From 2f5e49819dabc3bd935c18d254a93a30f3e26157 Mon Sep 17 00:00:00 2001 From: Admin <2762713521@qq.com> Date: Fri, 21 Jun 2024 23:52:18 +0800 Subject: [PATCH 1/4] TestMergeHeader --- gengo/gengo/package.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/gengo/gengo/package.go b/gengo/gengo/package.go index fe493ab99..d9e05ad01 100644 --- a/gengo/gengo/package.go +++ b/gengo/gengo/package.go @@ -20,6 +20,7 @@ import ( type Package struct { Name string + path string Restorer *decorator.Restorer Files map[string]*dst.File Provider @@ -60,7 +61,7 @@ func (p *Package) Fprint(fn func(path string) (io.WriteCloser, error)) error { file := mylog.Check2(fn(name)) p.Restorer.Fprint(file, f) mylog.Check(file.Close()) - stream.WriteGoFile(name, stream.NewBuffer(name)) + stream.WriteGoFile(p.path, stream.NewBuffer(p.path)) } return nil } @@ -154,7 +155,8 @@ func (p *Package) Print() { func (p *Package) WriteToDir(dir string) error { mylog.CheckIgnore(os.Mkdir(dir, 0755)) return p.Fprint(func(path string) (io.WriteCloser, error) { - return os.Create(filepath.Join(dir, path)) + p.path = filepath.Join(dir, path) + return os.Create(p.path) }) } From 50120d6db6efb9da216055ca3e6e49e091cf26dc Mon Sep 17 00:00:00 2001 From: Admin <2762713521@qq.com> Date: Fri, 21 Jun 2024 23:59:22 +0800 Subject: [PATCH 2/4] TestMergeHeader --- gengo/bind/sdk/New Text Document.txt | 18 - gengo/bind/sdk/sdk_test.go | 106 - ...9cd6ba37a3d23a1daf6af984d0f8df2da70838.zip | Bin 23926 -> 0 bytes gengo/bind/sdkMerge/HPRDBGCTRL.go.bak | 1634 ----- gengo/bind/sdkMerge/New Text Document.txt | 18 - gengo/bind/sdkMerge/bind_test.go | 333 - gengo/bind/sdkMerge/bug/CMakeLists.txt | 9 - gengo/bind/sdkMerge/bug/bug.h | 121 - gengo/bind/sdkMerge/bug/bug_test.go | 20 - gengo/bind/sdkMerge/bug/tmp/bug.go | 95 - gengo/bind/sdkMerge/combined_headers.h | 4213 ------------ gengo/bind/sdkMerge/merged_headers.h | 6008 ----------------- gengo/bind/sdkMerge/tmp/vars.go | 1 - 13 files changed, 12576 deletions(-) delete mode 100644 gengo/bind/sdk/New Text Document.txt delete mode 100644 gengo/bind/sdk/sdk_test.go delete mode 100644 gengo/bind/sdkMerge/93081c5cac5595c980312ec52e6ca8ce-d89cd6ba37a3d23a1daf6af984d0f8df2da70838.zip delete mode 100644 gengo/bind/sdkMerge/HPRDBGCTRL.go.bak delete mode 100644 gengo/bind/sdkMerge/New Text Document.txt delete mode 100644 gengo/bind/sdkMerge/bind_test.go delete mode 100644 gengo/bind/sdkMerge/bug/CMakeLists.txt delete mode 100644 gengo/bind/sdkMerge/bug/bug.h delete mode 100644 gengo/bind/sdkMerge/bug/bug_test.go delete mode 100644 gengo/bind/sdkMerge/bug/tmp/bug.go delete mode 100644 gengo/bind/sdkMerge/combined_headers.h delete mode 100644 gengo/bind/sdkMerge/merged_headers.h delete mode 100644 gengo/bind/sdkMerge/tmp/vars.go diff --git a/gengo/bind/sdk/New Text Document.txt b/gengo/bind/sdk/New Text Document.txt deleted file mode 100644 index 35990dd88..000000000 --- a/gengo/bind/sdk/New Text Document.txt +++ /dev/null @@ -1,18 +0,0 @@ -func Test_transFile(t *testing.T) { - includePaths := []string{ - "D:/fork/cpp2go/test/hyperdbg/dependencies", - "D:/fork/cpp2go/test/hyperdbg/hprdbgctrl", - "D:/fork/cpp2go/test/hyperdbg/hprdbgctrl/header", - "D:/fork/cpp2go/test/hyperdbg/include", - "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/MSVC/14.40.33807/include", - "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Tools/MSVC/14.40.33807/atlmfc/include", - "C:/Program Files/Microsoft Visual Studio/2022/Enterprise/VC/Auxiliary/VS/include", - "C:/Program Files (x86)/Windows Kits/10/Include/10.0.26100.0/ucrt", - "C:/Program Files (x86)/Windows Kits/10/Include/10.0.26100.0/um", - "C:/Program Files (x86)/Windows Kits/10/Include/10.0.26100.0/shared", - "C:/Program Files (x86)/Windows Kits/10/Include/10.0.26100.0/winrt", - "C:/Program Files (x86)/Windows Kits/10/Include/10.0.26100.0/cppwinrt", - "C:/Program Files (x86)/Windows Kits/NETFXSDK/4.8.1/Include/um", - } - - path := "D:\\fork\\cpp2go\\test\\hyperdbg\\hprdbgctrl\\code\\app\\hprdbgctrl" diff --git a/gengo/bind/sdk/sdk_test.go b/gengo/bind/sdk/sdk_test.go deleted file mode 100644 index 215ddf1fa..000000000 --- a/gengo/bind/sdk/sdk_test.go +++ /dev/null @@ -1,106 +0,0 @@ -package sdk - -import ( - "io/fs" - "os" - "path/filepath" - "strings" - "testing" - - "github.com/can1357/gengo/clang" - "github.com/can1357/gengo/gengo" - "github.com/ddkwork/golibrary/mylog" -) - -func TestName(t *testing.T) { - mylog.Todo("test bind bitset") - //typedef struct _CR3_TYPE - //{ - // union - // { - // UINT64 Flags; - // - // struct - // { - // UINT64 Pcid : 12; - // UINT64 PageFrameNumber : 36; - // UINT64 Reserved1 : 12; - // UINT64 Reserved_2 : 3; - // UINT64 PcidInvalidate : 1; - // } Fields; - // }; - //} CR3_TYPE, *PCR3_TYPE; -} - -func TestBindAll(t *testing.T) { - mylog.Warning("cpp stl not supported") - root := "../../../bin/debug" - root = "D:\\workspace\\workspace\\branch\\gui\\bin\\debug\\SDK\\HyperDbgSdk.h" - // root = "D:\\workspace\\workspace\\branch\\gui\\bin\\debug\\SDK\\Imports" - Sources := []string{} - filepath.Walk(root, func(path string, info fs.FileInfo, err error) error { - if filepath.Ext(path) == ".h" { - if strings.Contains(path, "Examples") { // todo bug:Imports dir was skipped - return err - } - // mylog.Trace("binding", path) - // mylog.Call(func() { bindOne(path) }) - Sources = append(Sources, path) - } - return err - }) - mylog.Check(os.Chdir("../../../bin/debug")) - mylog.Call(func() { bindOne(Sources) }) -} - -func bindOne(Sources []string) { - // todo "需要实现处理多个dll导出函数的头文件问题，" - // "是像zydis一样合并头文件还是修改gengo支持的方案好?不确定，都需要尝试一下," - // "问题是输出文件是一个而不是多个" - pkg := gengo.NewPackage("HPRDBGCTRL", - gengo.WithRemovePrefix( - //"Zydis_", "Zyan_", "Zycore_", - //"Zydis", "Zyan", "Zycore", - ), - gengo.WithInferredMethods([]gengo.MethodInferenceRule{ - //{Name: "ZydisDecoder", Receiver: "Decoder"}, - }), - gengo.WithForcedSynthetic( - //"ZydisShortString_", - //"struct ZydisShortString_", - ), - ) - mylog.Check(pkg.Transform("HPRDBGCTRL", &clang.Options{ - Sources: Sources, - AdditionalParams: []string{ - //"-DZYAN_NO_LIBC", - //"-DZYAN_STATIC_ASSERT", - //"-DZYDIS_STATIC_BUILD", - "-DHYPERDBG_HPRDBGCTRL", - - //"-IC:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.26100.0\\shared", - //"-IC:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.26100.0\\ucrt", - //"-IC:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.26100.0\\um", - //"-IC:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.26100.0\\km", - //"-IC:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.26100.0\\km\\crt", - - //"-IC:\\Program Files (x86)\\Windows Kits\\10\\Include\\10.0.26100.0\\winrt", - //"-IC:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\VC\\Tools\\MSVC\\14.40.33807\\include", - - //"-ID:\\fork\\HyperDbg\\hyperdbg\\hprdbgctrl", - //"-ID:\\fork\\HyperDbg\\hyperdbg\\hprdbghv", - //"-ID:\\fork\\HyperDbg\\hyperdbg\\hprdbgctrl\\header", - //"-ID:\\fork\\HyperDbg\\hyperdbg\\include", - //"-ID:\\fork\\HyperDbg\\hyperdbg\\dependencies", - //"-ID:\\fork\\HyperDbg\\hyperdbg\\dependencies\\phnt", - //"-ID:\\workspace\\workspace\\branch\\gui\\bin\\debug\\SDK", - "-I.", - }, - })) - return - mylog.Check(pkg.WriteToDir("../../../bin/debug")) - //return - //pkg.Fprint(func(path_ string) (io.WriteCloser, error) { - // return os.Create(path + ".go") - //}) -} diff --git a/gengo/bind/sdkMerge/93081c5cac5595c980312ec52e6ca8ce-d89cd6ba37a3d23a1daf6af984d0f8df2da70838.zip b/gengo/bind/sdkMerge/93081c5cac5595c980312ec52e6ca8ce-d89cd6ba37a3d23a1daf6af984d0f8df2da70838.zip deleted file mode 100644 index 07ed70073cabf232546bc2428665322f723c5eaf..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 23926 zcmb@tW0NjSuq-;ZZQHi3HMVWr&)Bxt*tYFiW81bpbKkw=-17@gf9UAwi0-WD57iZ! zS&FitU@$=cGv2BfH2-(;eQzLT@BXe#pHd7{ZE>m+BQzK3$E>uVhwE(Md=<-^EzW5QwbddgC@5< zcRMLd@NC2FPb09F_4z5B@aqwQD*R>Za7hOQ zo3guD0fn@xF{bvOXs@y=$9Dw)3hNu|lSOZM!fJE{VdLA31?D#LWnG=cKuAk)WM71@ zJK!NH*!%e^zG|*3*T=Ra<83ytXX6d>&(B@BU_EW1r;Sq++$jM;v&g_maxC_`KGXdwNs0E+75*|eK zCgEBeKxbC-nwRL!=~|~+_bph4vaD{`_x0to2yCiJscIV!;Cd14bodZ)Jt5%#bCd4p zQ({uHu-PrcUbFD(l`7vXGbX7>t5&mkiNH8U@A1{tTt-n^ss4j}>>x~VL@X_ekPSuNI zC3|LgSK_*CAP-&9-Bl^I@zR&7c5zn3>GARvXUO(j-~ZeGmPV&9+o129t?@Z~)&&El z_V)J?j(lJz4}2c*yBQ|`LhIT&`;*Ks=s)9cI2-@q!^?mnxuIaF*5OY87L=5V58Zh# zqWPt&=~F8_{%y7y%(NB`65!ZK4yO44GI+ki<%@=-?*I*q(GqZHZUbcpyx(Pa&eVy7 zv}6C@W?8`9cN&r*Iuw+ojz|DHDG{Cnbf7wB)l4#YzCn+nKUUBQRMn!+tnpml+T-uP z+Ew#!(%nx~CFc*=&#Cz4c3{-+$6nn>4x~==JDfI`Xb4tYH#qoG_phP(Y{Iy{y4v32 z`M#^zl$*hVU*D8@F0uc4`3CWQOE;ASd6ooEeEc~pjD$-z<$xVipnD#k{97nR$7E&v z-@&+eMH5kyHP5io6*usU|>mzSHtY+*;`)3ygHCgR*TW!Mog~& z2(_&5XdYI?amaOtu`~zvsW#M~>-T+^9>t22*7&g%3gf;R|D@$iCB2*YG>66kL<$*S z%zyrk8kjzMFQ}@g&%d+tj|RKz6+4=R)<~a&ct!Ky?>%Sav{B$VjEm??GP4y4Obf!) z#={6&)$Y^q%bEEHTYX!OH&bQZI2F2Ydn1>M20R9iC;!mze{X#qy~cz*+;M}|0bK5# zm^HN~QC)Vi#elOnrK9Z+TP$x>#Z|43wvy1N)OvRp9XFL6`Px-ZPXBR=sb`YWroqW< z--pA9?S5!;2Bb)Ck}zzahCBmN-WqW@-a#I%7zLD;T@kH369d}fzU~}* zb3THQAfRWzA|cW1cbt#Iw@d{GCiUfBA(XB{*{JUjZK+Q#1lO36y&CeS5ljSgW9Uw@p@oxbDnHEs^%Q|7r;f?<8o1 zi^EUZdEMIBEz0dH14~9Yatj0@OiKA71plQzNp3gST0N`j>0XW)Os&ruc{FB}B@rHJ znt$(L#WLV|E@fTY-Q_p8{)1*zPGc8;PL~16d@9&~Ct9DuKuEIE-3z`(gh4h5^)KUb zf(PzfoX=-Cx^9HUobz%7Y{2wX1H^_>uScM^1R0xT_45a99U4Qp(brK+?9Jgsd}3n{ zHi|KU$n=Mw2$kQWA)VM}u}^<@=c6E4Eo`SIdRp%+65mha-ZC+vqkY(;;PwwTB}jDo z->*>3NPSaT*EZeRQZdS!55VVs(l!3TxiNGR6d?$f36fwLu1tP9VXcTF zWf_+}i@#PlJ6XzGUqD43SHH}#e(m8hjzptwIBH+S5r5^Gau1vFx*qf~c5~d?_5<+I z#DUTi5;G#z3~^&*o1w=JKQyN8HLwkXy@kMO08Kk>!BmWGxNc^dYg>mReG@mWSQnE`! zT$kU^nRG!`_l}O>XUG!}gs&85bC3Cf7KgX87wOr{VzP!a76}`tjvtasEGcE8x%(ckFzbHTEwMQ87Ee85LEQ8o|y5uuI+Oo{Y1_RMikq)Ao>x-eU> z-tQeCTYP?LEA1|f)w5TQL!)hb874A1Y9kKuH?ou6SbuK6u`5rG=*eL+U(3;qP*cn zR)#dhZb|P_8(sJ@IA?k%ULfT3#p7Wfr|SrMkS$~@@GaD#;AnZTE7dO^PZ*~%_bL^M>AfXaJ1oi% zS9YuE(!W>8euN@7m;=vQ3U@t{wjy^%%)SWO1({3(cZsvySiD%Ab_-Y|j(zVKj`#Y- zdat!*zDwh$hs6rOKr<^Zj@3k)5_Nn4ozg!DJ(enP9s3E?f1t{_AWm5~F+EoIpcd zuHaek5F0xHtxbm1gcC}&G4O)c7aR;<-iH%=i}^FOm$$f-zfr$R*kiZXLN=~OFoIClTUJd7&*SBr+2ODqFf0p4@7W!B zZ|jafTy6!KU-tyZ`VZKET_7zm3=xLMz_Yy@h3i1o170SMu<(+cn#^~J!@ID|^gdeX8AzPM*HDO%nXkT&hc{~t3l*ZvZ zmQcEEwz&W?hSbM@aq(?ek@k*t+6<1&m<>ml?AB}noU@YGFJsJ&v5ROaytUWWgb7cs zNCZ!M&|jvqd+s}gT*LP_V>4QH^j%yvOQ9u*B%Mnl<)jCIWt~2R-?X0Y+Lb94jw;p! z|G(-}KnksZgD}j)O$N>?uaf}!Sdr$(Cb8VpEWS3tJbB>Yxc@i-*YoSQzU-+zm)_uv zfU_;-1|7-P*SpMCe}8LI{370xmBT*cs!}0K8Do;6L+JP2K(~<8E5^i)Zv!OlHs8a$ zNgUUc`jz>KlO4X{^c20wkSviz@=KMlWIc9u+J63yWYO57TlSALx9Fl}ikD5J$+m=h z3V}=Cs?DLj`_uc=_4&Eg^%HM5#OM11rr6=>e?95;Gpz52R8Z zCuj-Wg;Ug<(~ffscZM9YC=|A zeLpLv5Fs@ALSO;{G*zKXHK{8i3wb#y%Oah5H~;Q-o=;pq=bC7QySBaRY02oH!~vW1 zqRN#AhQiOmMnzE99f$TkhxHqmoV?iH2Kui>x&?NJuyJ^?Yx`NSjExguZs-?Nmwn-9@q4no`HEws?@)73(Gj-`gBD~Zda{nxQM0{|r{2eQGXML41 z%w-*D5LSUBqy{0W3J4gqBlqJzEX7=k{m-?(wOP>muv)TQFKTxe7S4IIJ_fXz^#f-@ z)t#INYY9#InInW|=vLc2`k$Gz-wy=RZtza0kiZruv-^{f2=F|eXltB23*&E#k4RL6 zkoIqWhkD&KBM9*^Q=z}68DePuSUFnKojyL3WSHuQ+*opAa0(0Q6?)C}r_s)*5 zU#sX`1CEycO{%U>mVai{eKIsYYiitS>t0@4H>SHc#?(<>oT~_R#<;5yCEprn{puglLf|0!rWHs zc)XTt7WEyD)Y@h~)!Yxn-7bd>T0UMb*e{2N%(GOsdG0|W4(>pAmXI)1U?>y6oze>L`;khkV_$w|7=UQfce%XnV4excI+BXo#hA95n;%}F3I zhnLz@j6tz1U$@TlOI5S`?BDl|O#ki)w{KpYy~H@nY<-NuGnZ1bh z5KK)djq?fo;YK3L9|G*CGKNpp_($k+whVV2St;_D$r3)787F@`FrN^mZXVRBBym>2 z#&oA0b2X4n!^2;CY_fA3B$Df5L0r2{^4l-+CWJ6%22%kmtMS}^!2mEfl$}K5_mIak zRUv3{Gx>MVIDorXTqEuZ+^bS0M<`33E9y>bWM|*zIL;vmsd!F0_WdvAk4&dC+VlC> zlH&)JzwX6VH@jo_Ve$snBt*>xX&eD*iZ^nft$&P&Jt^bG`uABpfWIRXxkRk(4%5cHeotb_7joB@z8@WTq^o*(lTJ`0>=%9%^ zr{h}&fi?2IxV1b`ERfkO{i~6+aHn@w0_LkMZH3sC5$3@ifzJiz|Gv=>VKc-R1y%1g z#H(g^*KURQ)0HZ z-C-%{8vI-`JB+~C~IJHe@azudqrnV^8pOTYSL)H z;-8gimBrR(=7dnc7!x7Ce(AMocR*-_eaO#oyQVZ0E`Q=5#YU2~OO08?qoy7+bPu?a zsN&@CSaW!krQ(z|%{`rq=kQAI{xPYzb5l65OV-PN4Pie49VFgAPgDQ;H|I?!eVjhG zURtt;2PY2QO&5AUt=$Ia-G9Kh!J7J?lg7AjPwM3L)+{9vsAkd&E796e(;-Sv{g)n` zWYx>718IWz!6z(BuR+q{An8N>>=hQ zWZxND4}R!6c6x&qN#RpNB| zdmsL-82W30`3)T~dqfflj^zDUI%)2?_s6fWw~xJ7;rP|0>8ItxekET0z=vMVz)xWr zarhOr=||O%^Rn;w;Nk4CLhIM(dAl0mOSad|aY;xxbzAYle*gWa@+a~uuM$Ah3rMg0 z)%FK`UQJD3)!{%EsLK94Gdy}`x!}<(32d~ZsA*rgtM9n_;~-o_zR<0uOqs3(*f#?> zrU7}`zuio~=NZ4QEdY@3H~#4Nie*3EIgN zkE0r4^M!@o7=9aYuLNBGEjaGSBl;k~!oN3zzOH9I^=eePs3*sire87oV-y)P)dFG% zD~Bl^q6OhQhni5da2KF zNpS@W*bm=LDN3k zA~tBkbX&O4U*4=aVh5tzEH3-k1h6AJ;4ZuSJ-pFK94;tUIfSQtU&z5+|E66J!Kp>2K~nm?PqG|a|F^MNe$nP5dEpVUpoqDjnJxG#ZK3?awG+!1vf(&9QCZy=)yPj#nOXHxH@}b7JZH zBY(#!jEBC~h3Ot6Qw{eF_B9I)$kdu32y%FQf;9?D^z6XO1QRQIL_nab>u8ACJ_Z65 z&GP_8)axj6UoMXa4^ce?fH}#FF*oX86!;vL{#HCLP;IroLY0@xmyR59gt9w?!tgun zF7o`=B|D|#1nT$5qHjENyAN)hSq|z!fsN4FW?p3KO{|+Wv1ezcLKc z-mAx@;hciX>?Y}96$39=qsq_;7n*PC2iNV~85ADq&d88=S$i8gOVQ5VeaT>u;O9w$_U zl#1+uje^^*SXs;wENl47kv(vlz#tXc%mg@Dw1MO(`SSYyP)5pw4+xn>l~+rK3oqSD z@1Ys7YmnN94h--6Hwdnuu&1l!zt-;-M=1zT6 zV9+fAeHq)WqtdQIM$$pOx$=NF=5u}nX=3xz@{s)BStbV60H1J}FKFHAKN&4E*ob;` zBz4^awfp+aTGlh6`q zP)x6Ja6;Jooo95I!rdXL;G;NbNx|~TJgn;d&8*glI(~-SFwl{ee+NRKy}fv3S>{)< zMD>|LjkOm5Ea7~7JTnC`@|mtVWj$p0ptd`8JfIKgiuO%^n7ADFeZ+dWB1rJ4k*0C)@f-Iv^R94NNEG*9CWR-o#_>pW!fe43r*xL?L!q7obozDzv+AdFldOv^N1LO4H}`e ziH{^Ca}d9Jm1*M|WDItuBzLx#gq}DTycWtE+&AqAoAAogYV*{oWi8~8Y)6;L8^jV! zpdq_C4}EaVJ=9IXQ33H}?UE=oFb?wPb#P^;=U&k6e?j(7`^af-b&jfRwam;oC`u?N zu#1Vd)yNSwB0Z_)*Xv(*q~UZay>N6`?oxfxYBQNbr`(SRR2)hDp0ZY3g~$|GMWxHI zpGP`EVZ|AOjh%|ROR%avmJ7lFu34GfJk*_*tjuUrQ(}&ywZbBq^95&OL=B?rc1Fd? zeEjwY^ho3>-Svrc*<|0zOku%V1dt z0YI)gZ-`0n;%DyHp6Pf*Aa3uf$8&iNwB%#GP73R6`-Ew*bIE+-wNP&Ox91D-7_%nl z_JN$xmUO-8MsJ)Wxv1IlF(@uZALC4tc}W(N2FNRgECl630XIw{@x)QWX6M`rQ>;F5 zp#n(2$?Cg!4FK<@U}XMTK=5s^*tK<`e!yuh$DuVu0o^SaW|srxm_b%V6coG(|GNSg1pJF9wA*4pTfD!HH%2S2^OAP&!=NJfy?=)pJDC65{A`c z%!V7zGXs7~Zo{SrPR%2RZ5APej*yJ^Xx~p{+)*6$ z0f>?4EmjgtcDtyBj=TX=3Y0T4h|vBrFTs4)Z_GMu#ON>8&)L5`2J}QI=YkATOHJ zlYjETQln2J89RA~V(?T7$N%H$or^yVw(`+W2ZW}#t!I+yiBW~}SxHVU_znV5<) z#GEaPGG@KSB)FGFa5fHat>g;n$P=WuwDXK_O`|_<1X$P;|6^-tWY8|pE zWMjxt59;hi1PTidcrqWKv%`HS{&}y0iVwvKR<6kXkajolY>4#LeSo_v+Eqd_6EP_Z zqeVj@APA$?4hwkK*VzV_-stPn~YLlU4X?(K8wjKs^siU89bkvUr(d~7{c@~j} z1nb78o;*pLrR7B2Z*O14Jk=JsF?IC1XyL)z<(I&6syw(Z=Rq~_ch!Mkqg{N>ud{i; zzY3Qvn-X}DfUB(cem%TP5;Q(y#JcC3@;;5}?}WUYKR2$D|Lz&m^<9Tz_mb5QpOC}4 z+wRd3n6p7oJP|bwKW5Z?L5}I3^(++>DbP@q7Aa*!=_Yz+I|(X~ zS%l-BG`yimm4@J@SZo3#H$Ycz8oow|og81SXK!Z;{q;`s#*B9D)gSd>Fq^ z3rRtbZr?R}Rs|XAR-x~N-cXV?K^~P&mS{0|ykezZ4bO|#1F=(|xyeiDFVs=qQLQ_v zdQ(!vco|I5Qpy-vX6yzAZJg7Vd@+~|gIrNT+ujZ6Kx;Wb9&Y(m z{G|Kt|eng2NkE{!6 zotH63AOR-jXr5|JlNlFqo**om|8up<2bGCAou!(T)xrgIIA*(d>buUCkhjd&-Bc>` zi0YuOUU3&$e@==0hO&xa2DIHaS6a>64Yi=lOV#x+{_4%p2WvX-DX{-6fKa@s3@9a* zi4`}+TvHC^9|%kv6H#>;J3hKIjU=iU6yj3a@=el+S25ciReNt>113DQ^2UBIK_PcQXJs|cGz zQp&xNnVSSDu#}6V$0`+eCo!7@apW3XFa2+Rlnesj4I3&DS_*jye1X|e2z@}?1Q9PW zPCi5y3P{PWI$3;ROUe=af!NgH;p14ZOOdy$HX3eOKULl}1^^aykc&HLlvVL;kqtE< z!U6$c^D0^3n2ECNMi`BapSE?2F8=#f^YN^x_NM*r%9U#ZkM2t@st6r>3t6tg+$ek5 zkuEctQdaNDIf%IE_Z**7-}D5GqHW<#Ygk&4_Gu3DK*}Lmho&N}{`(vs1wsldb_L26 z_YXOoh1QFh*e&B%r5QMdFeqLI>L-PDS9(K_hF9(WjqhrAA@!To=HnB6Ag65n4G;v6 zPyC=w*WEf6R2^FrjQXwx8niQ|zDP`GW5luQJe|Yxl7<$YS`Nt8mIpiH?a{1Aa0n}z zW?N|=Z=Rxp;=*s(znQ@Atdr7{0cNYpG8bH zfPOgM#ZoCAoFvfx(_#`eGQbUCvDQ8`n=;2H$CZ~||4B26n|nyCa10$s9U_c+4%A%6 zA9JJ$UcT-G%m%XIsK$50GEviwE>vJv<}aSAJDaWdWQBQe`(a@E?-o<*A&;wN*iQOb zH~{=Z!M@0$ICU)ic*aw{2k6qd%A-g2xFJWv$t#c6E<9Jqqv-rr4f(AyXBXBipiLV4 zPCgCw4{T;;XBT~REw&Zs0G0l|;60dwN*i>m*5?Ce=O$R9+`U2g=Rp^9560}5JBn;$ zMQdLs;C41*g;s&grp?y6e&SGHfkc>YP(aPW#3hEBmrRh(4L^s*4&p2YVTgv|nvvR; zV4!j3%9Hlv6OBuM?0mbH#a+q#Ij-$ab)i=9Yafx9*b5d~8j;pGpO=~I*acau=G7F& zmeI*bdRn+{b;ZEyP|a9lD?8COF@5t52}3VQk@-+HLDi#7vVKiwEe1qR}k(<(hQAlcJ8AHW_&lHU6nj))7g;z)RsC%D5HVDTX|J;Kt zmo1dD*c>mNeNL36Z^_o-ZS5pbT201CAjwfffrrycRFl~y? z_By^INZrBqt9FzBsN(|9(yUN4`9UGGLe&w8c^Q zsOsG!6sT1Gk^vKRsSt0t@ihmdSPCh4cU!{LQv$yQpVAg%K> z(){Z45M!wq$nuh0=e<&a4>-m>4fU2(@Trd}tjdvMg@#ie(<44fT?*fZQcRNENwSVK zfYYxYYFAy-Ay5%+KEP~&>^&tN92YokGNQPV{VS5fbkfcYUJ5&ZU%M@XRgW!