sym.cpp File Reference

.sym command More...

#include "pch.h"

Functions
VOID	CommandSymHelp ()
	help of the .sym command
VOID	CommandSym (vector< string > SplitCommand, string Command)
	.sym command handler

Variables
BOOLEAN	g_IsSerialConnectedToRemoteDebuggee
	Shows if the debugger was connected to remote debuggee over (A remote guest)
ACTIVE_DEBUGGING_PROCESS	g_ActiveProcessDebuggingState
	State of active debugging thread.

Detailed Description

.sym command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-05-27

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandSym()

VOID CommandSym	(	vector< string >	SplitCommand,
		string	Command )

.sym command handler

Parameters

SplitCommand
Command

Returns

VOID

{
    UINT64 BaseAddress   = NULL;
    UINT32 UserProcessId = NULL;
 
    if (SplitCommand.size() == 1)
    {
        ShowMessages("incorrect use of the '.sym'\n\n");
        CommandSymHelp();
        return;
    }
 
    if (!SplitCommand.at(1).compare("table"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // Show symbol table
        //
        SymbolBuildAndShowSymbolTable();
    }
    else if (!SplitCommand.at(1).compare("load") || !SplitCommand.at(1).compare("download"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // Load and download available symbols
        //
        if (!SplitCommand.at(1).compare("load"))
        {
            SymbolLoadOrDownloadSymbols(FALSE, FALSE);
        }
        else if (!SplitCommand.at(1).compare("download"))
        {
            SymbolLoadOrDownloadSymbols(TRUE, FALSE);
        }
    }
    else if (!SplitCommand.at(1).compare("reload"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2 && SplitCommand.size() != 4)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // Check for process id
        //
        if (SplitCommand.size() == 4)
        {
            if (!SplitCommand.at(2).compare("pid"))
            {
                if (!ConvertStringToUInt32(SplitCommand.at(3), &UserProcessId))
                {
                    //
                    // couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 SplitCommand.at(3).c_str());
                    CommandSymHelp();
                    return;
                }
            }
            else
            {
                ShowMessages("incorrect use of the '.sym'\n\n");
                CommandSymHelp();
                return;
            }
        }
 
        //
        // Refresh and reload symbols
        //
        if (g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Update symbol table from remote debuggee in debugger-mode
            //
            SymbolReloadSymbolTableInDebuggerMode(UserProcessId);
        }
        else
        {
            //
            // Check if user explicitly specified the process id
            //
            if (UserProcessId == NULL)
            {
                //
                // User didn't explicitly specified the process id, so
                // if it's a user-debugger process, we use the modules
                // of the target user-debuggee's process, otherwise,
                // the current process (HyperDbg's process) is specified
                //
                if (g_ActiveProcessDebuggingState.IsActive)
                {
                    UserProcessId = g_ActiveProcessDebuggingState.ProcessId;
                }
                else
                {
                    UserProcessId = GetCurrentProcessId();
                }
            }
 
            //
            // Build locally and reload it
            //
            if (SymbolLocalReload(UserProcessId))
            {
                ShowMessages("symbol table updated successfully\n");
            }
        }
    }
    else if (!SplitCommand.at(1).compare("unload"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() != 2)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        //
        // unload without any parameters, means that unload
        // all the symbols
        //
        ScriptEngineUnloadAllSymbolsWrapper();
 
        //
        // Size is 3 there is module name (not working ! I don't know why)
        //
        // ScriptEngineUnloadModuleSymbolWrapper((char *)SplitCommand.at(2).c_str());
    }
    else if (!SplitCommand.at(1).compare("add"))
    {
        //
        // Validate params
        //
        if (SplitCommand.size() < 6)
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
 
        if (!SplitCommand.at(2).compare("base"))
        {
            string Delimiter = "";
            string PathToPdb = "";
            if (!ConvertStringToUInt64(SplitCommand.at(3), &BaseAddress))
            {
                ShowMessages("please add a valid hex address to be used as the base address\n\n");
                CommandSymHelp();
                return;
            }
 
            //
            // Base address is now valid, check if next parameter is path
            //
            if (SplitCommand.at(4).compare("path"))
            {
                ShowMessages("incorrect use of the '.sym'\n\n");
                CommandSymHelp();
                return;
            }
 
            //
            // The rest of command is pdb path
            //
            Delimiter = "path ";
            PathToPdb = Command.substr(Command.find(Delimiter) + 5, Command.size());
 
            //
            // Check if pdb file exists or not
            //
            if (!IsFileExistA(PathToPdb.c_str()))
            {
                ShowMessages("pdb file not found\n");
                return;
            }
 
            ShowMessages("loading module symbol at '%s'\n", PathToPdb.c_str());
 
            //
            // Load the pdb file (the validation of pdb file is checked into pdb
            // parsing functions)
            //
            ScriptEngineLoadFileSymbolWrapper(BaseAddress, PathToPdb.c_str(), NULL);
        }
        else
        {
            ShowMessages("incorrect use of the '.sym'\n\n");
            CommandSymHelp();
            return;
        }
    }
    else
    {
        ShowMessages("unknown parameter at '%s'\n\n", SplitCommand.at(1).c_str());
        CommandSymHelp();
        return;
    }
}

CommandSymHelp()

VOID CommandSymHelp

(

)

help of the .sym command

Returns

VOID

{
    ShowMessages(".sym : performs the symbol actions.\n\n");
 
    ShowMessages("syntax : \t.sym [table]\n");
    ShowMessages("syntax : \t.sym [reload] [pid ProcessId (hex)]\n");
    ShowMessages("syntax : \t.sym [download]\n");
    ShowMessages("syntax : \t.sym [load]\n");
    ShowMessages("syntax : \t.sym [unload]\n");
    ShowMessages("syntax : \t.sym [add] [base Address (hex)] [path Path (string)]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : .sym table\n");
    ShowMessages("\t\te.g : .sym reload\n");
    ShowMessages("\t\te.g : .sym reload pid 3a24\n");
    ShowMessages("\t\te.g : .sym load\n");
    ShowMessages("\t\te.g : .sym download\n");
    ShowMessages("\t\te.g : .sym add base fffff8077356000 path c:\\symbols\\my_dll.pdb\n");
    ShowMessages("\t\te.g : .sym unload\n");
}

Variable Documentation

g_ActiveProcessDebuggingState

ACTIVE_DEBUGGING_PROCESS g_ActiveProcessDebuggingState

extern

State of active debugging thread.

{0};

g_IsSerialConnectedToRemoteDebuggee

BOOLEAN g_IsSerialConnectedToRemoteDebuggee

extern

Shows if the debugger was connected to remote debuggee over (A remote guest)