sym.cpp File Reference

.sym command More...

#include "pch.h"

Functions
VOID	CommandSymHelp ()
	help of the .sym command
VOID	CommandSym (vector< CommandToken > CommandTokens, string Command)
	.sym command handler

Variables
BOOLEAN	g_IsSerialConnectedToRemoteDebuggee
	Shows if the debugger was connected to remote debuggee over (A remote guest).
ACTIVE_DEBUGGING_PROCESS	g_ActiveProcessDebuggingState
	State of active debugging thread.

Detailed Description

.sym command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-05-27

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandSym()

VOID CommandSym	(	vector< CommandToken >	CommandTokens,
		string	Command )

.sym command handler

Parameters

CommandTokens
Command

Returns

VOID

{
    UINT64 BaseAddress   = NULL;
    UINT32 UserProcessId = NULL;
    string PathToPdb;
 
    if (CommandTokens.size() == 1)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandSymHelp();
        return;
    }
 
    if (CompareLowerCaseStrings(CommandTokens.at(1), "table"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // Show symbol table
        //
        SymbolBuildAndShowSymbolTable();
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "load") || CompareLowerCaseStrings(CommandTokens.at(1), "download"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // Load and download available symbols
        //
        if (CompareLowerCaseStrings(CommandTokens.at(1), "load"))
        {
            SymbolLoadOrDownloadSymbols(FALSE, FALSE);
        }
        else if (CompareLowerCaseStrings(CommandTokens.at(1), "download"))
        {
            SymbolLoadOrDownloadSymbols(TRUE, FALSE);
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "reload"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2 && CommandTokens.size() != 4)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // Check for process id
        //
        if (CommandTokens.size() == 4)
        {
            if (CompareLowerCaseStrings(CommandTokens.at(2), "pid"))
            {
                if (!ConvertTokenToUInt32(CommandTokens.at(3), &UserProcessId))
                {
                    //
                    // couldn't resolve or unknown parameter
                    //
                    ShowMessages("err, couldn't resolve error at '%s'\n\n",
                                 GetCaseSensitiveStringFromCommandToken(CommandTokens.at(3)).c_str());
                    CommandSymHelp();
                    return;
                }
            }
            else
            {
                ShowMessages("incorrect use of the '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
                CommandSymHelp();
                return;
            }
        }
 
        //
        // Refresh and reload symbols
        //
        if (g_IsSerialConnectedToRemoteDebuggee)
        {
            //
            // Update symbol table from remote debuggee in debugger-mode
            //
            SymbolReloadSymbolTableInDebuggerMode(UserProcessId);
        }
        else
        {
            //
            // Check if user explicitly specified the process id
            //
            if (UserProcessId == NULL)
            {
                //
                // User didn't explicitly specified the process id, so
                // if it's a user-debugger process, we use the modules
                // of the target user-debuggee's process, otherwise,
                // the current process (HyperDbg's process) is specified
                //
                if (g_ActiveProcessDebuggingState.IsActive)
                {
                    UserProcessId = g_ActiveProcessDebuggingState.ProcessId;
                }
                else
                {
                    UserProcessId = GetCurrentProcessId();
                }
            }
 
            //
            // Build locally and reload it
            //
            if (SymbolLocalReload(UserProcessId))
            {
                ShowMessages("symbol table updated successfully\n");
            }
        }
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "unload"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() != 2)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        //
        // unload without any parameters, means that unload
        // all the symbols
        //
        ScriptEngineUnloadAllSymbolsWrapper();
 
        //
        // Size is 3 there is module name (not working ! I don't know why)
        //
        // ScriptEngineUnloadModuleSymbolWrapper((char *)SplitCommand.at(2).c_str());
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "add"))
    {
        //
        // Validate params
        //
        if (CommandTokens.size() < 6)
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
 
        if (CompareLowerCaseStrings(CommandTokens.at(2), "base"))
        {
            if (!ConvertTokenToUInt64(CommandTokens.at(3), &BaseAddress))
            {
                ShowMessages("please add a valid hex address to be used as the base address\n\n");
                CommandSymHelp();
                return;
            }
 
            //
            // Base address is now valid, check if next parameter is path
            //
            if (!CompareLowerCaseStrings(CommandTokens.at(4), "path"))
            {
                ShowMessages("incorrect use of the '%s'\n\n",
                             GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
                CommandSymHelp();
                return;
            }
 
            //
            // The rest of command is pdb path
            //
            PathToPdb = GetCaseSensitiveStringFromCommandToken(CommandTokens.at(5));
 
            //
            // Check if pdb file exists or not
            //
            if (!IsFileExistA(PathToPdb.c_str()))
            {
                ShowMessages("pdb file not found\n");
                return;
            }
 
            ShowMessages("loading module symbol at '%s'\n", PathToPdb.c_str());
 
            //
            // Load the pdb file (the validation of pdb file is checked into pdb
            // parsing functions)
            //
            ScriptEngineLoadFileSymbolWrapper(BaseAddress, PathToPdb.c_str(), NULL);
        }
        else
        {
            ShowMessages("incorrect use of the '%s'\n\n",
                         GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
            CommandSymHelp();
            return;
        }
    }
    else
    {
        ShowMessages("unknown parameter at '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(1)).c_str());
        CommandSymHelp();
        return;
    }
}

CommandSymHelp()

VOID CommandSymHelp

(

)

help of the .sym command

Returns

VOID

{
    ShowMessages(".sym : performs the symbol actions.\n\n");
 
    ShowMessages("syntax : \t.sym [table]\n");
    ShowMessages("syntax : \t.sym [reload] [pid ProcessId (hex)]\n");
    ShowMessages("syntax : \t.sym [download]\n");
    ShowMessages("syntax : \t.sym [load]\n");
    ShowMessages("syntax : \t.sym [unload]\n");
    ShowMessages("syntax : \t.sym [add] [base Address (hex)] [path Path (string)]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : .sym table\n");
    ShowMessages("\t\te.g : .sym reload\n");
    ShowMessages("\t\te.g : .sym reload pid 3a24\n");
    ShowMessages("\t\te.g : .sym load\n");
    ShowMessages("\t\te.g : .sym download\n");
    ShowMessages("\t\te.g : .sym add base fffff8077356000 path c:\\symbols\\my_dll.pdb\n");
    ShowMessages("\t\te.g : .sym add base fffff8077356000 path \"c:\\symbols files\\my_dll.pdb\"\n");
    ShowMessages("\t\te.g : .sym unload\n");
}

Variable Documentation

g_ActiveProcessDebuggingState

ACTIVE_DEBUGGING_PROCESS g_ActiveProcessDebuggingState

extern

State of active debugging thread.

{0};

g_IsSerialConnectedToRemoteDebuggee

BOOLEAN g_IsSerialConnectedToRemoteDebuggee

extern

Shows if the debugger was connected to remote debuggee over (A remote guest).