%bySm7ey9_k*PWKN; zVX+tLP}NmWg5TAxk~M!G0W_+VZ``X#3A1t1+p~yWOjqJI`IuE>)E!*M0g?8%*!39$ z#AtPa|;PaZh;HJA-GJtse3top>KYyqtPU?nO|#xx5t)qJUIySfMzyC8JDBy?d~*((YUrc^7dE-2m<2>=T-bWNP0JvKCdot|sbd3Qfb+ z>K>_2x*El!s)&C#Q*0aWtT& zeAeySY)vO;X(k9OUYQIy2zT$SMFD%Ei0nF6W^VwrNAFXY-5|6#!jvQ^@ZQ3H8Mz>~ z8(T~t?fub)FScjs7B3MRXZk+gDk0^PO3?;}QLI5ntCrQfQm26y?#wA#5s%5n0y|SH z_>|95s4ZLb0bf_M9gkC!WT|vOq1?Db_14jGsL5@Ace$2o?kyA#I{SCs(}Q39ong>4V6448snUW0sr&%sjjd~o-k#z14$)1z^+N)6Mdo0`xLju~y+ z+&IW|Nd9>61yX%_mBU&U({WXA$v{`J!2 z)TZz2T)-pvPS)oj%s=c(fV1`unr94mBwg7MR!+b`+V<<Mny<8Q9yCJTR-(sH$KCWL{fP$GFa)FZbho`AoH~L_-eF4>ZDt3bcwK1JT8o= z)N6qlQbK_^AnG&cF%Iz$Q+Um2iTrq6W_dD1`juT1O?i}S&WU~kms)boYhkOJcza^t zFLd>npJQENVKzv|1lTLgQy=()33SO(z$9D))skO1fKogLQjF=@PI6oO}PFq~fxqtY; zWex6&auQx@J%XSb8O(Z0Aqn0|IM~HfnShO`J|L(9p(eX?CK=Dl+~*vrzxOtE8q=te z%OwsKEfOtE)Q5P6tfGkin06GZ4ts7Qds4Qf)3`wL#6BExJz!+q z_@N3a>y|!@at{5y1m6L5**U~t`1`9|CV~_C)nh357u;!B-k&4?XX&C_833D` zi=Zr6uj15{4w{+^BIQm6)gm&9^x-3UCFvCW6o)^wo57yvtTYJq3d<`m1dSFKtrW4A zO{o7nnDyNnIYt9_6P$@yhW+qay=Gz1O0p|^)}t;GaO-d6cc!`E25tlUqqC;-cU2mm zzJu;@$Oqu98~8TXVxajAGp5%Ei9yz;iu@I-CkXQq{9o!Vy7VQMhXER-FX84Dco#RC zeDNf)zUbV)=`)Q;lv*DkWV@?>@#zLB|7sdDCa`40Z1Xfx1V`QLKdEBP`ou+K#7uu^ zo`5GBjv8}-!flA*mW7!rcvBxu0sEwDuL(k_KLjUo1*VjXnZq8A5AAR9#`7k=po=XKKWp&D3r;Z@>usgQ&~)1z;ESNuGN0`p zS4ftO1AUd*e0{PBU2#U4b$?Y2w2&5Y>OKbrx5l=6#MT`kXWNg*=!67-v&U%f1{UP%=E${}{fS6HM__!o)K5OZI=BJ! zA6e}K&1m(1EP|?+vFU%>D!ldXIVjjP&Hj8@BqV)a{l|i+k1CXXC5K26+C0Su@9aYQ z&PlliOMW=G(t+=sqJ{T;DvcwdeybAmvgDg(J#gDSw4#-#B_N>+E6t}NPLAbS97Yz? z*F0BJmTKRlFh_|sAND&*Nf5bbQ504Tq7|-}e(Yt>s8#Kc$KYXrWT3CjpOWUSR;HCm z;H=oMFeN)rzHCku1f-n^8!Nw14aD#7()+bTr8Zz|NY&RIxWm#T1lT*o$001JxFwi3 z#>l4k(?e<4l3&$KR;{POgl2!5I8hem6|YG$*A7`6MzGi``3m>I^Z^WYH1<`Ma0F&RJuc{EP zuU|w(xqqg6G<3Yk9(uLBT6`E?iV|7VR2|{4XIpuE0DalqnL#sxo6rY|x1q^hl=%#UCAJY?&+-X>52r>Y$@SI<3~=g(J3YnEAy|x#RY2!Vh}A5z zCs5z~TH|h{Br%-2VV}`LDG_04NNXea@>B0~1%xFY$fjL+iuzcfvt(aM5))NT7yg-> z)$+gqK9#CPT(>3ul5oZMzgwe!q)3X_OCrB~3)_Ga10K=vzEcU@$Ko^qdrxYL53pku zQS0}pYgU}#@UU}RPhH<*_?0&Yx?en z$a>K6*ROy}ogoX23!+b-v^Rh)s+jqOg~u!;{G}{dk+-Q}4857iE#tVZctHpM*Qw7` zm^@&E8FVcyFw*`_IQBr;xReU}IBSzqm1JkK z$U7*EK|=ho-wa8igsz9_VJyM+nPh$_tZep>vi!7yZTuvMsZ*JLNng1leuPYul}H1B z8r9XE88XF;b4cSIwcms@PcYFVFTeItD<9MEi&-%#ur0z1>|UH{5B_=hkkay0%U9es z6n^e_xHje*)zt-k00PX1>HfWR(gk|~9|K2@U+yHeNOlrT0QA&)tHMN^-XeyD(6Kt^ z2Q|g{n$83Nfm5UnZK^?xv&ZO*8{$X%u`@8bry|}+SnD>y4x<8ACRxgciUGF!cQ_qF71Dbp?qbvKN zFUE}{@;go0Hcb0(<6|@(53W|Ma+48cM{`mAX{A4M-a`(UC;<=2hq|yEzk=|7 zd%VkJ4^Q7@K%}UO~mL9_X-the2r*_+B}%Mj(m#WV(mznat56c&2{rXpZz0>WyH z5}Aa`A-oTzu&oosR{6Pc*_KD|X74WyMJCx88jghjcF=<^6guyORmOL9z9yCM>}?dJ z!oIoJo#rZn@0O)$fQ#N6(xIsKUKgRBx7xUH{`(dflEJynJ!eyo zvK{G9dE=1jS1qzWp19(&9Jm9Ko0~qcZxDX7x_+7xt&T?!UYR{8pmcd zcFH_Dq%Lf^5!0C47v;(+geRiB8-}N7o03?KKV=)&@?TE{-PGq{+70V^+`+#s5ln9^ z&U1@=w`Vh*L^*|Rs^GamSSJfgI$AQ0 zrxH0en}l#B1UERuf1kI3oDPJ8TDpkita%Pef4Z2R!+YW!la}+&H}+3S{7&gh(Y(&H z&zMOvBM=zwJT$Y+G;B{rNSwJX{i1Daq!LRnc%&`RX6&XG z1Q#}8HZS-~HaAY`tZ1J`hfqr1E#KB~n|k z#2lN(8yYU{d0@1n8JY9@*Hc#q?JStN;n*JJZgS3D14y6sWV)m>G-XY-b_< zPy+>h6qN37Plf<7_kg53A>9$Y4p<;&010~)p6Bl*D+I`%I>1!+3o^l3;8IdP0v(1X zz;FNk6Fn~Z7bg2-)Nh8Ux2v=(sxK3VE!>9}p{KHNTso}AMM%Ei{ zC{X-|vIr?ua3d&EWXwi`vqYfyw%hN)Nx|-dLVsb}qOrb=>Sm9AR&%8=>28d+_WaMK zVXJ6J*2xe*hvGf5<_>p8%RYFc6keXg&au-fcr}~DGkKM$s{tAY=bw2BU+7pn@{_JU zbK{3`mZ=l&+q^Tryr)zMKDI<4U>txDJO$|)3>ED>(7kLe@hMBy)qLB2pgv+1$M~Ok zw2ccdbV~4g$sleyOv^A~J#ij27)C4l>V`Dild3Q7z<=}7i4KB6L7n~7T4e4#Hc%8< zocgVQ>sQE*ZI|rQJE?4f3tkWP02^8>hC4_spdylWfqkG*e*}OxU}F;$j1Qd-v3!Zi zs2?~-0Ga*kAxfK>J@ev4op*L?OPNZW+5>FwB>1&gBd(MG=QiN$GPM7mbi$Srr-(su zOgogk7nP||Etea&apTYG-1B{CD$*3)x}nHXjXbf_d}v;54IZHccuNWRMzVSj=YG6A zA-#)*F7xQplM+C#Jq%F|;e@_$uZ|3C5spWE#Sxt(r* zLdywsS#k~$kb-uR={JB2pKD^tsX!T97V@DOKVig4VSB$bEqGG;XL6s?KJxxr^KyXk z6;$|Jw?De5?LQC(#SDXrU_<6L=|*95K(+llq$9O_;tnC7&J;g_iLPHtQ;ENxASNCQ z2ttHMm|)MY)X9fS zsymSF z`1fWV%f!Y8NKb$6Gh}RCgB4~{TXRZ%qySCV^}@*rho!8VS-1=qIiZgi{Ano4`KPSG zTJq|REPJW=ByVAW8Uy!SA^t80^5>7~lh>49Y{ZoOJ+WP@iW6RnI*3x_m@HaXA?_jj z7dAhrce)567y-CpnMh2otvP?gb^mDQk~(n_L~`07IoJc~ghz*cNGR>(1uBg+jWtF_ zW0H}olPb|2K>+k~pr7O2?!OU9@8^OdcF~&PU6O*0K(~&Qfl3>KZm$tKD08s?q%1n8 z)ikglx+$-@tl4iXpzLHQ@9kHTC(gPwseHl@w|9_L=HAvBXl?NHG}Ta%#Ei8W zi5w_(hy(F;MT5x#8E{T1{#|-zajWxgp((OXXkW8PT(aw~p5jy~_L+#6h0OfWBt77sU}tIQvTlE*8$H znzn8uLymo6ioSP47rl4zZCbbp&%0KW)H^1YsWgXZUXJ%mQZ8kASj4q>%$rAlv`bNX z!~p`l&yQIZ&JL|FD%Yh<5ryum_BI+@lN+V&WwwG$x`!--n#<&1f6S2SYJN9MpeIfC z{%fAFnwhT38*5Y=0V3_d%ULzD#$?Di_%a-!T2zk|0rYFd?b*`9x%{_p!8_qofTFjr$@`*BiY`Q)@0}5%kZt0zHD+(cBMCm(~ zo_eOeF$G92s;SkFC1O zLXV6iKcGO>!X?TkrE;38B;$`DR~ebYw(p>)x;icXXirJ~n>T+2av|AM1u9#&(jFlH z8>hY$-OvBrmoQNn!`XBf9OiPbkTL`kL?gYtg8U54nVz}&977{WV&KE~aPdgt%aT!sv?xyf)f+^TG)TmIVZ+=`mvbT|+Yrw?$$BE6i_=XI( zYUZY`57*ARDtCMfWg+s~{A`}!_Y<}WxyMzkx&m6>arfM45(9DI%euOshp8oy3Ki4L z9DaE5C~@e(wS9$fKJdrIi^d$^q~!T0oDJWUhqxRr^zIFAtM79b8Sl0Z@12HBBH!ZG zuq9GHX@M~a*nPBOary4ZZI}mjFMea4VUZT8mhBAbckj;1(qii_@}_>(MCIByJRXx} zVeW`MU3rwY+`*S@;ghYv_I&yfo%xy8HZjxq^QTI$Mc<8ly&Au?Mf8a{yU6my{@Gsg zOaUAfg@Pcc>ROpjaX_~TH7Oku`Rbj2vTjn|ccmSEGKuQF*VRm0SiBfLd?}NBdxH7* z*Z~h&`9K^le&d;YUS~Sv$*~tR2_weZ;Q-ooEQNSba+at!3pRsn^lV_6Oi?F=jAU~+_kKr)J?X>_*ilR!_vt+jm)xrqF9#8R5KX$QhzS?rHR3Z_#BhDg5= zM?v5Ur@{|vYgfm++qzy9^2j{3v(d$lNc|WRl-0CSdi_CzPVUG=@GA$je!#~&fSha! zZ!OIdy>&p-ni))zAamSrPGEg6OmOaCF|LwleDSSWa1Re5#E)py1DXQ|c29^|p_;t@ z$m8Kq4)-~o%GJ!(7VTa{5mzH=tO@L?X+84LMv-kj|IIAyw00@m9kO`7DgR{}Ek^%2 zE}1UX-6m3Uw=gw;vHdtI=q-+al(w{oaEEUF_ag&q*~?3fy(5XE$S3smvInu5zk?(5 zN2Y0aE>_CPbE1+oMc0DgIOQ$2yK$xUcIX9&(w10ZPJ=hkev6x2hmD;MSoeqY;Z*&bB$~ji z@>|Cf`J&xM^mMW34~#y}z*VtTcNa_drw?dejjR;2JT37r?ei(wZk=Nab6v8dkelmkY+TSL<@ay5 zpsv3OhLc+S`tkGs0wo_<>tR|s{G)~zxzR( z;Q2AdL8`3L#eq8Io!T;CeNAL~6GKL6l7@FY0GXAeMLwV9vXS(@XJ%aW@g4p!qGBvSI?WK!KjpM+4kVOhp z?2-9utjxOWT8To5wNZh1|FIC5s?Y)|kI2XHCu__}=AVv;KN+PCyTh*}>xqH!dM)4y;wYPu&B$L=D(-2&g^GF18 zAOU9LZW^^K)rH6$liRG9i(`E~q?3opdk8A;t5e+tP3g-x7LV$!U6zjiox+0S zSpGS<78{#k;xLR|Fco+|4p+{C8Yw)?mQ5We>8)WfFkaf~tyLeLb!eUQ!ig1>+XY*O zE>GwuXlJz)NF^Qb_$3kOs(&_vM}iNE!ANA(yVbUuuwct9Z$sFbE{l>U_#)UdBfW@q zypHy3ydrW$CysJdy<9ZgPlb55lnhm+FDTlCW%r@sv#v;3Y!qtR8oUG{xd7jPZ=Sao z)H=nQ^f_Corh#7fY#-+EF9~|5vsas0e}$A3dkit(_psY=YlMr57Uinbe?2oZOUZHY zZG2m)XQb3jI5Bpu3Pc8yQ^h-$^dG8`JCyunotMi2EaKO|+Ei4lO2E1muUXC^(w3=2 z8Mxl@nicXTEUFPDci&>=FCuY6|W=+$^a@kS-uW90bY7OB)-i1#Pzl@vbg6P)_AmI*A8w5Pr zY86Pn%|r7zm8vfi=fHsUn%O>cTpZ#K{GXg#nE$ z_tp}y6fTpwv)Hmkpc{jX(Z!wgYmPy;Q*Q9-E7|lf&yV*Z7`Ht1#$?YLQX1axQAM=F zFw7~^l>r1?X{7UTQ55Qjd)f6-DKCv_{}NgAk5v~jbS&CP(z~P&GQj|2pu~6b3i0y% z72cclOD416dppluW0RId?DqJ#3oglFlgOo`DvsC_8A{cryG<_MwuOujLx)P??V zhr^+LW%%&;p>|t#0kY)k+c6Zy<8xZ8)mRk8od$`J7leJz;~My7{y0G-JHSH2%^ZQ} zjePiDG2q9vi)VqTG~Xuy?A}E-)IzYbv*oU9_|~)L60KK4lM0s(B6+qNxiB+K6w^bc zQ8@b33o=Zq1O2nACB_g@*LPx=r3Nbb2-MMj-Df4jL*I;E ziIfUj#^$ywQX9R^xRE1`c9>87#T?z;dVGMnH|)SKw01qKULGdBcJaHTY%lJ-!L~m@ z+)%9A-L~~9YFxd?UwQc?Yu!R6HgCpOeQi}2Iy zqkin}?XcM;>+(Qix6Y&PwyqrS^nG~5pk$-X2^d>Rj3_IF9qWt05Y~=>m*P=`D&;l< za_Y;KZwiZt>F4h{{0PUOw+zo2sf`Ww$E=fnp}M-A`I-F~%Sm0_7jA$EUiN!$Qxe(_ zf(IYLYrjPqC*V3~_^UKS`7V>GhOm!u?JjMzAyLv$-Nzna1sF;Kje1cpYCLDn79fO{ zD3Ylxqt5JBi?7Nd(S#{oIJa0{1D4%q5oxdb zahoAa&tu>47a{`GEvbrvN+MUp;a-w1cx?H#vY?B00f1x)AYHQPO7dAL|5u?MImbwo zwep~$L>H8m;Y0C3RA%L21}O#pR;&VC2UvthP}frG1bEIFaB_&>j7BSb#On&Uel?v3 zD_PF_687|tYulWIoxCRqM}I$V`q;FI3i|$)(dV6~yDu7N)^75jPGn8eO#B<)QxcL( z8p(Dw(-n5V&A{|ZiWH>ReI6}>IqtJ`btZ%2rGF^9>gt@jc5JAxS1w0eZqyi8lb~`c zJCcob!RE)aQPXnLD3O8F>kTJEKCjwVJpcZA81cZEPcvoG(lqV9h$efqLuFnP!R2@H z;&d+0J(Qbt(qw^Xn;3DX@$J?)Pw=y+<_+6c$x$ximMlyJoJ=Eh|9o$#d-ph*sz^B| z2Pd^vA{I}?2>K!UKIOS;A5lMH6*iIZ&!N?RXm$=g{v-1cgo4(+wsgb;{uP>t*6SZY zi0UA)`A!jPC2%0o7bHI&hxppRAGjmux^e9ECzGCHk0_&if>VFE<=_(#*leV3V+lm%N~!bWMPvOFt4BxNUDfL1Z|KXqm80p(+6;|x_YW@? zeZs7tBz_5EixdlPzHyOf#i20oITqlnRYjv^pSSs#3eeZwwWw#;<>gV4A;wbKCT)~q z+>UX!%`OFCX|Zgh>jY8T-fX;SAE36Eh^;nqcuW0SO7K(P{&oZHs$mN2`+Pk(n=*w{6wu#JH@oU*?nPmV3z!O_}tzeg#ed~CE%Ck7TK?8%FS>+F& z_7v+B)JFGrKQ#CGeeoG1cuQ)h+R^BJ0t-rMyozq2g@is6Pr@dPc6_JC?_G~oI_oJ& zcp1j>iZ+***c&b7HRSxM20yXf#dBN$+KEQVLzI*0&vdrD7)Zrwu~aGbqyurg=wAf1 zXkC82!Lwd4hQ`o5UWHoZu~U4C++$pS&!`L7mp})otYx)aB(c9uwgF@&4YEqH3ElZ;Ew6>C8cDhql5ncJ@~RE4yCdQDE1jui% zVB>aHmzK1)UEH`?Utwu~c=Q&C)Q!nI-o|yTT+j1sGh`6L;*OUI_}co>X58N%McBUK zc;9l`-s}_hTi8wSY}D(aXGi%F+4Nf4ngAl)yTSI|H4aP3t<>gZ+mCb4W_pPd3C2f= z5B|+ZtPb-Y9kR~}&diXbp(%GHL^Kp*O5kVb=ZrBbZKEPk=Np$5=e64E&~t4&)|MDj z;JxX${a_rtZ1*M_QLl3gPVdTcadlT-Q2dJ3u;KyC_FQ$H4+_UkRgxR0NefYSK1%e7 zk;wcdZbK!0tU4BHrsK{e{!yRzgDj!LW}|DtGoEdsH4b)sILfq#`b3In>cyH_{-Xo< zD^uC7*86AwzIw^+Om6-#|i@%>tf(OpcJS7Ezzktb?E#^EroyW3*e;?Vg>PuBC zU5a>U-+Xl-dy?ovPjQ~vd3R;P)qSK_eQ9-2v!oX`c;l|FjsoH9hLn#zx4iA8?Eh59 z-qHm17KIzPPZZM1?$v7xf{qBr#uWi+=+9sL&z9Vz!aISzKWVAXzED5~CBdi834ykx z8g}j5fLL9a?9u2U_Fh1DDF*i`A{TO{SITL6JSM(5&!TedrOO9SmmtsJ|9l9zi%R51 zgY84!a*Lx}-RaJjeVKygVfnmnrn)843_wYmR}kgPdY&Y4y%f{&S-Wg;!x+x)>MIjo zH#%~PEhV56%O81eFRUA78~D4+B}YX0oXksJV%oYQle@UO)0-#~n3_r3+~oA{g5zt| zabBBk4?tx-KVhWw$h&NGd9ULy9KZ18eyaOGaCw143NnINLgVj0$%5UwYou0i2p5xL zJXXAg2yzNV$WfCSZ~hF<6azHGuPSp#4u&Rx^bJSANIB2>ulME&V(<|Omr?r2F3 zurSDQ=O;I*%Pgs#tQN$@{TRHyS*>T<; z{}bmDiL*;mv+H(5_i%kuyu}3g<=e)vq`hSoQ`kOmS&Xj=hkvClD*;)prdn|bqBo3u zDqbs&dsUkS|Cbl~w%-;-Q4D%Dm2dpIolIKgZSw*}5+y_9=?smimMPU;Jsz|$8p(<_2ZxZ*NXibZLs4c^9cop@&V)~dT*;W4$ zB}9=lG68Q}a!C`{9PKsvrHf@Q{?oqU(?;G*V+SskpOt}n^%1{?KY?{$Zh%JL%e!w( zTbjCkd(9 zQnSUuk|(MI<7N|=A7ZQLJAWFu#5+6*#147$I9}Y1T;nJN2%1}&kSw;Gonhzut#*rS zxV(XBompNzH6CfwQ6=2nV!WFZYDxQeyV30H=yz=7q(h^?IAS%%Xm88-6gefgj~p|^ zXg1$ueKk45Tdv(vNj*(UknzXAnlwf{xQZFXPVIt>d{wBRJcmtykiycD%UpLVqO{}b zSxG;YWZd>4t$PavEw%CcxJ=QFCVQQs*_|Y{rUm{v!@7ALf`6y%M;jCOW4;pg5!rSU z+m+m!D@h)?5bq{FY!v0#c}sG%+raiW&I(9Apf39U;xv3O*Oy2$e&gX>Az`n__KB$@ zF@8@#&PrMH%i$JpW<$?mher01{}7pbpPlJSOIuEl=(SR}`hAd%=7;XyhCPZjwP}(O zx>FpJc`d6VdwgOw<+#?A1AOY{^f?k@RP?Vrwk>!&-H5LYI46NOcEcEosX&j*xniQ; z>j6S<398HI(2g@8|Dt<0euNv^HzT1g@l}$O;PIUE6*n+)rQav^bqoWwu*C9alVM0= zm930cDKYAA3?47_(ZRuenq@~Scx@)OLx8Oza{lu_H$}a4<5S#J3^iyKW~sh zz+cHNp;x^X0yh(G%p<8}VfvaIFcYn8IQQiOPQh+%nwe6|zq!%sjYaBi<}q9DsS-Hu zzq|d{jHXgi@nU7KVG#;Mo%!g>ULT>r?=Idt9b|`atFS}?kX4HOh#~W10A|Y5Esa&< z+|A{26r-2BZaJaA_e{=Bg6s=FDRKpUs8ZxlGx8K)N~IQ@~D({)+Omc;8bw zxrjv@uDlVP1Yo_+J|?u{ZJ8}jmO{TxRVr{`wS;hwZOP|SC3#&<;b!RfW*^rB^xo#^ z`8b>$>(zRVogdD{eW%y++^B526UVuR_@0PzzgisUjoRiPSJKYdnZ5X$?F0`{Gp-f= z`4lyUN7!=F8GO!uL03rgp&J=0dfF7?^qt>Z1Z+j~QCCmBKQ6cUK~u-H&m(4&9@v%f znQB5RgjkXZrAB~-TDoTI@J$RYBL)<7OJ6N`zfMSbv;3dnl2c6nw?Y%$CyBpQebIws zNroW7LaI>&J2|W0Tj5CG#;nzG11z(tVH7d4Q5yyC%QVP&FQQI7%_{s-l!tj|f~1uC z?Fmc=!S!{Yd2b~!uCDVdXO7oHqWs|s!k=WAKkez0XsXs?ex0PiwD`&*Hv@_kBd-@n zD-6DH=9phOa z@QE>tdn9TaecQQJ&yf2{BW}Ct#%uA94b+_>e}Vz<_bQgJ7KS)Rhx4v2waVFA9ra!J zYUzZ|{%RNg`^@iR`OTr<1Fy6NY2hKOSE*i4-+K02Q*0w-J~axBSFyF++5}u83fieAM1i%rd+xKZPg}R*Q#V1-PtK3PF@7fBPa5Yiy?ea(gOBh^b9 zVBd>6p6JULab(4er}tsg!?LLWi_%|gvs~rnMGOAtxp{leOkr-}+lX*>n@DB$tewkw zCC7uQ;lgtqBtHe^`lJfqv6Q+9ChP`CQv-;7-I*0IU`fdx=JKW^YgR2nSG=4wZhZMC zW@VaSGKJ)O9yjpA@{6%%PUFRto=K3uoewv3`qvvP8S9;^PP-R!4He{9NJ#&CO89>R zh7= '0') ? (__DATE__[4]) : '0') -#define BUILD_DAY_CH1 (__DATE__[5]) - -// -// Example of __TIME__ string: "21:06:19" -// 01234567 - -#define BUILD_HOUR_CH0 (__TIME__[0]) -#define BUILD_HOUR_CH1 (__TIME__[1]) - -#define BUILD_MIN_CH0 (__TIME__[3]) -#define BUILD_MIN_CH1 (__TIME__[4]) - -#define BUILD_SEC_CH0 (__TIME__[6]) -#define BUILD_SEC_CH1 (__TIME__[7]) - -#if VERSION_MAJOR > 100 - -# define VERSION_MAJOR_INIT \ - ((VERSION_MAJOR / 100) + '0'), \ - (((VERSION_MAJOR % 100) / 10) + '0'), \ - ((VERSION_MAJOR % 10) + '0') - -#elif VERSION_MAJOR > 10 - -# define VERSION_MAJOR_INIT \ - ((VERSION_MAJOR / 10) + '0'), \ - ((VERSION_MAJOR % 10) + '0') - -#else - -# define VERSION_MAJOR_INIT \ - (VERSION_MAJOR + '0') - -#endif - -#if VERSION_MINOR > 100 - -# define VERSION_MINOR_INIT \ - ((VERSION_MINOR / 100) + '0'), \ - (((VERSION_MINOR % 100) / 10) + '0'), \ - ((VERSION_MINOR % 10) + '0') - -#elif VERSION_MINOR > 10 - -# define VERSION_MINOR_INIT \ - ((VERSION_MINOR / 10) + '0'), \ - ((VERSION_MINOR % 10) + '0') - -#else - -# define VERSION_MINOR_INIT \ - (VERSION_MINOR + '0') - -#endif - -#if VERSION_PATCH > 100 - -# define VERSION_PATCH_INIT \ - ((VERSION_PATCH / 100) + '0'), \ - (((VERSION_PATCH % 100) / 10) + '0'), \ - ((VERSION_PATCH % 10) + '0') - -#elif VERSION_PATCH > 10 - -# define VERSION_PATCH_INIT \ - ((VERSION_PATCH / 10) + '0'), \ - ((VERSION_PATCH % 10) + '0') - -#else - -# define VERSION_PATCH_INIT \ - (VERSION_PATCH + '0') - -#endif - -#ifndef HYPERDBG_KERNEL_MODE - -const unsigned char BuildDateTime[] = { - BUILD_YEAR_CH0, - BUILD_YEAR_CH1, - BUILD_YEAR_CH2, - BUILD_YEAR_CH3, - '-', - BUILD_MONTH_CH0, - BUILD_MONTH_CH1, - '-', - BUILD_DAY_CH0, - BUILD_DAY_CH1, - ' ', - BUILD_HOUR_CH0, - BUILD_HOUR_CH1, - ':', - BUILD_MIN_CH0, - BUILD_MIN_CH1, - ':', - BUILD_SEC_CH0, - BUILD_SEC_CH1, - - '\0'}; - -const unsigned char CompleteVersion[] = { - 'v', - VERSION_MAJOR_INIT, - '.', - VERSION_MINOR_INIT, - '.', - VERSION_PATCH_INIT, - '\0'}; - -const unsigned char BuildVersion[] = { - BUILD_YEAR_CH0, - BUILD_YEAR_CH1, - BUILD_YEAR_CH2, - BUILD_YEAR_CH3, - BUILD_MONTH_CH0, - BUILD_MONTH_CH1, - BUILD_DAY_CH0, - BUILD_DAY_CH1, - '.', - BUILD_HOUR_CH0, - BUILD_HOUR_CH1, - BUILD_MIN_CH0, - BUILD_MIN_CH1, - - '\0'}; - -const unsigned char BuildSignature[] = { - VERSION_MAJOR_INIT, - '.', - VERSION_MINOR_INIT, - '.', - VERSION_PATCH_INIT, - '-', - BUILD_YEAR_CH0, - BUILD_YEAR_CH1, - BUILD_YEAR_CH2, - BUILD_YEAR_CH3, - BUILD_MONTH_CH0, - BUILD_MONTH_CH1, - BUILD_DAY_CH0, - BUILD_DAY_CH1, - '.', - BUILD_HOUR_CH0, - BUILD_HOUR_CH1, - BUILD_MIN_CH0, - BUILD_MIN_CH1, - - '\0'}; - -#endif // SCRIPT_ENGINE_KERNEL_MODE - -////////////////////////////////////////////////// -// Message Tracing // -////////////////////////////////////////////////// - -/** - * @brief Default buffer count of packets for message tracing - * @details number of packets storage for regular buffers - */ -#define MaximumPacketsCapacity 1000 - -/** - * @brief Default buffer count of packets for message tracing - * @details number of packets storage for priority buffers - */ -#define MaximumPacketsCapacityPriority 50 - -/** - * @brief Size of normal OS (processor) pages - */ -#define NORMAL_PAGE_SIZE 4096 // PAGE_SIZE - -/** - * @brief Size of each packet - */ -#define PacketChunkSize NORMAL_PAGE_SIZE - -/** - * @brief size of user-mode buffer - * @details Because of operation code at the start of the - * buffer + 1 for null-termminating - * - */ -#define UsermodeBufferSize sizeof(UINT32) + PacketChunkSize + 1 - -/** - * @brief size of buffer for serial - * @details the maximum packet size for sending over serial - * - */ -#define MaxSerialPacketSize 10 * NORMAL_PAGE_SIZE - -/** - * @brief Final storage size of message tracing - * - */ -#define LogBufferSize \ - MaximumPacketsCapacity *(PacketChunkSize + sizeof(BUFFER_HEADER)) - -/** - * @brief Final storage size of message tracing - * - */ -#define LogBufferSizePriority \ - MaximumPacketsCapacityPriority *(PacketChunkSize + sizeof(BUFFER_HEADER)) - -/** - * @brief limitation of Windows DbgPrint message size - * @details currently is not functional - * - */ -#define DbgPrintLimitation 512 - -/** - * @brief The seeds that user-mode codes use as the starter - * of their events' tag - * - */ -#define DebuggerEventTagStartSeed 0x1000000 - -/** - * @brief The seeds that user-mode thread detail token start with it - * @details This seed should not start with zero (0), otherwise it's - * interpreted as error - */ -#define DebuggerThreadDebuggingTagStartSeed 0x1000000 - -/** - * @brief The seeds that user-mode codes use as the starter - * of their output source tag - * - */ -#define DebuggerOutputSourceTagStartSeed 0x1 - -/** - * @brief Determines how many sources a debugger can have for - * a single event - * - */ -#define DebuggerOutputSourceMaximumRemoteSourceForSingleEvent 0x5 - -/** - * @brief The size of each