script-engine.cpp File Reference

Interpret script engine affairs. More...

#include "pch.h"

Functions
UINT64	ScriptEngineEvalSingleExpression (string Expr, PBOOLEAN HasError)
	Get the value from the evaluation of single expression from local debuggee and remote debuggee.
BOOLEAN	ScriptEngineExecuteSingleExpression (CHAR *Expr, BOOLEAN ShowErrorMessageIfAny, BOOLEAN IsFormat)
	Execute single expression for the kernel debugger and the user-mode debugger.

Variables
UINT64	g_ResultOfEvaluatedExpression
	Result of the expression that is evaluated in the debuggee.
UINT32	g_ErrorStateOfResultOfEvaluatedExpression
	Shows the state of the evaluation of expression which whether contains error or not.
BOOLEAN	g_IsSerialConnectedToRemoteDebuggee
	Shows if the debugger was connected to remote debuggee over (A remote guest).
ACTIVE_DEBUGGING_PROCESS	g_ActiveProcessDebuggingState
	State of active debugging thread.

Detailed Description

Interpret script engine affairs.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-09-23

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ScriptEngineEvalSingleExpression()

UINT64 ScriptEngineEvalSingleExpression	(	string	Expr,
		PBOOLEAN	HasError )

Get the value from the evaluation of single expression from local debuggee and remote debuggee.

Parameters

Expr
HasError

Returns

UINT64

{
    UINT64 Result = NULL;
 
    //
    // Prepend and append 'formats(' and ')'
    //
    Expr.insert(0, "formats(");
    Expr.append(");");
 
    if (g_IsSerialConnectedToRemoteDebuggee || g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Send data to the target user debugger or kernel debugger
        //
        if (!ScriptEngineExecuteSingleExpression((CHAR *)Expr.c_str(), TRUE, TRUE))
        {
            *HasError = TRUE;
            return NULL;
        }
 
        //
        // Check whether there was an error in evaluation or not
        //
        if (g_ErrorStateOfResultOfEvaluatedExpression == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            //
            // Everything was fine, return the result of the evaluated
            // expression and null the global holders
            //
            Result                                    = g_ResultOfEvaluatedExpression;
            g_ErrorStateOfResultOfEvaluatedExpression = NULL;
            g_ResultOfEvaluatedExpression             = NULL;
            *HasError                                 = FALSE;
        }
        else
        {
            //
            // There was an error evaluating the expression from the kernel (debuggee)
            //
            g_ErrorStateOfResultOfEvaluatedExpression = NULL;
            g_ResultOfEvaluatedExpression             = NULL;
 
            *HasError = TRUE;
            Result    = NULL;
        }
    }
    else
    {
        //
        // It's in vmi-mode,
        // execute it locally with regs set to ZERO
        //
        Result = ScriptEngineEvalUInt64StyleExpressionWrapper(Expr, HasError);
    }
 
    return Result;
}

ScriptEngineExecuteSingleExpression()

BOOLEAN ScriptEngineExecuteSingleExpression	(	CHAR *	Expr,
		BOOLEAN	ShowErrorMessageIfAny,
		BOOLEAN	IsFormat )

Execute single expression for the kernel debugger and the user-mode debugger.

Parameters

Expr
ShowErrorMessageIfAny
IsFormat	If it's a format expression

Returns

BOOLEAN Returns TRUE if it was successful

{
    PVOID   CodeBuffer;
    UINT64  BufferAddress;
    UINT32  BufferLength;
    UINT32  Pointer;
    BOOLEAN Result = FALSE;
 
    //
    // Check whether a kernel debugger is connected or a user-mode debugger is active
    //
    if (!g_IsSerialConnectedToRemoteDebuggee && !g_ActiveProcessDebuggingState.IsActive)
    {
        if (ShowErrorMessageIfAny)
        {
            ShowMessages("err, you're not connected to any debuggee (neither user debugger nor kernel debugger)\n");
        }
        return FALSE;
    }
 
    //
    // Check if the user-mode debuggee is paused
    //
    if (g_ActiveProcessDebuggingState.IsActive && !g_ActiveProcessDebuggingState.IsPaused)
    {
        if (ShowErrorMessageIfAny)
        {
            ShowMessages("err, the target process is NOT paused, you should run 'pause' to pause it\n");
        }
        return FALSE;
    }
 
    //
    // Run script engine handler
    //
    CodeBuffer = ScriptEngineParseWrapper(Expr, ShowErrorMessageIfAny);
 
    if (CodeBuffer == NULL)
    {
        //
        // return to show that this item contains an error
        //
        return FALSE;
    }
 
    //
    // Print symbols (test)
    //
    // PrintSymbolBufferWrapper(CodeBuffer);
 
    //
    // Set the buffer and length
    //
    BufferAddress = ScriptEngineWrapperGetHead(CodeBuffer);
    BufferLength  = ScriptEngineWrapperGetSize(CodeBuffer);
    Pointer       = ScriptEngineWrapperGetPointer(CodeBuffer);
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Send it to the remote debuggee (kernel debugger)
        //
        Result = KdSendScriptPacketToDebuggee(BufferAddress,
                                              BufferLength,
                                              Pointer,
                                              IsFormat);
    }
    else if (g_ActiveProcessDebuggingState.IsActive)
    {
        //
        // Send it to the user debugger
        //
        Result = UdSendScriptBufferToProcess(
            g_ActiveProcessDebuggingState.ProcessDebuggingToken,
            g_ActiveProcessDebuggingState.ThreadId,
            BufferAddress,
            BufferLength,
            Pointer,
            IsFormat);
    }
    else
    {
        //
        // Not connected to any debuggee
        //
        ShowMessages("err, you're not connected to any debuggee (neither user debugger nor kernel debugger)\n");
        Result = FALSE;
    }
 
    //
    // Remove the buffer of script engine interpreted code
    //
    ScriptEngineWrapperRemoveSymbolBuffer(CodeBuffer);
 
    //
    // Return result
    //
    return Result;
}

Variable Documentation

g_ActiveProcessDebuggingState

ACTIVE_DEBUGGING_PROCESS g_ActiveProcessDebuggingState

extern

State of active debugging thread.

{0};

g_ErrorStateOfResultOfEvaluatedExpression

UINT32 g_ErrorStateOfResultOfEvaluatedExpression

extern

Shows the state of the evaluation of expression which whether contains error or not.

g_IsSerialConnectedToRemoteDebuggee

BOOLEAN g_IsSerialConnectedToRemoteDebuggee

extern

Shows if the debugger was connected to remote debuggee over (A remote guest).

g_ResultOfEvaluatedExpression

UINT64 g_ResultOfEvaluatedExpression

extern

Result of the expression that is evaluated in the debuggee.