rev.cpp File Reference

!rev command More...

#include "pch.h"

Functions
VOID	CommandRevHelp ()
	help of the !rev command
VOID	CommandRev (vector< CommandToken > CommandTokens, string Command)
	!rev command handler

Variables
BOOLEAN	g_IsSerialConnectedToRemoteDebugger
	Shows if the debugger was connected to remote debugger (A remote host).

Detailed Description

!rev command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-03-22

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandRev()

VOID CommandRev	(	vector< CommandToken >	CommandTokens,
		string	Command )

!rev command handler

Parameters

CommandTokens
Command

Returns

VOID

{
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST RevRequest         = {0};
    BOOLEAN                                      SetPid             = FALSE;
    UINT32                                       TargetPid          = NULL;
    BOOLEAN                                      IgnoreFirstCommand = TRUE;
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE    Mode               = REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN;
    REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE    Type               = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN;
 
    //
    // Interpret command specific details
    //
    for (auto Section : CommandTokens)
    {
        if (CompareLowerCaseStrings(Section, "!rev") && IgnoreFirstCommand)
        {
            IgnoreFirstCommand = FALSE;
            continue;
        }
        else if (CompareLowerCaseStrings(Section, "pid") && !SetPid)
        {
            SetPid = TRUE;
        }
        else if (SetPid)
        {
            if (!ConvertTokenToUInt32(Section, &TargetPid))
            {
                //
                // couldn't resolve or unknown parameter
                //
                ShowMessages("err, couldn't resolve error at '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(Section).c_str());
                CommandRevHelp();
                return;
            }
            SetPid = FALSE;
        }
        else if (CompareLowerCaseStrings(Section, "pattern"))
        {
            Type = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN;
        }
        else if (CompareLowerCaseStrings(Section, "reconstruct"))
        {
            Type = REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT;
        }
        else
        {
            //
            // Unknown parameter
            //
            ShowMessages("err, couldn't resolve error at '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(Section).c_str());
            CommandRevHelp();
            return;
        }
    }
 
    if (SetPid)
    {
        ShowMessages("err, please enter a valid process id in hex format, "
                     "or if you want to use it in decimal format, add '0n' "
                     "prefix to the number\n");
        return;
    }
 
    RevRequest.ProcessId = TargetPid;
 
    // ================================================================================
 
    //
    // Send the request to the hypervisor (kernel)
    //
    RevRequestService(&RevRequest);
}

CommandRevHelp()

VOID CommandRevHelp

(

)

help of the !rev command

Returns

VOID

{
    ShowMessages("!rev : uses the reversing machine module in order to reconstruct the programmer/memory assumptions.\n\n");
 
    ShowMessages("syntax : \t!rev [config] [pid ProcessId (hex)]\n");
    ShowMessages("syntax : \t!rev [path Path (string)] [Parameters (string)]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : !rev path c:\\reverse eng\\my_file.exe\n");
    ShowMessages("\t\te.g : !rev pattern\n");
    ShowMessages("\t\te.g : !rev reconstruct\n");
    ShowMessages("\t\te.g : !rev pattern pid 1c0\n");
    ShowMessages("\t\te.g : !rev reconstruct pid 1c0\n");
}

Variable Documentation

g_IsSerialConnectedToRemoteDebugger

BOOLEAN g_IsSerialConnectedToRemoteDebugger

extern

Shows if the debugger was connected to remote debugger (A remote host).