chunk of memory used in the 'memcpy' function - * of the script engine for transferring buffers in the VMX-root mode - * - */ -#define DebuggerScriptEngineMemcpyMovingBufferSize 64 - -////////////////////////////////////////////////// -// EPT Hook // -////////////////////////////////////////////////// - -/** - * @brief Maximum number of initial pre-allocated EPT hooks - * - */ -#define MAXIMUM_NUMBER_OF_INITIAL_PREALLOCATED_EPT_HOOKS 5 - -////////////////////////////////////////////////// -// Instant Event Configs // -////////////////////////////////////////////////// - -/** - * @brief Maximum number of (regular) instant events that are pre-allocated - * - */ -#define MAXIMUM_REGULAR_INSTANT_EVENTS 20 - -/** - * @brief Maximum number of (big) instant events that are pre-allocated - * - */ -#define MAXIMUM_BIG_INSTANT_EVENTS 0 - -/** - * @brief Pre-allocated size for a regular event + conditions buffer - * - */ -#define REGULAR_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + 100 - -/** - * @brief Pre-allocated size for a big event + conditions buffer - * - */ -#define BIG_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + PAGE_SIZE - -/** - * @brief Pre-allocated size for a regular action + custom code or script buffer - * - */ -#define REGULAR_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + (PAGE_SIZE * 2) - -/** - * @brief Pre-allocated size for a big action + custom code or script buffer - * - */ -#define BIG_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + MaxSerialPacketSize - -/** - * @brief Pre-allocated size for a regular requested safe buffer - * - */ -#define REGULAR_INSTANT_EVENT_REQUESTED_SAFE_BUFFER PAGE_SIZE - -/** - * @brief Pre-allocated size for a big requested safe buffer - * - */ -#define BIG_INSTANT_EVENT_REQUESTED_SAFE_BUFFER MaxSerialPacketSize - -////////////////////////////////////////////////// -// Remote Connection // -////////////////////////////////////////////////// - -/** - * @brief default port of HyperDbg for listening by - * debuggee (server, guest) - * - */ -#define DEFAULT_PORT "50000" - -/** - * @brief Packet size for TCP connections - * @details Note that we might add something to the kernel buffers - * that's why we add 0x100 to it - */ -#define COMMUNICATION_BUFFER_SIZE PacketChunkSize + 0x100 - -////////////////////////////////////////////////// -// VMCALL Numbers // -////////////////////////////////////////////////// - -/** - * @brief The start number of VMCALL number allowed to be - * used by top-level drivers - * - */ -#define TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER 0x00000200 - -/** - * @brief The start number of VMCALL number allowed to be - * used by top-level drivers - * - */ -#define TOP_LEVEL_DRIVERS_VMCALL_ENDING_NUMBER TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER + 0x100 - -////////////////////////////////////////////////// -// Operation Codes // -////////////////////////////////////////////////// - -/** - * @brief If a operation use this bit in its Operation code, - * then it means that the operation should be performed - * mandatorily in debuggee and should not be sent to the debugger - */ -#define OPERATION_MANDATORY_DEBUGGEE_BIT (1 << 31) - -/** - * @brief Message logs id that comes from kernel-mode to - * user-mode - * @details Message area >= 0x5 - */ -#define OPERATION_LOG_INFO_MESSAGE 1U -#define OPERATION_LOG_WARNING_MESSAGE 2U -#define OPERATION_LOG_ERROR_MESSAGE 3U -#define OPERATION_LOG_NON_IMMEDIATE_MESSAGE 4U -#define OPERATION_LOG_WITH_TAG 5U - -#define OPERATION_COMMAND_FROM_DEBUGGER_CLOSE_AND_UNLOAD_VMM \ - 6U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_USER_INPUT 7U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_REGISTER_EVENT 8U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_ADD_ACTION_TO_EVENT \ - 9 | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_CLEAR_EVENTS 10U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_CLEAR_EVENTS_WITHOUT_NOTIFYING_DEBUGGER 11U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED \ - 12U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS \ - 13U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_COMMAND_FROM_DEBUGGER_RELOAD_SYMBOL \ - 14U | OPERATION_MANDATORY_DEBUGGEE_BIT - -#define OPERATION_NOTIFICATION_FROM_USER_DEBUGGER_PAUSE \ - 15U | OPERATION_MANDATORY_DEBUGGEE_BIT - -////////////////////////////////////////////////// -// Breakpoints & Debug Breakpoints // -////////////////////////////////////////////////// - -/** - * @brief maximum number of buffers to be allocated for a single - * breakpoint - */ -#define MAXIMUM_BREAKPOINTS_WITHOUT_CONTINUE 100 - -/** - * @brief maximum number of thread/process ids to be allocated for a simultaneous - * debugging - * @details it shows the maximum number of threads/processes that HyperDbg sets - * trap flag for them - * - */ -#define MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_TRAPS 200 - -////////////////////////////////////////////////// -// Pool tags used in HyperDbg // -////////////////////////////////////////////////// - -/** - * @brief Pool tag - * - */ -#define POOLTAG 0x48444247 // [H]yper[DBG] (HDBG) - -////////////////////////////////////////////////// -// End of Buffer Detection // -////////////////////////////////////////////////// - -/** - * @brief count of characters for serial end of buffer - */ -#define SERIAL_END_OF_BUFFER_CHARS_COUNT 0x4 - -/** - * @brief characters of the buffer that we set at the end of - * buffers for serial - */ -#define SERIAL_END_OF_BUFFER_CHAR_1 0x00 -#define SERIAL_END_OF_BUFFER_CHAR_2 0x80 -#define SERIAL_END_OF_BUFFER_CHAR_3 0xEE -#define SERIAL_END_OF_BUFFER_CHAR_4 0xFF - -/** - * @brief count of characters for tcp end of buffer - */ -#define TCP_END_OF_BUFFER_CHARS_COUNT 0x4 - -/** - * @brief characters of the buffer that we set at the end of - * buffers for tcp - */ -#define TCP_END_OF_BUFFER_CHAR_1 0x10 -#define TCP_END_OF_BUFFER_CHAR_2 0x20 -#define TCP_END_OF_BUFFER_CHAR_3 0x33 -#define TCP_END_OF_BUFFER_CHAR_4 0x44 - -////////////////////////////////////////////////// -// Name of OS // -////////////////////////////////////////////////// - -/** - * @brief maximum name for OS name buffer - * - */ -#define MAXIMUM_CHARACTER_FOR_OS_NAME 256 - -////////////////////////////////////////////////// -// Processor Details // -////////////////////////////////////////////////// - -/** - * @brief maximum instruction size in Intel - */ -#define MAXIMUM_INSTR_SIZE 16 - -/** - * @brief maximum size for call instruction in Intel - */ -#define MAXIMUM_CALL_INSTR_SIZE 7 - -////////////////////////////////////////////////// -// Symbols Details // -////////////////////////////////////////////////// - -/** - * @brief maximum supported modules to load - * their symbol information - */ -#define MAXIMUM_SUPPORTED_SYMBOLS 1000 - -/** - * @brief maximum size for GUID and Age of PE - * @detail It seems that 33 bytes is enough but let's - * have more space because there might be sth that we - * missed :) - */ -#define MAXIMUM_GUID_AND_AGE_SIZE 60 - -////////////////////////////////////////////////// -// Debuggee Communication // -////////////////////////////////////////////////// - -/** - * @brief constant indicator of a HyperDbg packet - * @warning used in hwdbg - * - */ -#define INDICATOR_OF_HYPERDBG_PACKET \ - 0x4859504552444247 // HYPERDBG = 0x4859504552444247 - -////////////////////////////////////////////////// -// Command Details // -////////////////////////////////////////////////// - -/** - * @brief maximum results that will be returned by !s* s* - * command - * - */ -#define MaximumSearchResults 0x1000 - -////////////////////////////////////////////////// -// Script Engine // -////////////////////////////////////////////////// - -/** - * @brief EFLAGS/RFLAGS - * - */ -#define X86_FLAGS_CF (1 << 0) -#define X86_FLAGS_PF (1 << 2) -#define X86_FLAGS_AF (1 << 4) -#define X86_FLAGS_ZF (1 << 6) -#define X86_FLAGS_SF (1 << 7) -#define X86_FLAGS_TF (1 << 8) -#define X86_FLAGS_IF (1 << 9) -#define X86_FLAGS_DF (1 << 10) -#define X86_FLAGS_OF (1 << 11) -#define X86_FLAGS_STATUS_MASK (0xfff) -#define X86_FLAGS_IOPL_MASK (3 << 12) -#define X86_FLAGS_IOPL_SHIFT (12) -#define X86_FLAGS_IOPL_SHIFT_2ND_BIT (13) -#define X86_FLAGS_NT (1 << 14) -#define X86_FLAGS_RF (1 << 16) -#define X86_FLAGS_VM (1 << 17) -#define X86_FLAGS_AC (1 << 18) -#define X86_FLAGS_VIF (1 << 19) -#define X86_FLAGS_VIP (1 << 20) -#define X86_FLAGS_ID (1 << 21) -#define X86_FLAGS_RESERVED_ONES 0x2 -#define X86_FLAGS_RESERVED 0xffc0802a - -#define X86_FLAGS_RESERVED_BITS 0xffc38028 -#define X86_FLAGS_FIXED 0x00000002 - -#ifndef LOWORD -# define LOWORD(l) ((WORD)(l)) -#endif // !LOWORD - -#ifndef HIWORD -# define HIWORD(l) ((WORD)(((DWORD)(l) >> 16) & 0xFFFF)) -#endif // !HIWORD - -#ifndef LOBYTE -# define LOBYTE(w) ((BYTE)(w)) -#endif // !LOBYTE - -#ifndef HIBYTE -# define HIBYTE(w) ((BYTE)(((WORD)(w) >> 8) & 0xFF)) -#endif // !HIBYTE - -#define MAX_TEMP_COUNT 128 - -#define MAX_STACK_BUFFER_COUNT 128 - -// TODO: Extract number of variables from input of ScriptEngine -// and allocate variableList Dynamically. -#define MAX_VAR_COUNT 512 - -#define MAX_FUNCTION_NAME_LENGTH 32 - -////////////////////////////////////////////////// -// Debugger // -////////////////////////////////////////////////// - -/** - * @brief Apply event modifications to all tags - * - */ -#define DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG 0xffffffffffffffff - -/** - * @brief Maximum length for a function (to be used in showing distance - * from symbol functions in the 'u' command) - * - */ -#define DISASSEMBLY_MAXIMUM_DISTANCE_FROM_OBJECT_NAME 0xffff - -/** - * @brief Read and write MSRs to all cores - * - */ -#define DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES 0xffffffff - -/** - * @brief Apply the event to all the cores - * - */ -#define DEBUGGER_DEBUGGEE_IS_RUNNING_NO_CORE 0xffffffff - -/** - * @brief Apply the event to all the cores - * - */ -#define DEBUGGER_EVENT_APPLY_TO_ALL_CORES 0xffffffff - -/** - * @brief Apply the event to all the processes - * - */ -#define DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES 0xffffffff - -/** - * @brief Apply to all Model Specific Registers - * - */ -#define DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS 0xffffffff - -/** - * @brief Apply to all first 32 exceptions - * - */ -#define DEBUGGER_EVENT_EXCEPTIONS_ALL_FIRST_32_ENTRIES 0xffffffff - -/** - * @brief Apply to all syscalls and sysrets - * - */ -#define DEBUGGER_EVENT_SYSCALL_ALL_SYSRET_OR_SYSCALLS 0xffffffff - -/** - * @brief Apply to all I/O ports - * - */ -#define DEBUGGER_EVENT_ALL_IO_PORTS 0xffffffff - -/** - * @brief The constant to apply to all cores for bp command - * - */ -#define DEBUGGEE_BP_APPLY_TO_ALL_CORES 0xffffffff - -/** - * @brief The constant to apply to all processes for bp command - * - */ -#define DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES 0xffffffff - -/** - * @brief The constant to apply to all threads for bp command - * - */ -#define DEBUGGEE_BP_APPLY_TO_ALL_THREADS 0xffffffff - -/** - * @brief for reading all registers in r command. - * - */ -#define DEBUGGEE_SHOW_ALL_REGISTERS 0xffffffff - - -/** - * @file BasicTypes.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers For Basic Datatypes - * @details This file contains definitions of basic datatypes - * @version 0.2 - * @date 2022-06-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -#pragma warning(disable : 4201) // Suppress nameless struct/union warning - -////////////////////////////////////////////////// -// Basic Datatypes // -////////////////////////////////////////////////// - -typedef unsigned long long QWORD; -typedef unsigned __int64 UINT64, *PUINT64; -typedef unsigned long DWORD; -typedef int BOOL; -typedef unsigned char BYTE; -typedef unsigned short WORD; -typedef int INT; -typedef unsigned int UINT; -typedef unsigned int * PUINT; -typedef unsigned __int64 ULONG64, *PULONG64; -typedef unsigned __int64 DWORD64, *PDWORD64; -typedef char CHAR; -//typedef wchar_t WCHAR; -typedef short wchar_t ; -typedef short WCHAR; -#define VOID void -#define PVOID void * -#define LPVOID void * -#define HANDLE void * -#define SIZE_T int -#define time_t UINT64 -#define MAX_PATH 260 -typedef struct _LIST_ENTRY { - struct _LIST_ENTRY *Flink; - struct _LIST_ENTRY *Blink; -} LIST_ENTRY, *PLIST_ENTRY, PRLIST_ENTRY; - -//#define static_assert(cond, msg) typedef char static_assertion_##msg[(!!(cond))*2-1]//todo bug,mock error - -typedef unsigned char UCHAR; -typedef unsigned short USHORT; -typedef unsigned long ULONG; - -typedef UCHAR BOOLEAN; // winnt -typedef BOOLEAN * PBOOLEAN; // winnt - -typedef signed char INT8, *PINT8; -typedef signed short INT16, *PINT16; -typedef signed int INT32, *PINT32; -typedef signed __int64 INT64, *PINT64; -typedef unsigned char UINT8, *PUINT8; -typedef unsigned short UINT16, *PUINT16; -typedef unsigned int UINT32, *PUINT32; -typedef unsigned __int64 UINT64, *PUINT64; - -#define NULL_ZERO 0 -#define NULL64_ZERO 0ull - -#define FALSE 0 -#define TRUE 1 - -#define UPPER_56_BITS 0xffffffffffffff00 -#define UPPER_48_BITS 0xffffffffffff0000 -#define UPPER_32_BITS 0xffffffff00000000 -#define LOWER_32_BITS 0x00000000ffffffff -#define LOWER_16_BITS 0x000000000000ffff -#define LOWER_8_BITS 0x00000000000000ff -#define SECOND_LOWER_8_BITS 0x000000000000ff00 -#define UPPER_48_BITS_AND_LOWER_8_BITS 0xffffffffffff00ff - -// -// DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA -// -typedef struct GUEST_REGS -{ - // - // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA - // - - UINT64 rax; // 0x00 - UINT64 rcx; // 0x08 - UINT64 rdx; // 0x10 - UINT64 rbx; // 0x18 - UINT64 rsp; // 0x20 - UINT64 rbp; // 0x28 - UINT64 rsi; // 0x30 - UINT64 rdi; // 0x38 - UINT64 r8; // 0x40 - UINT64 r9; // 0x48 - UINT64 r10; // 0x50 - UINT64 r11; // 0x58 - UINT64 r12; // 0x60 - UINT64 r13; // 0x68 - UINT64 r14; // 0x70 - UINT64 r15; // 0x78 - - // - // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA - // - -} GUEST_REGS, *PGUEST_REGS; - -/** - * @brief struct for extra registers - * - */ -typedef struct GUEST_EXTRA_REGISTERS -{ - UINT16 CS; - UINT16 DS; - UINT16 FS; - UINT16 GS; - UINT16 ES; - UINT16 SS; - UINT64 RFLAGS; - UINT64 RIP; -} GUEST_EXTRA_REGISTERS, *PGUEST_EXTRA_REGISTERS; - -/** - * @brief List of different variables - */ -typedef struct _SCRIPT_ENGINE_VARIABLES_LIST -{ - UINT64 * TempList; - UINT64 * GlobalVariablesList; - UINT64 * LocalVariablesList; - -} SCRIPT_ENGINE_VARIABLES_LIST, *PSCRIPT_ENGINE_VARIABLES_LIST; - -/** - * @brief CR3 Structure - * - */ -typedef struct _CR3_TYPE -{ - union - { - UINT64 Flags; - - struct - { - UINT64 Pcid : 12; - UINT64 PageFrameNumber : 36; - UINT64 Reserved1 : 12; - UINT64 Reserved_2 : 3; - UINT64 PcidInvalidate : 1; - } Fields; - }; -} CR3_TYPE, *PCR3_TYPE; - - -/** - * @file ErrorCodes.