unload.cpp File Reference

unload command More...

#include "pch.h"

Functions
VOID	CommandUnloadHelp ()
	help of the unload command
BOOLEAN	CommandUnloadCheckEnvironment ()
	check the environment for unload command
VOID	CommandUnload (vector< CommandToken > CommandTokens, string Command)
	unload command handler

Variables
BOOLEAN	g_IsConnectedToHyperDbgLocally
	Shows whether the user is allowed to use 'load' command to load modules locally in VMI (virtual machine introspection) mode.
BOOLEAN	g_IsKdModuleLoaded
	shows whether the kernel debugger (KD) module is loaded or not
BOOLEAN	g_IsVmmModuleLoaded
	shows whether the VMM module is loaded or not
BOOLEAN	g_IsHyperTraceModuleLoaded
	shows whether the HyperTrace module is loaded or not
BOOLEAN	g_IsSerialConnectedToRemoteDebuggee
	Shows if the debugger was connected to remote debuggee over (A remote guest).
BOOLEAN	g_IsSerialConnectedToRemoteDebugger
	Shows if the debugger was connected to remote debugger (A remote host).

Detailed Description

unload command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-05-27

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandUnload()

VOID CommandUnload	(	vector< CommandToken >	CommandTokens,
		string	Command )

unload command handler

Parameters

CommandTokens
Command

Returns

VOID

{
    if (CommandTokens.size() != 2 && CommandTokens.size() != 3)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandUnloadHelp();
        return;
    }
 
    //
    // Check for the module
    //
    if (CommandTokens.size() == 2 &&
        (CompareLowerCaseStrings(CommandTokens.at(1), "vmm") || CompareLowerCaseStrings(CommandTokens.at(1), "vm")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        if (g_IsVmmModuleLoaded)
        {
            HyperDbgUnloadVmm();
 
            HyperDbgUnloadKd(); // Test: Should be removed
        }
        else
        {
            ShowMessages("the vmm module is not loadedd\n");
        }
    }
    else if (CommandTokens.size() == 2 &&
             (CompareLowerCaseStrings(CommandTokens.at(1), "trace") || CompareLowerCaseStrings(CommandTokens.at(1), "hypertrace")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        if (g_IsHyperTraceModuleLoaded)
        {
            HyperDbgUnloadHyperTrace();
        }
        else
        {
            ShowMessages("the trace (hypertrace) module is not loadedd\n");
        }
    }
    else if (CommandTokens.size() == 2 &&
             (CompareLowerCaseStrings(CommandTokens.at(1), "kd") || CompareLowerCaseStrings(CommandTokens.at(1), "dbg") ||
              CompareLowerCaseStrings(CommandTokens.at(1), "debugger") || CompareLowerCaseStrings(CommandTokens.at(1), "debug") ||
              CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebugger") || CompareLowerCaseStrings(CommandTokens.at(1), "kerneldebug")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        if (g_IsKdModuleLoaded)
        {
            HyperDbgUnloadKd();
        }
        else
        {
            ShowMessages("the kd (kernel debugger) module is not loadedd\n");
        }
    }
    else if (CommandTokens.size() == 2 &&
             (CompareLowerCaseStrings(CommandTokens.at(1), "all") || CompareLowerCaseStrings(CommandTokens.at(1), ".")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        //
        // Check if any module is loaded
        //
        if (!HyperDbgIsAnyModuleLoaded())
        {
            ShowMessages("no module is loaded\n");
            return;
        }
 
        ShowMessages("unloading all modules\n");
 
        //
        // Unload all modules
        //
        if (HyperDbgUnloadAllModules() != 0)
        {
            ShowMessages("err, failed to unload all modules\n");
            return;
        }
        else
        {
            ShowMessages("all modules are unloaded\n");
        }
    }
    else if (CommandTokens.size() == 3 && CompareLowerCaseStrings(CommandTokens.at(1), "remove") &&
             (CompareLowerCaseStrings(CommandTokens.at(2), "all") ||
              CompareLowerCaseStrings(CommandTokens.at(2), ".") ||
              CompareLowerCaseStrings(CommandTokens.at(2), "vmm") ||
              CompareLowerCaseStrings(CommandTokens.at(2), "vm")))
    {
        //
        // Check the environment
        //
        if (!CommandUnloadCheckEnvironment())
        {
            return;
        }
 
        //
        // Unload all modules before removing the driver
        //
        if (HyperDbgUnloadAllModules())
        {
            ShowMessages("err, failed to unload all modules\n");
            return;
        }
 
        //
        // Stop the driver
        //
        if (HyperDbgStopKdDriver())
        {
            ShowMessages("err, failed to stop driver\n");
            return;
        }
 
        //
        // Uninstall the driver
        //
        if (HyperDbgUninstallKdDriver())
        {
            ShowMessages("err, failed to uninstall the driver\n");
            return;
        }
 
        ShowMessages("all drivers are removed\n");
    }
    else
    {
        //
        // Module not found
        //
        ShowMessages("err, module not found\n");
    }
}

CommandUnloadCheckEnvironment()

BOOLEAN CommandUnloadCheckEnvironment

(

)

check the environment for unload command

Returns

BOOLEAN

{
    if (!g_IsConnectedToHyperDbgLocally)
    {
        ShowMessages("you're not connected to any instance of HyperDbg, did you "
                     "use '.connect'? \n");
        return FALSE;
    }
 
    //
    // Check to avoid using this command in debugger-mode
    //
    if (g_IsSerialConnectedToRemoteDebuggee || g_IsSerialConnectedToRemoteDebugger)
    {
        ShowMessages("you're connected to a an instance of HyperDbg, please use "
                     "'.debug close' command\n");
        return FALSE;
    }
 
    return TRUE;
}

CommandUnloadHelp()

VOID CommandUnloadHelp

(

)

help of the unload command

Returns

VOID

{
    ShowMessages("unload : unloads the kernel modules and uninstalls drivers.\n\n");
 
    ShowMessages("syntax : \tunload [ModuleNameOrAll (string)]\n");
    ShowMessages("syntax : \tunload [remove] [all]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : unload vmm\n");
    ShowMessages("\t\te.g : unload trace\n");
    ShowMessages("\t\te.g : unload kd\n");
    ShowMessages("\t\te.g : unload all\n");
    ShowMessages("\t\te.g : unload remove all\n");
}

Variable Documentation

g_IsConnectedToHyperDbgLocally

BOOLEAN g_IsConnectedToHyperDbgLocally

extern

Shows whether the user is allowed to use 'load' command to load modules locally in VMI (virtual machine introspection) mode.

g_IsHyperTraceModuleLoaded

BOOLEAN g_IsHyperTraceModuleLoaded

extern

shows whether the HyperTrace module is loaded or not

g_IsKdModuleLoaded

BOOLEAN g_IsKdModuleLoaded

extern

shows whether the kernel debugger (KD) module is loaded or not

g_IsSerialConnectedToRemoteDebuggee

BOOLEAN g_IsSerialConnectedToRemoteDebuggee

extern

Shows if the debugger was connected to remote debuggee over (A remote guest).

g_IsSerialConnectedToRemoteDebugger

BOOLEAN g_IsSerialConnectedToRemoteDebugger

extern

Shows if the debugger was connected to remote debugger (A remote host).

g_IsVmmModuleLoaded

BOOLEAN g_IsVmmModuleLoaded

extern

shows whether the VMM module is loaded or not