unhide.cpp File Reference

!unhide command More...

#include "pch.h"

Functions
VOID	CommandUnhideHelp ()
	help of the !unhide command
BOOLEAN	HyperDbgDisableTransparentMode ()
	Disable transparent mode.
VOID	CommandUnhide (vector< CommandToken > CommandTokens, string Command)
	!unhide command handler

Variables
BOOLEAN	g_IsVmmModuleLoaded
	shows whether the VMM module is loaded or not

Detailed Description

!unhide command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-07-07

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandUnhide()

VOID CommandUnhide	(	vector< CommandToken >	CommandTokens,
		string	Command )

!unhide command handler

Parameters

CommandTokens
Command

Returns

VOID

{
    if (CommandTokens.size() >= 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandUnhideHelp();
        return;
    }
 
    //
    // Disable transparent mode
    //
    HyperDbgDisableTransparentMode();
}

CommandUnhideHelp()

VOID CommandUnhideHelp

(

)

help of the !unhide command

Returns

VOID

{
    ShowMessages("!unhide : reverts the transparency measures of the '!hide' command and exits the transparent mode.\n\n");
 
    ShowMessages("syntax : \t!unhide\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : !unhide\n");
}

HyperDbgDisableTransparentMode()

BOOLEAN HyperDbgDisableTransparentMode

(

)

Disable transparent mode.

Returns

BOOLEAN

{
    BOOLEAN                                     Status;
    ULONG                                       ReturnedLength;
    DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE UnhideRequest = {0};
 
    //
    // Check if debugger is loaded or not
    //
    AssertShowMessageReturnStmt(g_IsVmmModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_VMM_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
 
    //
    // We don't wanna hide the debugger and make transparent vm-exits
    //
    UnhideRequest.IsHide = FALSE;
 
    //
    // Send the request to the kernel
    //
    Status = DeviceIoControl(
        g_DeviceHandle,                                             // Handle to device
        IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER, // IO Control
                                                                    // code
        &UnhideRequest,                                             // Input Buffer to driver.
        SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE,         // Input buffer length
        &UnhideRequest,                                             // Output Buffer from driver.
        SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE,         // Length of output
                                                                    // buffer in bytes.
        &ReturnedLength,                                            // Bytes placed in buffer.
        NULL                                                        // synchronous call
    );
 
    if (!Status)
    {
        ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
        return FALSE;
    }
 
    if (UnhideRequest.KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
    {
        ShowMessages("transparent debugging successfully disabled :)\n");
        return TRUE;
    }
    else
    {
        ShowErrorMessage(UnhideRequest.KernelStatus);
        return FALSE;
    }
}

Variable Documentation

g_IsVmmModuleLoaded

BOOLEAN g_IsVmmModuleLoaded

extern

shows whether the VMM module is loaded or not