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Error codes - * @details This file contains definitions of error codes used in HyperDbg - * @version 0.2 - * @date 2022-06-24 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Success Codes // -////////////////////////////////////////////////// - -/** - * @brief General value to indicate that the operation or - * request was successful - * - */ -#define DEBUGGER_OPERATION_WAS_SUCCESSFUL 0xFFFFFFFF - -////////////////////////////////////////////////// -// Error Codes // -////////////////////////////////////////////////// - -/** - * @brief error, the tag not exist - * - */ -#define DEBUGGER_ERROR_TAG_NOT_EXISTS 0xc0000000 - -/** - * @brief error, invalid type of action - * - */ -#define DEBUGGER_ERROR_INVALID_ACTION_TYPE 0xc0000001 - -/** - * @brief error, the action buffer size is invalid - * - */ -#define DEBUGGER_ERROR_ACTION_BUFFER_SIZE_IS_ZERO 0xc0000002 - -/** - * @brief error, the event type is unknown - * - */ -#define DEBUGGER_ERROR_EVENT_TYPE_IS_INVALID 0xc0000003 - -/** - * @brief error, enable to create event - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_CREATE_EVENT 0xc0000004 - -/** - * @brief error, invalid address specified for debugger - * - */ -#define DEBUGGER_ERROR_INVALID_ADDRESS 0xc0000005 - -/** - * @brief error, the core id is invalid - * - */ -#define DEBUGGER_ERROR_INVALID_CORE_ID 0xc0000006 - -/** - * @brief error, the index is greater than 32 in !exception command - * - */ -#define DEBUGGER_ERROR_EXCEPTION_INDEX_EXCEED_FIRST_32_ENTRIES 0xc0000007 - -/** - * @brief error, the index for !interrupt command is not between 32 to 256 - * - */ -#define DEBUGGER_ERROR_INTERRUPT_INDEX_IS_NOT_VALID 0xc0000008 - -/** - * @brief error, unable to hide the debugger and enter to transparent-mode - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER 0xc0000009 - -/** - * @brief error, the debugger is already in transparent-mode - * - */ -#define DEBUGGER_ERROR_DEBUGGER_ALREADY_UHIDE 0xc000000a - -/** - * @brief error, invalid parameters in !e* e* commands - * - */ -#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_PARAMETER 0xc000000b - -/** - * @brief error, an invalid address is specified based on current cr3 - * in !e* or e* commands - * - */ -#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_CURRENT_PROCESS \ - 0xc000000c - -/** - * @brief error, an invalid address is specified based on anotehr process's cr3 - * in !e* or e* commands - * - */ -#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_OTHER_PROCESS \ - 0xc000000d - -/** - * @brief error, invalid tag for 'events' command (tag id is unknown for kernel) - * - */ -#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TAG 0xc000000e - -/** - * @brief error, type of action (enable/disable/clear) is wrong - * - */ -#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TYPE_OF_ACTION 0xc000000f - -/** - * @brief error, invalid parameters steppings actions - * - */ -#define DEBUGGER_ERROR_STEPPING_INVALID_PARAMETER 0xc0000010 - -/** - * @brief error, thread is invalid (not found) or disabled in - * stepping (step-in & step-out) requests - * - */ -#define DEBUGGER_ERROR_STEPPINGS_EITHER_THREAD_NOT_FOUND_OR_DISABLED 0xc0000011 - -/** - * @brief error, baud rate is invalid - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_BAUDRATE 0xc0000012 - -/** - * @brief error, serial port address is invalid - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_SERIAL_PORT 0xc0000013 - -/** - * @brief error, invalid core selected in changing core in remote debuggee - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_CORE_IN_REMOTE_DEBUGGE \ - 0xc0000014 - -/** - * @brief error, invalid process selected in changing process in remote debuggee - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_UNABLE_TO_SWITCH_TO_NEW_PROCESS \ - 0xc0000015 - -/** - * @brief error, unable to run script in remote debuggee - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT 0xc0000016 - -/** - * @brief error, invalid register number - * - */ -#define DEBUGGER_ERROR_INVALID_REGISTER_NUMBER 0xc0000017 - -/** - * @brief error, maximum pools were used without continuing debuggee - * - */ -#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_WITHOUT_CONTINUE 0xc0000018 - -/** - * @brief error, breakpoint already exists on the target address - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_EXISTS_ON_THE_ADDRESS 0xc0000019 - -/** - * @brief error, breakpoint id not found - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND 0xc000001a - -/** - * @brief error, breakpoint already disabled - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_DISABLED 0xc000001b - -/** - * @brief error, breakpoint already enabled - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_ENABLED 0xc000001c - -/** - * @brief error, memory type is invalid - * - */ -#define DEBUGGER_ERROR_MEMORY_TYPE_INVALID 0xc000001d - -/** - * @brief error, the process id is invalid - * - */ -#define DEBUGGER_ERROR_INVALID_PROCESS_ID 0xc000001e - -/** - * @brief error, for event specific reasons the event is not - * applied - * - */ -#define DEBUGGER_ERROR_EVENT_IS_NOT_APPLIED 0xc000001f - -/** - * @brief error, for process switch or process details, invalid parameter - * - */ -#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_PROCESS_INVALID_PARAMETER 0xc0000020 - -/** - * @brief error, for thread switch or thread details, invalid parameter - * - */ -#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER 0xc0000021 - -/** - * @brief error, maximum breakpoint for a single page is hit - * - */ -#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_FOR_A_SINGLE_PAGE_IS_HIT 0xc0000022 - -/** - * @brief error, there is no pre-allocated buffer - * - */ -#define DEBUGGER_ERROR_PRE_ALLOCATED_BUFFER_IS_EMPTY 0xc0000023 - -/** - * @brief error, in the EPT handler, it could not split the 2MB pages to - * 512 entries of 4 KB pages - * - */ -#define DEBUGGER_ERROR_EPT_COULD_NOT_SPLIT_THE_LARGE_PAGE_TO_4KB_PAGES 0xc0000024 - -/** - * @brief error, failed to get PML1 entry of the target address - * - */ -#define DEBUGGER_ERROR_EPT_FAILED_TO_GET_PML1_ENTRY_OF_TARGET_ADDRESS 0xc0000025 - -/** - * @brief error, multiple EPT Hooks or Monitors are applied on a single page - * - */ -#define DEBUGGER_ERROR_EPT_MULTIPLE_HOOKS_IN_A_SINGLE_PAGE 0xc0000026 - -/** - * @brief error, could not build the EPT Hook - * - */ -#define DEBUGGER_ERROR_COULD_NOT_BUILD_THE_EPT_HOOK 0xc0000027 - -/** - * @brief error, could not find the type of allocation - * - */ -#define DEBUGGER_ERROR_COULD_NOT_FIND_ALLOCATION_TYPE 0xc0000028 - -/** - * @brief error, could not find the index of test query - * - */ -#define DEBUGGER_ERROR_INVALID_TEST_QUERY_INDEX 0xc0000029 - -/** - * @brief error, failed to attach to the target user-mode process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS 0xc000002a - -/** - * @brief error, failed to remove hooks as entrypoint is not reached yet - * @details The caller of this functionality should keep sending the previous - * IOCTL until the hook is remove successfully - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED 0xc000002b - -/** - * @brief error, could not remove the previous hook - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS 0xc000002c - -/** - * @brief error, the needed routines for debugging is not initialized - * - */ -#define DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED 0xc000002d - -/** - * @brief error, unable to get 32-bit or 64-bit of the target process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS 0xc000002e - -/** - * @brief error, unable to kill the target process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS 0xc000002f - -/** - * @brief error, invalid thread debugging token - * - */ -#define DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN 0xc0000030 - -/** - * @brief error, unable to pause the process's threads - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS 0xc0000031 - -/** - * @brief error, user debugger already attached to this process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS 0xc0000032 - -/** - * @brief error, the user debugger is not attached to the target process - * - */ -#define DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS 0xc0000033 - -/** - * @brief error, cannot detach from the process as there are paused threads - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS 0xc0000034 - -/** - * @brief error, cannot switch to new thread as the process id or thread id is not found - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID 0xc0000035 - -/** - * @brief error, cannot switch to new thread the process doesn't contain an active thread - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS 0xc0000036 - -/** - * @brief error, unable to get modules - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS 0xc0000037 - -/** - * @brief error, unable to get the callstack - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_GET_CALLSTACK 0xc0000038 - -/** - * @brief error, unable to query count of processes or threads - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_QUERY_COUNT_OF_PROCESSES_OR_THREADS 0xc0000039 - -/** - * @brief error, using short-circuiting event with post-event mode is - * not supported in HyperDbg - * - */ -#define DEBUGGER_ERROR_USING_SHORT_CIRCUITING_EVENT_WITH_POST_EVENT_MODE_IS_FORBIDDEDN 0xc000003a - -/** - * @brief error, unknown test query is received - * - */ -#define DEBUGGER_ERROR_UNKNOWN_TEST_QUERY_RECEIVED 0xc000003b - -/** - * @brief error, for reading from memory in case of invalid parameters - * - */ -#define DEBUGGER_ERROR_READING_MEMORY_INVALID_PARAMETER 0xc000003c - -/** - * @brief error, the list of threads/process trap flag is full - * - */ -#define DEBUGGER_ERROR_THE_TRAP_FLAG_LIST_IS_FULL 0xc000003d - -/** - * @brief error, unable to kill the target process. process does not exists - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS 0xc000003e - -/** - * @brief error, the execution mode is incorrect - * - */ -#define DEBUGGER_ERROR_MODE_EXECUTION_IS_INVALID 0xc000003f - -/** - * @brief error, the process id cannot be specified while the debugger is in VMX-root mode - * - */ -#define DEBUGGER_ERROR_PROCESS_ID_CANNOT_BE_SPECIFIED_WHILE_APPLYING_EVENT_FROM_VMX_ROOT_MODE 0xc0000040 - -/** - * @brief error, the preallocated buffer is not enough for storing event+conditional buffer - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_EVENT_AND_CONDITIONALS 0xc0000041 - -/** - * @brief error, the regular preallocated buffer not found - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000042 - -/** - * @brief error, the big preallocated buffer not found - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000043 - -/** - * @brief error, enable to create action (cannot allocate buffer) - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_CREATE_ACTION_CANNOT_ALLOCATE_BUFFER 0xc0000044 - -/** - * @brief error, the regular preallocated buffer not found (for action) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000045 - -/** - * @brief error, the big preallocated buffer not found (for action) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000046 - -/** - * @brief error, the preallocated buffer is not enough for storing action buffer - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_ACTION_BUFFER 0xc0000047 - -/** - * @brief error, the requested optional buffer is bigger than send/receive stack of the debugger - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_REQUESTED_OPTIONAL_BUFFER_IS_BIGGER_THAN_DEBUGGERS_SEND_RECEIVE_STACK 0xc0000048 - -/** - * @brief error, the requested safe buffer does not exist (regular) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc0000049 - -/** - * @brief error, the requested safe buffer does not exists (big) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc000004a - -/** - * @brief error, the preallocated buffer is not enough for storing safe requested buffer - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_REQUESTED_SAFE_BUFFER 0xc000004b - -/** - * @brief error, enable to create requested safe buffer (cannot allocate buffer) - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_ALLOCATE_REQUESTED_SAFE_BUFFER 0xc000004c - -/** - * @brief error, could not find the type of preactivation - * - */ -#define DEBUGGER_ERROR_COULD_NOT_FIND_PREACTIVATION_TYPE 0xc000004d - -/** - * @brief error, the mode exec trap is not already initialized - * - */ -#define DEBUGGER_ERROR_THE_MODE_EXEC_TRAP_IS_NOT_INITIALIZED 0xc000004e - -/** - * @brief error, the target event(s) is/are disabled but cannot clear them because the buffer of the user-mode - * priority is full - * - */ -#define DEBUGGER_ERROR_THE_TARGET_EVENT_IS_DISABLED_BUT_CANNOT_BE_CLEARED_PRIRITY_BUFFER_IS_FULL 0xc000004f - -/** - * @brief error, not all cores are locked (probably due to a race condition in HyperDbg) in - * instant-event mechanism - * - */ -#define DEBUGGER_ERROR_NOT_ALL_CORES_ARE_LOCKED_FOR_APPLYING_INSTANT_EVENT 0xc0000050 - -/** - * @brief error, switching to the target core is not possible because core is not locked - * (probably due to a race condition in HyperDbg) - * - */ -#define DEBUGGER_ERROR_TARGET_SWITCHING_CORE_IS_NOT_LOCKED 0xc0000051 - -/** - * @brief error, invalid physical address - * - */ -#define DEBUGGER_ERROR_INVALID_PHYSICAL_ADDRESS 0xc0000052 - -// -// WHEN YOU ADD ANYTHING TO THIS LIST OF ERRORS, THEN -// MAKE SURE TO ADD AN ERROR MESSAGE TO ShowErrorMessage(UINT32 Error) -// FUNCTION -// - -/** - * @file Connection.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers For Native Structures, Enums and Constants - * @details These datatypes are used in all devices like HDL (FPGAs) - * @version 0.2 - * @date 2022-07-14 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -/** - * @brief enum for reasons why debuggee is paused - * - */ -typedef enum _DEBUGGEE_PAUSING_REASON -{ - - // - // For both kernel & user debugger - // - DEBUGGEE_PAUSING_REASON_NOT_PAUSED = 0, - DEBUGGEE_PAUSING_REASON_PAUSE, - DEBUGGEE_PAUSING_REASON_REQUEST_FROM_DEBUGGER, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_STEPPED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_TRACKING_STEPPED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_HARDWARE_DEBUG_REGISTER_HIT, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_CORE_SWITCHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_PROCESS_SWITCHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_THREAD_SWITCHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_COMMAND_EXECUTION_FINISHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_EVENT_TRIGGERED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED, - - // - // Only for user-debugger - // - DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_DEBUG_BREAK, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED, - - // - // Only used for hardware debugging - // - DEBUGGEE_PAUSING_REASON_HARDWARE_BASED_DEBUGGEE_GENERAL_BREAK, - -} DEBUGGEE_PAUSING_REASON; - -/** - * @brief enum for requested action for HyperDbg packet - * - */ -typedef enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION -{ - - // - // Debugger to debuggee (user-mode execution) - // - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_PAUSE = 1, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DO_NOT_READ_ANY_PACKET, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DEBUGGER_VERSION, - - // - // Debuggee to debugger (user-mode execution) - // - DEBUGGER_REMOTE_PACKET_PING_AND_SEND_SUPPORTED_VERSION, - - // - // Debugger to debuggee (vmx-root mode