
345 //
346 // No reason to reach here
347 //
348 return FALSE;
349}
unsigned int UINT32
Definition BasicTypes.h:48
#define IOCTL_GET_LIST_OF_THREADS_AND_PROCESSES
ioctl, to get list threads/processes
Definition Ioctls.h:254
#define IOCTL_QUERY_COUNT_OF_ACTIVE_PROCESSES_OR_THREADS
ioctl, query count of active threads or processes
Definition Ioctls.h:247
@ DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT
Definition RequestStructures.h:658
@ DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST
Definition RequestStructures.h:659
@ DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST
Definition RequestStructures.h:660
@ DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT
Definition RequestStructures.h:657
struct _DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY * PDEBUGGEE_PROCESS_LIST_DETAILS_ENTRY
struct _DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY
The structure showing list of processes (details of each entry)
struct _DEBUGGEE_THREAD_LIST_DETAILS_ENTRY DEBUGGEE_THREAD_LIST_DETAILS_ENTRY
The structure showing list of threads (details of each entry)
#define SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS
Definition RequestStructures.h:648
struct _DEBUGGEE_THREAD_LIST_DETAILS_ENTRY * PDEBUGGEE_THREAD_LIST_DETAILS_ENTRY
@ DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT
Definition RequestStructures.h:673
#define AssertShowMessageReturnStmt(expr, message, rc)
Definition common.h:51
#define ASSERT_MESSAGE_DRIVER_NOT_LOADED
Definition common.h:25
#define AssertReturnFalse
Definition common.h:21
NULL()
Definition test-case-generator.py:530
The structure showing list of processes (details of each entry)
Definition RequestStructures.h:714
The structure of needed information to get the details of the process from nt!_EPROCESS and location ...
Definition RequestStructures.h:684
The structure showing list of threads (details of each entry)
Definition RequestStructures.h:728
UCHAR ImageFileName[15+1]
Definition RequestStructures.h:733
UINT64 Eprocess
Definition RequestStructures.h:729
The structure of needed information to get the details of the thread from nt!_ETHREAD and location of...
Definition RequestStructures.h:698
request for query count of active processes and threads
Definition RequestStructures.h:742
UINT32 Count
Definition RequestStructures.h:747
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES QueryType
Definition RequestStructures.h:745
DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListNeededDetails
Definition RequestStructures.h:744
UINT64 Result
Definition RequestStructures.h:748
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS QueryAction
Definition RequestStructures.h:746
DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededDetails
Definition RequestStructures.h:743