unload.cpp File Reference

unload command More...

#include "pch.h"

Functions
VOID	CommandUnloadHelp ()
	help of the unload command
VOID	CommandUnload (vector< string > SplitCommand, string Command)
	unload command handler

Variables
BOOLEAN	g_IsConnectedToHyperDbgLocally
	Shows whether the user is allowed to use 'load' command to load modules locally in VMI (virtual machine introspection) mode.
BOOLEAN	g_IsDebuggerModulesLoaded
	this variable is used to indicate that modules are loaded so we make sure to later use a trace of loading in 'unload' command (used in Debugger VMM)
BOOLEAN	g_IsSerialConnectedToRemoteDebuggee
	Shows if the debugger was connected to remote debuggee over (A remote guest)
BOOLEAN	g_IsSerialConnectedToRemoteDebugger
	Shows if the debugger was connected to remote debugger (A remote host)

Detailed Description

unload command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-05-27

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandUnload()

VOID CommandUnload	(	vector< string >	SplitCommand,
		string	Command )

unload command handler

Parameters

SplitCommand
Command

Returns

VOID

{
    if (SplitCommand.size() != 2 && SplitCommand.size() != 3)
    {
        ShowMessages("incorrect use of the 'unload'\n\n");
        CommandUnloadHelp();
        return;
    }
 
    //
    // Check for the module
    //
    if ((SplitCommand.size() == 2 && !SplitCommand.at(1).compare("vmm")) || (SplitCommand.size() == 3 && !SplitCommand.at(2).compare("vmm") && !SplitCommand.at(1).compare("remove")))
    {
        if (!g_IsConnectedToHyperDbgLocally)
        {
            ShowMessages("you're not connected to any instance of HyperDbg, did you "
                         "use '.connect'? \n");
            return;
        }
 
        //
        // Check to avoid using this command in debugger-mode
        //
        if (g_IsSerialConnectedToRemoteDebuggee || g_IsSerialConnectedToRemoteDebugger)
        {
            ShowMessages("you're connected to a an instance of HyperDbg, please use "
                         "'.debug close' command\n");
            return;
        }
 
        if (g_IsDebuggerModulesLoaded)
        {
            HyperDbgUnloadVmm();
        }
        else
        {
            ShowMessages("there is nothing to unload\n");
        }
 
        //
        // Check to remove the driver
        //
        if (!SplitCommand.at(1).compare("remove"))
        {
            //
            // Stop the driver
            //
            if (HyperDbgStopVmmDriver())
            {
                ShowMessages("err, failed to stop driver\n");
                return;
            }
 
            //
            // Uninstall the driver
            //
            if (HyperDbgUninstallVmmDriver())
            {
                ShowMessages("err, failed to uninstall the driver\n");
                return;
            }
 
            ShowMessages("the driver is removed\n");
        }
    }
    else
    {
        //
        // Module not found
        //
        ShowMessages("err, module not found\n");
    }
}

CommandUnloadHelp()

VOID CommandUnloadHelp

(

)

help of the unload command

Returns

VOID

{
    ShowMessages(
        "unload : unloads the kernel modules and uninstalls the drivers.\n\n");
 
    ShowMessages("syntax : \tunload [remove] [ModuleName (string)]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : unload vmm\n");
    ShowMessages("\t\te.g : unload remove vmm\n");
}

Variable Documentation

g_IsConnectedToHyperDbgLocally

BOOLEAN g_IsConnectedToHyperDbgLocally

extern

Shows whether the user is allowed to use 'load' command to load modules locally in VMI (virtual machine introspection) mode.

g_IsDebuggerModulesLoaded

BOOLEAN g_IsDebuggerModulesLoaded

extern

this variable is used to indicate that modules are loaded so we make sure to later use a trace of loading in 'unload' command (used in Debugger VMM)

g_IsSerialConnectedToRemoteDebuggee

BOOLEAN g_IsSerialConnectedToRemoteDebuggee

extern

Shows if the debugger was connected to remote debuggee over (A remote guest)

g_IsSerialConnectedToRemoteDebugger

BOOLEAN g_IsSerialConnectedToRemoteDebugger

extern

Shows if the debugger was connected to remote debugger (A remote host)