execution) - // - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_STEP, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CONTINUE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CLOSE_AND_UNLOAD_DEBUGGEE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_CORE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_FLUSH_BUFFERS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CALLSTACK, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_TEST_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_PROCESS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_THREAD, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_USER_INPUT_BUFFER, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SEARCH_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_REGISTER_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_ADD_ACTION_TO_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_AND_MODIFY_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_REGISTERS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_EDIT_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_BP, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_LIST_OR_MODIFY_BREAKPOINTS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_RELOAD, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_PA2VA_AND_VA2PA, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_QUERY_PTE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SET_SHORT_CIRCUITING_STATE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_INJECT_PAGE_FAULT, - - // - // Debuggee to debugger - // - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_NO_ACTION, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_STARTED, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_LOGGING_MECHANISM, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_PAUSED_AND_CURRENT_INSTRUCTION, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_CORE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_PROCESS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_THREAD, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_RUNNING_SCRIPT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FORMATS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FLUSH, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CALLSTACK, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_TEST_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_REGISTERING_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_ADDING_ACTION_TO_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_QUERY_AND_MODIFY_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_REGISTERS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_EDITING_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BP, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_STATE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_LIST_OR_MODIFY_BREAKPOINTS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_UPDATE_SYMBOL_INFO, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SYMBOL_FINISHED, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SEARCH_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_PTE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_VA2PA_AND_PA2VA, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BRINGING_PAGES_IN, - - // - // hardware debuggee to debugger - // - - // - // hardware debugger to debuggee - // - -} DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION; - -/** - * @brief enum for different packet types in HyperDbg packets - * @warning used in hwdbg - * - */ -typedef enum _DEBUGGER_REMOTE_PACKET_TYPE -{ - - // - // Debugger to debuggee (vmx-root) - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT = 1, - - // - // Debugger to debuggee (user-mode) - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_USER_MODE = 2, - - // - // Debuggee to debugger (user-mode and kernel-mode, vmx-root mode) - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER = 3, - - // - // Debugger to debuggee (hardware), used in hwdbg - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_HARDWARE_LEVEL = 4, - - // - // Debuggee to debugger (hardware), used in hwdbg - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER_HARDWARE_LEVEL = 5, - -} DEBUGGER_REMOTE_PACKET_TYPE; - -/** - * @brief The structure of remote packets in HyperDbg - * - */ -typedef struct _DEBUGGER_REMOTE_PACKET -{ - BYTE Checksum; - UINT64 Indicator; /* Shows the type of the packet */ - DEBUGGER_REMOTE_PACKET_TYPE TypeOfThePacket; - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedActionOfThePacket; - -} DEBUGGER_REMOTE_PACKET, *PDEBUGGER_REMOTE_PACKET; - -/** - * @file DataTypes.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK data type definitions - * @details This file contains definitions of structures, enums, etc. - * used in HyperDbg - * @version 0.2 - * @date 2022-06-22 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Memory Stages // -////////////////////////////////////////////////// - -/** - * @brief Different levels of paging - * - */ -typedef enum _PAGING_LEVEL -{ - PagingLevelPageTable = 0, - PagingLevelPageDirectory, - PagingLevelPageDirectoryPointerTable, - PagingLevelPageMapLevel4 -} PAGING_LEVEL; - -////////////////////////////////////////////////// -// Pool Manager // -////////////////////////////////////////////////// - -/** - * @brief Inum of intentions for buffers (buffer tag) - * - */ -typedef enum _POOL_ALLOCATION_INTENTION -{ - TRACKING_HOOKED_PAGES, - EXEC_TRAMPOLINE, - SPLIT_2MB_PAGING_TO_4KB_PAGE, - DETOUR_HOOK_DETAILS, - BREAKPOINT_DEFINITION_STRUCTURE, - PROCESS_THREAD_HOLDER, - - // - // Instant event buffers - // - INSTANT_REGULAR_EVENT_BUFFER, - INSTANT_BIG_EVENT_BUFFER, - INSTANT_REGULAR_EVENT_ACTION_BUFFER, - INSTANT_BIG_EVENT_ACTION_BUFFER, - - // - // Use for request safe buffers of the event - // - INSTANT_REGULAR_SAFE_BUFFER_FOR_EVENTS, - INSTANT_BIG_SAFE_BUFFER_FOR_EVENTS, - -} POOL_ALLOCATION_INTENTION; - -////////////////////////////////////////////////// -// Debug Registers Modifications // -////////////////////////////////////////////////// - -typedef enum _DEBUG_REGISTER_TYPE -{ - BREAK_ON_INSTRUCTION_FETCH, - BREAK_ON_WRITE_ONLY, - BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED, - BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH -} DEBUG_REGISTER_TYPE; - -////////////////////////////////////////////////// -// Execution Stages // -////////////////////////////////////////////////// - -typedef enum _VMX_EXECUTION_MODE -{ - VmxExecutionModeNonRoot = FALSE, - VmxExecutionModeRoot = TRUE -} VMX_EXECUTION_MODE; - -/** - * @brief Type of calling the event - * - */ -typedef enum _VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE -{ - VMM_CALLBACK_CALLING_STAGE_INVALID_EVENT_EMULATION = 0, - VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION = 1, - VMM_CALLBACK_CALLING_STAGE_POST_EVENT_EMULATION = 2, - VMM_CALLBACK_CALLING_STAGE_ALL_EVENT_EMULATION = 3 - -} VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE; - -/** - * @brief enum to query different process and thread interception mechanisms - * - */ -typedef enum _DEBUGGER_THREAD_PROCESS_TRACING -{ - - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_THREAD_CHANGE, - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_PROCESS_CHANGE, - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_DEBUG_REGISTER_INTERCEPTION, - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_WAITING_FOR_MOV_CR3_VM_EXITS, - -} DEBUGGER_THREAD_PROCESS_TRACING; - -////////////////////////////////////////////////// -// Callback Definitions // -////////////////////////////////////////////////// - -/** - * @brief Callback type that can be used to be used - * as a custom ShowMessages function - * - */ -typedef int (*Callback)(const char * Text); - -////////////////////////////////////////////////// -// Communications // -////////////////////////////////////////////////// - -/** - * @brief The structure of user-input packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_USER_INPUT_PACKET -{ - UINT32 CommandLen; - BOOLEAN IgnoreFinishedSignal; - UINT32 Result; - - // - // The user's input is here - // - -} DEBUGGEE_USER_INPUT_PACKET, *PDEBUGGEE_USER_INPUT_PACKET; - -/** - * @brief The structure of user-input packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET -{ - UINT32 Length; - - // - // The buffer for event and action is here - // - -} DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET, - *PDEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET; - -////////////////////////////////////////////////// -// Pausing // -////////////////////////////////////////////////// - -#define SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED \ - sizeof(DEBUGGER_PAUSE_PACKET_RECEIVED) - -/** - * @brief request to pause and halt the system - * - */ -typedef struct _DEBUGGER_PAUSE_PACKET_RECEIVED -{ - UINT32 Result; // Result from kernel - -} DEBUGGER_PAUSE_PACKET_RECEIVED, *PDEBUGGER_PAUSE_PACKET_RECEIVED; - -/* ============================================================================================== - */ - -/** - * @brief The structure of detail of a triggered event in HyperDbg - * @details This structure is also used for transferring breakpoint ids, RIP as the context, etc. - * - */ -typedef struct _DEBUGGER_TRIGGERED_EVENT_DETAILS -{ - UINT64 Tag; /* in breakpoints Tag is breakpoint id, not event tag */ - PVOID Context; - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE Stage; - -} DEBUGGER_TRIGGERED_EVENT_DETAILS, *PDEBUGGER_TRIGGERED_EVENT_DETAILS; - -/* ============================================================================================== - */ - -/** - * @brief The structure of pausing packet in kHyperDbg - * - */ -typedef struct _DEBUGGEE_KD_PAUSED_PACKET -{ - UINT64 Rip; - BOOLEAN IsProcessorOn32BitMode; // if true shows that the address should be interpreted in 32-bit mode - BOOLEAN IgnoreDisassembling; // if check if diassembling should be ignored or not - DEBUGGEE_PAUSING_REASON PausingReason; - ULONG CurrentCore; - UINT64 EventTag; - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; - UINT64 Rflags; - BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; - UINT16 ReadInstructionLen; - -} DEBUGGEE_KD_PAUSED_PACKET, *PDEBUGGEE_KD_PAUSED_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of pausing packet in uHyperDbg - * - */ -typedef struct _DEBUGGEE_UD_PAUSED_PACKET -{ - UINT64 Rip; - UINT64 ProcessDebuggingToken; - BOOLEAN Is32Bit; // if true shows that the address should be interpreted in 32-bit mode - DEBUGGEE_PAUSING_REASON PausingReason; - UINT32 ProcessId; - UINT32 ThreadId; - UINT64 Rflags; - UINT64 EventTag; - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; - BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; - UINT16 ReadInstructionLen; - GUEST_REGS GuestRegs; - -} DEBUGGEE_UD_PAUSED_PACKET, *PDEBUGGEE_UD_PAUSED_PACKET; - -/** - * @brief check so the DEBUGGEE_UD_PAUSED_PACKET should be smaller than packet size - * - */ -//static_assert(sizeof(DEBUGGEE_UD_PAUSED_PACKET) < PacketChunkSize, -// "err (static_assert), size of PacketChunkSize should be bigger than DEBUGGEE_UD_PAUSED_PACKET"); - -////////////////////////////////////////////////// -// Message Tracing Enums // -////////////////////////////////////////////////// - -/** - * @brief Type of transferring buffer between user-to-kernel - * - */ -typedef enum _NOTIFY_TYPE -{ - IRP_BASED, - EVENT_BASED -} NOTIFY_TYPE; - -////////////////////////////////////////////////// -// Structures // -////////////////////////////////////////////////// - -/** - * @brief The structure of message packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_MESSAGE_PACKET -{ - UINT32 OperationCode; - CHAR Message[PacketChunkSize]; - -} DEBUGGEE_MESSAGE_PACKET, *PDEBUGGEE_MESSAGE_PACKET; - -/** - * @brief Used to register event for transferring buffer between user-to-kernel - * - */ -typedef struct _REGISTER_NOTIFY_BUFFER -{ - NOTIFY_TYPE Type; - HANDLE hEvent; - -} REGISTER_NOTIFY_BUFFER, *PREGISTER_NOTIFY_BUFFER; - -////////////////////////////////////////////////// -// Direct VMCALL // -////////////////////////////////////////////////// - -/** - * @brief Used for sending direct VMCALLs on the VMX root-mode - * - */ -typedef struct _DIRECT_VMCALL_PARAMETERS -{ - UINT64 OptionalParam1; - UINT64 OptionalParam2; - UINT64 OptionalParam3; - -} DIRECT_VMCALL_PARAMETERS, *PDIRECT_VMCALL_PARAMETERS; - -////////////////////////////////////////////////// -// EPT Hook // -////////////////////////////////////////////////// - -/** - * @brief different type of memory addresses - * - */ -typedef enum _DEBUGGER_HOOK_MEMORY_TYPE -{ - DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS, - DEBUGGER_MEMORY_HOOK_PHYSICAL_ADDRESS -} DEBUGGER_HOOK_MEMORY_TYPE; - -/** - * @brief Temporary $context used in some EPT hook commands - * - */ -typedef struct _EPT_HOOKS_CONTEXT -{ - UINT64 HookingTag; // This is same as the event tag - UINT64 PhysicalAddress; - UINT64 VirtualAddress; -} EPT_HOOKS_CONTEXT, *PEPT_HOOKS_CONTEXT; - -/** - * @brief Setting details for EPT Hooks (!monitor) - * - */ -typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR -{ - UINT64 StartAddress; - UINT64 EndAddress; - BOOLEAN SetHookForRead; - BOOLEAN SetHookForWrite; - BOOLEAN SetHookForExec; - DEBUGGER_HOOK_MEMORY_TYPE MemoryType; - UINT64 Tag; - -} EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR; - -/** - * @brief Setting details for EPT Hooks (!epthook2) - * - */ -typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2 -{ - PVOID TargetAddress; - PVOID HookFunction; - -} EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2; - -/** - * @brief Details of unhooking single EPT hooks - * - */ -typedef struct _EPT_SINGLE_HOOK_UNHOOKING_DETAILS -{ - BOOLEAN CallerNeedsToRestoreEntryAndInvalidateEpt; - BOOLEAN RemoveBreakpointInterception; - SIZE_T PhysicalAddress; - UINT64 /* EPT_PML1_ENTRY */ OriginalEntry; - -} EPT_SINGLE_HOOK_UNHOOKING_DETAILS, *PEPT_SINGLE_HOOK_UNHOOKING_DETAILS; - -////////////////////////////////////////////////// -// Segment Types // -////////////////////////////////////////////////// - -/** - * @brief Describe segment selector in VMX - * @details This structure is copied from ia32.h to the SDK to - * be used as a data type for functions - * - */ -typedef union -{ - struct - { - /** - * [Bits 3:0] Segment type. - */ - UINT32 Type : 4; - - /** - * [Bit 4] S - Descriptor type (0 = system; 1 = code or data). - */ - UINT32 DescriptorType : 1; - - /** - * [Bits 6:5] DPL - Descriptor privilege level. - */ - UINT32 DescriptorPrivilegeLevel : 2; - - /** - * [Bit 7] P - Segment present. - */ - UINT32 Present : 1; - - UINT32 Reserved1 : 4; - - /** - * [Bit 12] AVL - Available for use by system software. - */ - UINT32 AvailableBit : 1; - - /** - * [Bit 13] Reserved (except for CS). L - 64-bit mode active (for CS only). - */ - UINT32 LongMode : 1; - - /** - * [Bit 14] D/B - Default operation size (0 = 16-bit segment; 1 = 32-bit segment). - */ - UINT32 DefaultBig : 1; - - /** - * [Bit 15] G - Granularity. - */ - UINT32 Granularity : 1; - /** - * [Bit 16] Segment unusable (0 = usable; 1 = unusable). - */ - UINT32 Unusable : 1; - UINT32 Reserved2 : 15; - }; - - UINT32 AsUInt; -} VMX_SEGMENT_ACCESS_RIGHTS_TYPE; - -/** - * @brief Segment selector - * - */ -typedef struct _VMX_SEGMENT_SELECTOR -{ - UINT16 Selector; - VMX_SEGMENT_ACCESS_RIGHTS_TYPE Attributes; - UINT32 Limit; - UINT64 Base; -} VMX_SEGMENT_SELECTOR, *PVMX_SEGMENT_SELECTOR; - -/** - * @file Ioctls.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK IOCTL codes - * @details This file contains definitions of IOCTLs used in HyperDbg - * @version 0.2 - * @date 2022-06-24 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Definitions // -////////////////////////////////////////////////// - -// -// The following controls are mainly defined in -// - -// -// Macro definition for defining IOCTL and FSCTL function control codes. Note -// that function codes 0-2047 are reserved for Microsoft Corporation, and -// 2048-4095 are reserved for customers. -// -#ifndef CTL_CODE - -# define CTL_CODE(DeviceType, Function, Method, Access) ( \ - ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method)) - -#endif // ! CTL_CODE - -#ifndef FILE_ANY_ACCESS - -# define FILE_ANY_ACCESS 0 - -#endif // !FILE_ANY_ACCESS - -// -// Define the method codes for how buffers are passed for I/O and FS controls -// - -#ifndef METHOD_BUFFERED - -# define METHOD_BUFFERED 0 - -#endif // !METHOD_BUFFERED - -#ifndef FILE_DEVICE_UNKNOWN - -# define FILE_DEVICE_UNKNOWN 0x00000022 - -#endif // !FILE_DEVICE_UNKNOWN - -////////////////////////////////////////////////// -// IOCTLs // -////////////////////////////////////////////////// - -/** - * @brief ioctl, register a new event - * - */ -#define IOCTL_REGISTER_EVENT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, irp pending mechanism for reading from message tracing buffers - * - */ -#define IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to terminate vmx and exit form debugger - * - */ -#define IOCTL_TERMINATE_VMX \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to read memory - * - */ -#define IOCTL_DEBUGGER_READ_MEMORY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to read or write on a special MSR - * - */ -#define IOCTL_DEBUGGER_READ_OR_WRITE_MSR \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to read page table entries - * - */ -#define IOCTL_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, register an event - * - */ -#define IOCTL_DEBUGGER_REGISTER_EVENT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, add action to event - * - */ -#define IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to enable or disable transparent-mode - * - */ -#define IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, for !va2pa and !pa2va commands - * - */ -#define IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to edit virtual and physical memory - * - */ -#define IOCTL_DEBUGGER_EDIT_MEMORY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to search virtual and physical memory - * - */ -#define IOCTL_DEBUGGER_SEARCH_MEMORY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to modify an event (enable/disable/clear) - * - */ -#define IOCTL_DEBUGGER_MODIFY_EVENTS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80c, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, flush the kernel buffers - * - */ -#define IOCTL_DEBUGGER_FLUSH_LOGGING_BUFFERS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80d, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, attach or detach user-mode processes - * - */ -#define IOCTL_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80e, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, print states (Deprecated) - * - * - */ -#define IOCTL_DEBUGGER_PRINT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80f, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, prepare debuggee - * - */ -#define IOCTL_PREPARE_DEBUGGEE \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, pause and halt the system - * - */ -#define IOCTL_PAUSE_PACKET_RECEIVED \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x811, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, send a signal that execution of command finished - * - */ -#define IOCTL_SEND_SIGNAL_EXECUTION_IN_DEBUGGEE_FINISHED \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x812, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, send user-mode messages to the debugger - * - */ -#define IOCTL_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x813, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, send general buffer from debuggee to debugger - * - */ -#define IOCTL_SEND_GENERAL_BUFFER_FROM_DEBUGGEE_TO_DEBUGGER \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x814, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to perform kernel-side tests - * - */ -#define IOCTL_PERFROM_KERNEL_SIDE_TESTS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to reserve pre-allocated pools - * - */ -#define IOCTL_RESERVE_PRE_ALLOCATED_POOLS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x816, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to send user debugger commands - * - */ -#define IOCTL_SEND_USER_DEBUGGER_COMMANDS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x817, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to get active threads/processes that are debugging - * - */ -#define IOCTL_GET_DETAIL_OF_ACTIVE_THREADS_AND_PROCESSES \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x818, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to get user mode modules details - * - */ -#define IOCTL_GET_USER_MODE_MODULE_DETAILS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x819, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, query count of active threads or processes - * - */ -#define IOCTL_QUERY_COUNT_OF_ACTIVE_PROCESSES_OR_THREADS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81a, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to get list threads/processes - * - */ -#define IOCTL_GET_LIST_OF_THREADS_AND_PROCESSES \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81b, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, query the current process details - * - */ -#define IOCTL_QUERY_CURRENT_PROCESS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81c, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, query the current thread details - * - */ -#define IOCTL_QUERY_CURRENT_THREAD \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81d, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request service from the reversing machine - * - */ -#define IOCTL_REQUEST_REV_MACHINE_SERVICE \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81e, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to bring pages in - * - */ -#define IOCTL_DEBUGGER_BRING_PAGES_IN \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81f, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to preactivate a functionality - * - */ -#define IOCTL_PREACTIVATE_FUNCTIONALITY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x820, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @file Events.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers for Events - * @details This file contains definitions of event datatypes - * @version 0.2 - * @date 2022-06-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// System Events // -////////////////////////////////////////////////// - -/** - * @brief Exceptions enum - * - */ -typedef enum _EXCEPTION_VECTORS -{ - EXCEPTION_VECTOR_DIVIDE_ERROR, - EXCEPTION_VECTOR_DEBUG_BREAKPOINT, - EXCEPTION_VECTOR_NMI, - EXCEPTION_VECTOR_BREAKPOINT, - EXCEPTION_VECTOR_OVERFLOW, - EXCEPTION_VECTOR_BOUND_RANGE_EXCEEDED, - EXCEPTION_VECTOR_UNDEFINED_OPCODE, - EXCEPTION_VECTOR_NO_MATH_COPROCESSOR, - EXCEPTION_VECTOR_DOUBLE_FAULT, - EXCEPTION_VECTOR_RESERVED0, - EXCEPTION_VECTOR_INVALID_TASK_SEGMENT_SELECTOR, - EXCEPTION_VECTOR_SEGMENT_NOT_PRESENT, - EXCEPTION_VECTOR_STACK_SEGMENT_FAULT, - EXCEPTION_VECTOR_GENERAL_PROTECTION_FAULT, - EXCEPTION_VECTOR_PAGE_FAULT, - EXCEPTION_VECTOR_RESERVED1, - EXCEPTION_VECTOR_MATH_FAULT, - EXCEPTION_VECTOR_ALIGNMENT_CHECK, - EXCEPTION_VECTOR_MACHINE_CHECK, - EXCEPTION_VECTOR_SIMD_FLOATING_POINT_NUMERIC_ERROR, - EXCEPTION_VECTOR_VIRTUAL_EXCEPTION, - EXCEPTION_VECTOR_RESERVED2, - EXCEPTION_VECTOR_RESERVED3, - EXCEPTION_VECTOR_RESERVED4, - EXCEPTION_VECTOR_RESERVED5, - EXCEPTION_VECTOR_RESERVED6, - EXCEPTION_VECTOR_RESERVED7, - EXCEPTION_VECTOR_RESERVED8, - EXCEPTION_VECTOR_RESERVED9, - EXCEPTION_VECTOR_RESERVED10, - EXCEPTION_VECTOR_RESERVED11, - EXCEPTION_VECTOR_RESERVED12, - - // - // NT (Windows) specific exception vectors. - // - APC_INTERRUPT = 31, - DPC_INTERRUPT = 47, - CLOCK_INTERRUPT = 209, - IPI_INTERRUPT = 225, - PMI_INTERRUPT = 254, - -} EXCEPTION_VECTORS; - -////////////////////////////////////////////////// -// Callback Enums // -////////////////////////////////////////////////// - -/** - * @brief The status of triggering events - * - */ -typedef enum _VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE -{ - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED = 0, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL = 0, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT = 1, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_DEBUGGER_NOT_ENABLED = 2, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_INVALID_EVENT_TYPE = 3, - -} VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE; - -////////////////////////////////////////////////// -// Event Details // -////////////////////////////////////////////////// - -/** - * @brief enum to show type of all HyperDbg events - * - */ -typedef enum _VMM_EVENT_TYPE_ENUM -{ - - // - // EPT Memory Monitoring Events - // - HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE, - HIDDEN_HOOK_READ_AND_WRITE, - HIDDEN_HOOK_READ_AND_EXECUTE, - HIDDEN_HOOK_WRITE_AND_EXECUTE, - HIDDEN_HOOK_READ, - HIDDEN_HOOK_WRITE, - HIDDEN_HOOK_EXECUTE, - - // - // EPT Hook Events - // - HIDDEN_HOOK_EXEC_DETOURS, - HIDDEN_HOOK_EXEC_CC, - - // - // System-call Events - // - SYSCALL_HOOK_EFER_SYSCALL, - SYSCALL_HOOK_EFER_SYSRET, - - // - // CPUID Instruction Execution Events - // - CPUID_INSTRUCTION_EXECUTION, - - // - // Model-Specific Registers (MSRs) Reads/Modifications Events - // - RDMSR_INSTRUCTION_EXECUTION, - WRMSR_INSTRUCTION_EXECUTION, - - // - // PMIO Events - // - IN_INSTRUCTION_EXECUTION, - OUT_INSTRUCTION_EXECUTION, - - // - // Interrupts/Exceptions/Faults Events - // - EXCEPTION_OCCURRED, - EXTERNAL_INTERRUPT_OCCURRED, - - // - // Debug Registers Events - // - DEBUG_REGISTERS_ACCESSED, - - // - // Timing & Performance Events - // - TSC_INSTRUCTION_EXECUTION, - PMC_INSTRUCTION_EXECUTION, - - // - // VMCALL Instruction Execution Events - // - VMCALL_INSTRUCTION_EXECUTION, - - // - // Control Registers Events - // - CONTROL_REGISTER_MODIFIED, - CONTROL_REGISTER_READ, - CONTROL_REGISTER_3_MODIFIED, - - // - // Execution Trap Events - // - TRAP_EXECUTION_MODE_CHANGED, - TRAP_EXECUTION_INSTRUCTION_TRACE, - -} VMM_EVENT_TYPE_ENUM; - -/** - * @brief Type of Actions - * - */ -typedef enum _DEBUGGER_EVENT_ACTION_TYPE_ENUM -{ - BREAK_TO_DEBUGGER, - RUN_SCRIPT, - RUN_CUSTOM_CODE - -} DEBUGGER_EVENT_ACTION_TYPE_ENUM; - -/** - * @brief Type of handling !syscall or !sysret - * - */ -typedef enum _DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE -{ - DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY = 0, - DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD = 1, - -} DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE; - -#define SIZEOF_DEBUGGER_MODIFY_EVENTS sizeof(DEBUGGER_MODIFY_EVENTS) - -/** - * @brief Type of mode change traps - * - */ -typedef enum _DEBUGGER_EVENT_MODE_TYPE -{ - DEBUGGER_EVENT_MODE_TYPE_USER_MODE_AND_KERNEL_MODE = 1, - DEBUGGER_EVENT_MODE_TYPE_USER_MODE = 3, - DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE = 0, - DEBUGGER_EVENT_MODE_TYPE_INVALID = 0xffffffff, - -} DEBUGGER_EVENT_MODE_TYPE; - -/** - * @brief Type of tracing events - * - */ -typedef enum _DEBUGGER_EVENT_TRACE_TYPE -{ - DEBUGGER_EVENT_TRACE_TYPE_INVALID = 0, - DEBUGGER_EVENT_TRACE_TYPE_STEP_IN = 1, - DEBUGGER_EVENT_TRACE_TYPE_STEP_OUT = 2, - DEBUGGER_EVENT_TRACE_TYPE_INSTRUMENTATION_STEP_IN = 3, - -} DEBUGGER_EVENT_TRACE_TYPE; - -/** - * @brief different types of modifying events request (enable/disable/clear) - * - */ -typedef enum _DEBUGGER_MODIFY_EVENTS_TYPE -{ - DEBUGGER_MODIFY_EVENTS_QUERY_STATE, - DEBUGGER_MODIFY_EVENTS_ENABLE, - DEBUGGER_MODIFY_EVENTS_DISABLE, - DEBUGGER_MODIFY_EVENTS_CLEAR, -} DEBUGGER_MODIFY_EVENTS_TYPE; - -/** - * @brief request for modifying events (enable/disable/clear) - * - */ -typedef struct _DEBUGGER_MODIFY_EVENTS -{ - UINT64 Tag; // Tag of the target event that we want to modify - UINT64 KernelStatus; // Kernel put the status in this field - DEBUGGER_MODIFY_EVENTS_TYPE - TypeOfAction; // Determines what's the action (enable | disable | clear) - BOOLEAN IsEnabled; // Determines what's the action (enable | disable | clear) - -} DEBUGGER_MODIFY_EVENTS, *PDEBUGGER_MODIFY_EVENTS; - -/** - * @brief request for performing a short-circuiting event - * - */ -typedef struct _DEBUGGER_SHORT_CIRCUITING_EVENT -{ - UINT64 KernelStatus; // Kernel put the status in this field - BOOLEAN IsShortCircuiting; // Determines whether to perform short circuting (on | off) - -} DEBUGGER_SHORT_CIRCUITING_EVENT, *PDEBUGGER_SHORT_CIRCUITING_EVENT; - -////////////////////////////////////////////////// -// Event Options // -////////////////////////////////////////////////// - -/** - * @brief request for performing a short-circuiting event - * - */ -typedef struct _DEBUGGER_EVENT_OPTIONS -{ - UINT64 OptionalParam1; // Optional parameter - UINT64 OptionalParam2; // Optional parameter - UINT64 OptionalParam3; // Optional parameter - UINT64 OptionalParam4; // Optional parameter - UINT64 OptionalParam5; // Optional parameter - UINT64 OptionalParam6; // Optional parameter - -} DEBUGGER_EVENT_OPTIONS, *PDEBUGGER_EVENT_OPTIONS; - -////////////////////////////////////////////////// -// Enums For Event And Debugger Resources // -////////////////////////////////////////////////// - -/** - * @brief Things to consider when applying resources - * - */ -typedef enum _PROTECTED_HV_RESOURCES_PASSING_OVERS -{ - // - // for exception bitmap - // - PASSING_OVER_NONE = 0, - PASSING_OVER_UD_EXCEPTIONS_FOR_SYSCALL_SYSRET_HOOK = 1, - PASSING_OVER_EXCEPTION_EVENTS, - - // - // for external interupts-exitings - // - PASSING_OVER_INTERRUPT_EVENTS, - - // - // for external rdtsc/p exitings - // - PASSING_OVER_TSC_EVENTS, - - // - // for external mov to hardware debug registers exitings - // - PASSING_OVER_MOV_TO_HW_DEBUG_REGS_EVENTS, - - // - // for external mov to control registers exitings - // - PASSING_OVER_MOV_TO_CONTROL_REGS_EVENTS, - -} PROTECTED_HV_RESOURCES_PASSING_OVERS; - -/** - * @brief Type of protected (multi-used) resources - * - */ -typedef enum _PROTECTED_HV_RESOURCES_TYPE -{ - PROTECTED_HV_RESOURCES_EXCEPTION_BITMAP, - - PROTECTED_HV_RESOURCES_EXTERNAL_INTERRUPT_EXITING, - - PROTECTED_HV_RESOURCES_RDTSC_RDTSCP_EXITING, - - PROTECTED_HV_RESOURCES_MOV_TO_DEBUG_REGISTER_EXITING, - - PROTECTED_HV_RESOURCES_MOV_CONTROL_REGISTER_EXITING, - - PROTECTED_HV_RESOURCES_MOV_TO_CR3_EXITING, - -} PROTECTED_HV_RESOURCES_TYPE; - -////////////////////////////////////////////////// -// Event Details // -////////////////////////////////////////////////// - -/** - * @brief Each command is like the following struct, it also used for - * tracing works in user mode and sending it to the kernl mode - * @details THIS IS NOT WHAT HYPERDBG SAVES FOR EVENTS IN KERNEL-MODE - */ -typedef struct _DEBUGGER_GENERAL_EVENT_DETAIL -{ - LIST_ENTRY - CommandsEventList; // Linked-list of commands list (used for tracing purpose - // in user mode) - - time_t CreationTime; // Date of creating this event - - UINT32 CoreId; // determines the core index to apply this event to, if it's - // 0xffffffff means that we have to apply it to all cores - - UINT32 ProcessId; // determines the process id to apply this to - // only that 0xffffffff means that we have to - // apply it to all processes - - BOOLEAN IsEnabled; - - BOOLEAN EnableShortCircuiting; // indicates whether the short-circuiting event - // is enabled or not for this event - - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventStage; // reveals the calling stage of the event - // (whether it's a all- pre- or post- event) - - BOOLEAN HasCustomOutput; // Shows whether this event has a custom output - // source or not - - UINT64 - OutputSourceTags - [DebuggerOutputSourceMaximumRemoteSourceForSingleEvent]; // tags of - // multiple - // sources which - // can be used to - // send the event - // results of - // scripts to - // remote sources - - UINT32 CountOfActions; - - UINT64 Tag; // is same as operation code - VMM_EVENT_TYPE_ENUM EventType; - - DEBUGGER_EVENT_OPTIONS Options; - - PVOID CommandStringBuffer; - - UINT32 ConditionBufferSize; - -} DEBUGGER_GENERAL_EVENT_DETAIL, *PDEBUGGER_GENERAL_EVENT_DETAIL; - -/** - * @brief Each event can have multiple actions - * @details THIS STRUCTURE IS ONLY USED IN USER MODE - * WE USE SEPARATE STRUCTURE FOR ACTIONS IN - * KERNEL MODE - */ -typedef struct _DEBUGGER_GENERAL_ACTION -{ - UINT64 EventTag; - DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType; - BOOLEAN ImmediateMessagePassing; - UINT32 PreAllocatedBuffer; - - UINT32 CustomCodeBufferSize; - UINT32 ScriptBufferSize; - UINT32 ScriptBufferPointer; - -} DEBUGGER_GENERAL_ACTION, *PDEBUGGER_GENERAL_ACTION; - -/** - * @brief Status of register buffers - * - */ -typedef struct _DEBUGGER_EVENT_AND_ACTION_RESULT -{ - BOOLEAN IsSuccessful; - UINT32 Error; // If IsSuccessful was, FALSE - -} DEBUGGER_EVENT_AND_ACTION_RESULT, *PDEBUGGER_EVENT_AND_ACTION_RESULT; - -#define SIZEOF_REGISTER_EVENT sizeof(REGISTER_NOTIFY_BUFFER) - -/** - * @file RequestStructures.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers Request Packets - * @details This file contains definitions of request packets (enums, structs) - * @version 0.2 - * @date 2022-06-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -#define SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ - sizeof(DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS) - -/** - * @brief request for !pte command - * - */ -typedef struct _DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS -{ - UINT64 VirtualAddress; - UINT32 ProcessId; - - UINT64 Pml4eVirtualAddress; - UINT64 Pml4eValue; - - UINT64 PdpteVirtualAddress; - UINT64 PdpteValue; - - UINT64 PdeVirtualAddress; - UINT64 PdeValue; - - UINT64 PteVirtualAddress; - UINT64 PteValue; - - UINT32 KernelStatus; - -} DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, - *PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ - sizeof(DEBUGGER_VA2PA_AND_PA2VA_COMMANDS) - -/** - * @brief requests for !va2pa and !pa2va commands - * - */ -typedef struct _DEBUGGER_VA2PA_AND_PA2VA_COMMANDS -{ - UINT64 VirtualAddress; - UINT64 PhysicalAddress; - UINT32 ProcessId; - BOOLEAN IsVirtual2Physical; - UINT32 KernelStatus; - -} DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, *PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS; - -/* ============================================================================================== - */ -#define SIZEOF_DEBUGGER_PAGE_IN_REQUEST \ - sizeof(DEBUGGER_PAGE_IN_REQUEST) - -/** - * @brief requests for the '.pagein' command - * - */ -typedef struct _DEBUGGER_PAGE_IN_REQUEST -{ - UINT64 VirtualAddressFrom; - UINT64 VirtualAddressTo; - UINT32 ProcessId; - UINT32 PageFaultErrorCode; - UINT32 KernelStatus; - -} DEBUGGER_PAGE_IN_REQUEST, *PDEBUGGER_PAGE_IN_REQUEST; - -/* ============================================================================================== - */ - -/** - * @brief different modes of reconstruct requests - * - */ -typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE -{ - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN = 0, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_USER_MODE, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_KERNEL_MODE, -} REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE; - -/** - * @brief different types of reconstruct requests - * - */ -typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE -{ - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN = 0, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN, -} REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE; - -#define SIZEOF_REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST \ - sizeof(REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST) - -/** - * @brief requests for !rev command - * - */ -typedef struct _REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST -{ - UINT32 ProcessId; - UINT32 Size; - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE Mode; - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE Type; - UINT32 KernelStatus; - -} REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST, *PREVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_DT_COMMAND_OPTIONS \ - sizeof(DEBUGGER_DT_COMMAND_OPTIONS) - -/** - * @brief requests options for dt and struct command - * - */ -typedef struct _DEBUGGER_DT_COMMAND_OPTIONS -{ - const char * TypeName; - UINT64 SizeOfTypeName; - UINT64 Address; - BOOLEAN IsStruct; - PVOID BufferAddress; - UINT32 TargetPid; - const char * AdditionalParameters; - -} DEBUGGER_DT_COMMAND_OPTIONS, *PDEBUGGER_DT_COMMAND_OPTIONS; - -/* ============================================================================================== - */ - -/** - * @brief different types of prealloc requests - * - */ -typedef enum _DEBUGGER_PREALLOC_COMMAND_TYPE -{ - DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION, - DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR, - DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK, - DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK2, - DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_EVENT, - DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_EVENT, - DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_SAFE_BUFFER, - DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_SAFE_BUFFER, - -} DEBUGGER_PREALLOC_COMMAND_TYPE; - -#define SIZEOF_DEBUGGER_PREALLOC_COMMAND \ - sizeof(DEBUGGER_PREALLOC_COMMAND) - -/** - * @brief requests for the 'prealloc' command - * - */ -typedef struct _DEBUGGER_PREALLOC_COMMAND -{ - DEBUGGER_PREALLOC_COMMAND_TYPE Type; - UINT32 Count; - UINT32 KernelStatus; - -} DEBUGGER_PREALLOC_COMMAND, *PDEBUGGER_PREALLOC_COMMAND; - -/* ============================================================================================== - */ - -/** - * @brief different types of preactivate requests - * - */ -typedef enum _DEBUGGER_PREACTIVATE_COMMAND_TYPE -{ - DEBUGGER_PREACTIVATE_COMMAND_TYPE_MODE, - -} DEBUGGER_PREACTIVATE_COMMAND_TYPE; - -#define SIZEOF_DEBUGGER_PREACTIVATE_COMMAND \ - sizeof(DEBUGGER_PREACTIVATE_COMMAND) - -/** - * @brief requests for the 'preactivate' command - * - */ -typedef struct _DEBUGGER_PREACTIVATE_COMMAND -{ - DEBUGGER_PREACTIVATE_COMMAND_TYPE Type; - UINT32 KernelStatus; - -} DEBUGGER_PREACTIVATE_COMMAND, *PDEBUGGER_PREACTIVATE_COMMAND; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_READ_MEMORY sizeof(DEBUGGER_READ_MEMORY) - -/** - * @brief different types of reading memory - * - */ -typedef enum _DEBUGGER_READ_READING_TYPE -{ - READ_FROM_KERNEL, - READ_FROM_VMX_ROOT -} DEBUGGER_READ_READING_TYPE; - -/** - * @brief different type of addresses - * - */ -typedef enum _DEBUGGER_READ_MEMORY_TYPE -{ - DEBUGGER_READ_PHYSICAL_ADDRESS, - DEBUGGER_READ_VIRTUAL_ADDRESS -} DEBUGGER_READ_MEMORY_TYPE; - -/** - * @brief the way that debugger should show - * the details of memory or disassemble them - * - */ -typedef enum _DEBUGGER_SHOW_MEMORY_STYLE -{ - DEBUGGER_SHOW_COMMAND_DT = 1, - DEBUGGER_SHOW_COMMAND_DISASSEMBLE64, - DEBUGGER_SHOW_COMMAND_DISASSEMBLE32, - DEBUGGER_SHOW_COMMAND_DB, - DEBUGGER_SHOW_COMMAND_DC, - DEBUGGER_SHOW_COMMAND_DQ, - DEBUGGER_SHOW_COMMAND_DD, - DEBUGGER_SHOW_COMMAND_DUMP -} DEBUGGER_SHOW_MEMORY_STYLE; - -/** - * @brief request for reading virtual and physical memory - * - */ -typedef struct _DEBUGGER_READ_MEMORY -{ - UINT32 Pid; // Read from cr3 of what process - UINT64 Address; - UINT32 Size; - BOOLEAN IsForDisasm; // Debugger sets whether the read memory is for diassembler or not - BOOLEAN Is32BitAddress; // Debuggee sets the status of address - DEBUGGER_READ_MEMORY_TYPE MemoryType; - DEBUGGER_READ_READING_TYPE ReadingType; - PDEBUGGER_DT_COMMAND_OPTIONS DtDetails; - DEBUGGER_SHOW_MEMORY_STYLE Style; // not used in local debugging - UINT32 ReturnLength; // not used in local debugging - UINT32 KernelStatus; // not used in local debugging - - // - // Here is the target buffer (actual memory) - // - -} DEBUGGER_READ_MEMORY, *PDEBUGGER_READ_MEMORY; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_FLUSH_LOGGING_BUFFERS \ - sizeof(DEBUGGER_FLUSH_LOGGING_BUFFERS) - -/** - * @brief request for flushing buffers - * - */ -typedef struct _DEBUGGER_FLUSH_LOGGING_BUFFERS -{ - UINT32 KernelStatus; - UINT32 CountOfMessagesThatSetAsReadFromVmxRoot; - UINT32 CountOfMessagesThatSetAsReadFromVmxNonRoot; - -} DEBUGGER_FLUSH_LOGGING_BUFFERS, *PDEBUGGER_FLUSH_LOGGING_BUFFERS; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_TEST_QUERY_BUFFER \ - sizeof(DEBUGGER_TEST_QUERY_BUFFER) - -/** - * @brief test query used for test purposed - * - */ -typedef enum _DEBUGGER_TEST_QUERY_STATE -{ - TEST_QUERY_HALTING_CORE_STATUS = 1, // Query constant to show detail of halting of core - TEST_QUERY_PREALLOCATED_POOL_STATE = 2, // Query pre-allocated pool state - TEST_QUERY_TRAP_STATE = 3, // Query trap state - TEST_BREAKPOINT_TURN_OFF_BPS = 4, // Turn off the breakpoints (#BP) - TEST_BREAKPOINT_TURN_ON_BPS = 5, // Turn on the breakpoints (#BP) - TEST_BREAKPOINT_TURN_OFF_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 6, // Turn off the breakpoints and events for executing the commands in the remote computer - TEST_BREAKPOINT_TURN_ON_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 7, // Turn on the breakpoints and events for executing the commands in the remote computer - TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_SYNCHRONOUS = 8, // For testing synchronized event - TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_ASYNCHRONOUS = 9, // For testing unsynchronized event - TEST_SETTING_TARGET_TASKS_ON_TARGET_HALTED_CORES = 10, // Send the task to the halted core - TEST_BREAKPOINT_TURN_OFF_DBS = 11, // Turn off the debug breaks (#DB) - TEST_BREAKPOINT_TURN_ON_DBS = 12, // Turn on the debug breaks (#DB) - -} DEBUGGER_TEST_QUERY_STATE; - -/** - * @brief request for test query buffers - * - */ -typedef struct _DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER -{ - DEBUGGER_TEST_QUERY_STATE RequestType; - UINT64 Context; - UINT32 KernelStatus; - -} DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER, *PDEBUGGER_DEBUGGER_TEST_QUERY_BUFFER; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_PERFORM_KERNEL_TESTS \ - sizeof(DEBUGGER_PERFORM_KERNEL_TESTS) - -/** - * @brief request performing kernel tests - * - */ -typedef struct _DEBUGGER_PERFORM_KERNEL_TESTS -{ - UINT32 KernelStatus; - -} DEBUGGER_PERFORM_KERNEL_TESTS, *PDEBUGGER_PERFORM_KERNEL_TESTS; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL \ - sizeof(DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL) - -/** - * @brief request for send a signal that command execution finished - * - */ -typedef struct _DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL -{ - UINT32 KernelStatus; - -} DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL, - *PDEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER \ - sizeof(DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER) - -/** - * @brief request for send general packets from debuggee to debugger - * - */ -typedef struct _DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER -{ - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction; - UINT32 LengthOfBuffer; - BOOLEAN PauseDebuggeeWhenSent; - UINT32 KernelResult; - - // - // The buffer for the general packet is here - // - -} DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER, - *PDEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ - sizeof(DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER) - -/** - * @brief request for send a user-mode message to debugger - * - */ -typedef struct _DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER -{ - UINT32 KernelStatus; - UINT32 Length; - - // - // Here is the messages - // - -} DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER, - *PDEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR \ - sizeof(DEBUGGER_READ_AND_WRITE_ON_MSR) - -/** - * @brief different types of actions on MSRs - * - */ -typedef enum _DEBUGGER_MSR_ACTION_TYPE -{ - DEBUGGER_MSR_READ, - DEBUGGER_MSR_WRITE -} DEBUGGER_MSR_ACTION_TYPE; - -/** - * @brief request to read or write on MSRs - * - */ -typedef struct _DEBUGGER_READ_AND_WRITE_ON_MSR -{ - UINT64 Msr; // It's actually a 32-Bit value but let's not mess with a register - UINT32 CoreNumber; // specifies the core to execute wrmsr or read the msr - // (DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES mean all - // the cores) - DEBUGGER_MSR_ACTION_TYPE - ActionType; // Detects whether user needs wrmsr or rdmsr - UINT64 Value; - -} DEBUGGER_READ_AND_WRITE_ON_MSR, *PDEBUGGER_READ_AND_WRITE_ON_MSR; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_EDIT_MEMORY sizeof(DEBUGGER_EDIT_MEMORY) - -/** - * @brief different type of addresses for editing memory - * - */ -typedef enum _DEBUGGER_EDIT_MEMORY_TYPE -{ - EDIT_PHYSICAL_MEMORY, - EDIT_VIRTUAL_MEMORY -} DEBUGGER_EDIT_MEMORY_TYPE; - -/** - * @brief size of editing memory - * - */ -typedef enum _DEBUGGER_EDIT_MEMORY_BYTE_SIZE -{ - EDIT_BYTE, - EDIT_DWORD, - EDIT_QWORD -} DEBUGGER_EDIT_MEMORY_BYTE_SIZE; - -/** - * @brief request for edit virtual and physical memory - * - */ -typedef struct _DEBUGGER_EDIT_MEMORY -{ - UINT32 Result; // Result from kernel - UINT64 Address; // Target address to modify - UINT32 ProcessId; // specifies the process id - DEBUGGER_EDIT_MEMORY_TYPE MemoryType; // Type of memory - DEBUGGER_EDIT_MEMORY_BYTE_SIZE ByteSize; // Modification size - UINT32 CountOf64Chunks; - UINT32 FinalStructureSize; - UINT32 KernelStatus; // not used in local debugging - -} DEBUGGER_EDIT_MEMORY, *PDEBUGGER_EDIT_MEMORY; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_SEARCH_MEMORY sizeof(DEBUGGER_SEARCH_MEMORY) - -/** - * @brief different types of address for searching on memory - * - */ -typedef enum _DEBUGGER_SEARCH_MEMORY_TYPE -{ - SEARCH_PHYSICAL_MEMORY, - SEARCH_VIRTUAL_MEMORY, - SEARCH_PHYSICAL_FROM_VIRTUAL_MEMORY, - -} DEBUGGER_SEARCH_MEMORY_TYPE; - -/** - * @brief different sizes on searching memory - * - */ -typedef enum _DEBUGGER_SEARCH_MEMORY_BYTE_SIZE -{ - SEARCH_BYTE, - SEARCH_DWORD, - SEARCH_QWORD - -} DEBUGGER_SEARCH_MEMORY_BYTE_SIZE; - -/** - * @brief request for searching memory - * - */ -typedef struct _DEBUGGER_SEARCH_MEMORY -{ - UINT64 Address; // Target address to start searching - UINT64 Length; // Length of bytes to search - UINT32 ProcessId; // specifies the process id - DEBUGGER_SEARCH_MEMORY_TYPE MemoryType; // Type of memory - DEBUGGER_SEARCH_MEMORY_BYTE_SIZE ByteSize; // Modification size - UINT32 CountOf64Chunks; - UINT32 FinalStructureSize; - -} DEBUGGER_SEARCH_MEMORY, *PDEBUGGER_SEARCH_MEMORY; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE \ - sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) - -/** - * @brief request for enable or disable transparent-mode - * - */ -typedef struct _DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE -{ - BOOLEAN IsHide; - - UINT64 CpuidAverage; - UINT64 CpuidStandardDeviation; - UINT64 CpuidMedian; - - UINT64 RdtscAverage; - UINT64 RdtscStandardDeviation; - UINT64 RdtscMedian; - - BOOLEAN TrueIfProcessIdAndFalseIfProcessName; - UINT32 ProcId; - UINT32 LengthOfProcessName; // in the case of !hide name xxx, this parameter - // shows the length of xxx - - UINT64 KernelStatus; /* DEBUGGER_OPERATION_WAS_SUCCESSFUL , - DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER - */ - -} DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, - *PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_PREPARE_DEBUGGEE sizeof(DEBUGGER_PREPARE_DEBUGGEE) - -/** - * @brief request to make this computer to a debuggee - * - */ -typedef struct _DEBUGGER_PREPARE_DEBUGGEE -{ - UINT32 PortAddress; - UINT32 Baudrate; - UINT64 NtoskrnlBaseAddress; - UINT32 Result; // Result from the kernel - CHAR OsName[MAXIMUM_CHARACTER_FOR_OS_NAME]; - -} DEBUGGER_PREPARE_DEBUGGEE, *PDEBUGGER_PREPARE_DEBUGGEE; - -/* ============================================================================================== - */ - -/** - * @brief The structure of changing core packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_CHANGE_CORE_PACKET -{ - UINT32 NewCore; - UINT32 Result; - -} DEBUGGEE_CHANGE_CORE_PACKET, *PDEBUGGEE_CHANGE_CORE_PACKET; - -/* ============================================================================================== - */ -#define SIZEOF_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ - sizeof(DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS) - -/** - * @brief different actions of switchings - * - */ -typedef enum _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE -{ - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS, - -} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE; - -/** - * @brief request for attaching user-mode process - * - */ -typedef struct _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS -{ - BOOLEAN IsStartingNewProcess; - UINT32 ProcessId; - UINT32 ThreadId; - BOOLEAN CheckCallbackAtFirstInstruction; - BOOLEAN Is32Bit; - BOOLEAN IsPaused; // used in switching to threads - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE Action; - UINT32 CountOfActiveDebuggingThreadsAndProcesses; // used in showing the list of active threads/processes - UINT64 Token; - UINT64 Result; - -} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS, - *PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS; - -/* ============================================================================================== - */ -#define SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS \ - sizeof(DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS) - -/** - * @brief different type of process or thread queries - * - */ -typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES -{ - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT = 1, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT = 2, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST = 3, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST = 4, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_PROCESS = 5, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_THREAD = 6, - -} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES; - -/** - * @brief different actions on showing or querying list of process or threads - * - */ -typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS -{ - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_SHOW_INSTANTLY = 1, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT = 2, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_SAVE_DETAILS = 3, - -} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS; - -/** - * @brief The structure of needed information to get the details - * of the process from nt!_EPROCESS and location of needed variables - * - */ -typedef struct _DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS -{ - UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead - ULONG ImageFileNameOffset; // nt!_EPROCESS.ImageFileName - ULONG UniquePidOffset; // nt!_EPROCESS.UniqueProcessId - ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks - -} DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS, *PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS; - -/** - * @brief The structure of needed information to get the details - * of the thread from nt!_ETHREAD and location of needed variables - * - */ -typedef struct _DEBUGGEE_THREAD_LIST_NEEDED_DETAILS -{ - UINT32 ThreadListHeadOffset; // nt!_EPROCESS.ThreadListHead - UINT32 ThreadListEntryOffset; // nt!_ETHREAD.ThreadListEntry - UINT32 CidOffset; // nt!_ETHREAD.Cid - UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead - ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks - UINT64 Process; - -} DEBUGGEE_THREAD_LIST_NEEDED_DETAILS, *PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS; - -/** - * @brief The structure showing list of processes (details of each - * entry) - * - */ -typedef struct _DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY -{ - UINT64 Eprocess; - UINT32 ProcessId; - UINT64 Cr3; - UCHAR ImageFileName[15 + 1]; - -} DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY, *PDEBUGGEE_PROCESS_LIST_DETAILS_ENTRY; - -/** - * @brief The structure showing list of threads (details of each - * entry) - * - */ -typedef struct _DEBUGGEE_THREAD_LIST_DETAILS_ENTRY -{ - UINT64 Eprocess; - UINT64 Ethread; - UINT32 ProcessId; - UINT32 ThreadId; - UCHAR ImageFileName[15 + 1]; - -} DEBUGGEE_THREAD_LIST_DETAILS_ENTRY, *PDEBUGGEE_THREAD_LIST_DETAILS_ENTRY; - -/** - * @brief request for query count of active processes and threads - * - */ -typedef struct _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS -{ - DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededDetails; - DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListNeededDetails; - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES QueryType; - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS QueryAction; - UINT32 Count; - UINT64 Result; - -} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS, - *PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS; - -/* ============================================================================================== - */ - -/** - * @brief The structure for saving the callstack frame of one parameter - * - */ -typedef struct _DEBUGGER_SINGLE_CALLSTACK_FRAME -{ - BOOLEAN IsStackAddressValid; - BOOLEAN IsValidAddress; - BOOLEAN IsExecutable; - UINT64 Value; - BYTE InstructionBytesOnRip[MAXIMUM_CALL_INSTR_SIZE]; - -} DEBUGGER_SINGLE_CALLSTACK_FRAME, *PDEBUGGER_SINGLE_CALLSTACK_FRAME; - -#define SIZEOF_DEBUGGER_CALLSTACK_REQUEST \ - sizeof(DEBUGGER_CALLSTACK_REQUEST) - -/** - * @brief callstack showing method - * - */ -typedef enum _DEBUGGER_CALLSTACK_DISPLAY_METHOD -{ - DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITHOUT_PARAMS, - DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS, - -} DEBUGGER_CALLSTACK_DISPLAY_METHOD; - -/** - * @brief request for callstack frames - * - */ -typedef struct _DEBUGGER_CALLSTACK_REQUEST -{ - BOOLEAN Is32Bit; - UINT32 KernelStatus; - DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod; - UINT32 Size; - UINT32 FrameCount; - UINT64 BaseAddress; - UINT64 BufferSize; - - // - // Here is the size of stack frames - // - -} DEBUGGER_CALLSTACK_REQUEST, *PDEBUGGER_CALLSTACK_REQUEST; - -/* ============================================================================================== - */ -#define SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS \ - sizeof(USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS) - -typedef struct _USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS -{ - UINT32 ProcessId; - UINT32 ThreadId; - BOOLEAN IsProcess; - -} USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS, *PUSERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS; - -/* ============================================================================================== - */ - -/** - * @brief Used for run the script - * - */ -typedef struct _DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION -{ - UINT64 ScriptBuffer; - UINT32 ScriptLength; - UINT32 ScriptPointer; - UINT32 OptionalRequestedBufferSize; - -} DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION, - *PDEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION; - -/** - * @brief used in the case of requesting a "request buffer" - * - */ -typedef struct _DEBUGGER_EVENT_REQUEST_BUFFER -{ - BOOLEAN EnabledRequestBuffer; - UINT32 RequestBufferSize; - UINT64 RequstBufferAddress; - -} DEBUGGER_EVENT_REQUEST_BUFFER, *PDEBUGGER_EVENT_REQUEST_BUFFER; - -/** - * @brief used in the case of custom code requests to the debugger - * - */ -typedef struct _DEBUGGER_EVENT_REQUEST_CUSTOM_CODE -{ - UINT32 CustomCodeBufferSize; - PVOID CustomCodeBufferAddress; - UINT32 OptionalRequestedBufferSize; - -} DEBUGGER_EVENT_REQUEST_CUSTOM_CODE, *PDEBUGGER_EVENT_REQUEST_CUSTOM_CODE; - -/* ============================================================================================== - */ - -/** - * @brief User-mode debugging actions - * - */ -typedef enum _DEBUGGER_UD_COMMAND_ACTION_TYPE -{ - DEBUGGER_UD_COMMAND_ACTION_TYPE_NONE = 0, - DEBUGGER_UD_COMMAND_ACTION_TYPE_PAUSE, - DEBUGGER_UD_COMMAND_ACTION_TYPE_CONTINUE, - DEBUGGER_UD_COMMAND_ACTION_TYPE_REGULAR_STEP, - -} DEBUGGER_UD_COMMAND_ACTION_TYPE; - -/** - * @brief Description of user-mode debugging actions - * - */ -typedef struct _DEBUGGER_UD_COMMAND_ACTION -{ - DEBUGGER_UD_COMMAND_ACTION_TYPE ActionType; - UINT64 OptionalParam1; - UINT64 OptionalParam2; - UINT64 OptionalParam3; - UINT64 OptionalParam4; - -} DEBUGGER_UD_COMMAND_ACTION, *PDEBUGGER_UD_COMMAND_ACTION; - -/** - * @brief The structure of command packet in uHyperDbg - * - */ -typedef struct _DEBUGGER_UD_COMMAND_PACKET -{ - DEBUGGER_UD_COMMAND_ACTION UdAction; - UINT64 ProcessDebuggingDetailToken; - UINT32 TargetThreadId; - BOOLEAN ApplyToAllPausedThreads; - UINT32 Result; - -} DEBUGGER_UD_COMMAND_PACKET, *PDEBUGGER_UD_COMMAND_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Debugger process switch and process details - * - */ -typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE -{ - - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS, - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST, - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH, - -} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE; - -/** - * @brief The structure of changing process and show process - * packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET -{ - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType; - UINT32 ProcessId; - UINT64 Process; - BOOLEAN IsSwitchByClkIntr; - UCHAR ProcessName[16]; - DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListSymDetails; - UINT32 Result; - -} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET - * - */ -#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET \ - sizeof(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET) - -/** - * @brief Debugger thread switch and thread details - * - */ -typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE -{ - - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH, - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS, - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LIST, - -} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE; - -/** - * @brief The structure of changing thead and show thread - * packet in HyperDbg - */ -typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET -{ - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType; - UINT32 ThreadId; - UINT32 ProcessId; - UINT64 Thread; - UINT64 Process; - BOOLEAN CheckByClockInterrupt; - UCHAR ProcessName[16]; - DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListSymDetails; - UINT32 Result; - -} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET; - -/** - * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET - * - */ -#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET \ - sizeof(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET) - -/* ============================================================================================== - */ - -/** - * @brief stepping and tracking types - * - */ -typedef enum _DEBUGGER_REMOTE_STEPPING_REQUEST -{ - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_IN, - DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN, - DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN_FOR_TRACKING, - - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER, - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU, - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU_LAST_INSTRUCTION, - -} DEBUGGER_REMOTE_STEPPING_REQUEST; - -/** - * @brief The structure of stepping packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_STEP_PACKET -{ - DEBUGGER_REMOTE_STEPPING_REQUEST StepType; - - // - // Only in the case of call instructions - // the 'p' command - // - BOOLEAN IsCurrentInstructionACall; - UINT32 CallLength; - -} DEBUGGEE_STEP_PACKET, *PDEBUGGEE_STEP_PACKET; - -/** - * @brief default number of instructions used in tracking and stepping - * - */ -#define DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING 0xffffffff - -/* ============================================================================================== - */ - -/** - * @brief The structure of .formats result packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_FORMATS_PACKET -{ - UINT64 Value; - UINT32 Result; - -} DEBUGGEE_FORMATS_PACKET, *PDEBUGGEE_FORMATS_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of .sym reload packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_SYMBOL_REQUEST_PACKET -{ - UINT32 ProcessId; - -} DEBUGGEE_SYMBOL_REQUEST_PACKET, *PDEBUGGEE_SYMBOL_REQUEST_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of bp command packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_BP_PACKET -{ - UINT64 Address; - UINT32 Pid; - UINT32 Tid; - UINT32 Core; - BOOLEAN RemoveAfterHit; - BOOLEAN CheckForCallbacks; - UINT32 Result; - -} DEBUGGEE_BP_PACKET, *PDEBUGGEE_BP_PACKET; - -/** - * @brief breakpoint modification types - * - */ -typedef enum _DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST -{ - - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS, - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE, - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE, - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR, - -} DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST; - -/** - * @brief The structure of breakpoint modification requests packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_BP_LIST_OR_MODIFY_PACKET -{ - UINT64 BreakpointId; - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST Request; - UINT32 Result; - -} DEBUGGEE_BP_LIST_OR_MODIFY_PACKET, *PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Whether a jump is taken or not taken - * - */ -typedef enum _DEBUGGER_CONDITIONAL_JUMP_STATUS -{ - - DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR = 0, - DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP, - DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN, - DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN, - -} DEBUGGER_CONDITIONAL_JUMP_STATUS; - -/* ============================================================================================== - */ - -/** - * @brief The structure of script packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_SCRIPT_PACKET -{ - UINT32 ScriptBufferSize; - UINT32 ScriptBufferPointer; - BOOLEAN IsFormat; - UINT32 Result; - - // - // The script buffer is here - // - -} DEBUGGEE_SCRIPT_PACKET, *PDEBUGGEE_SCRIPT_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of result of search packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_RESULT_OF_SEARCH_PACKET -{ - UINT32 CountOfResults; - UINT32 Result; - -} DEBUGGEE_RESULT_OF_SEARCH_PACKET, *PDEBUGGEE_RESULT_OF_SEARCH_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Register Descriptor Structure to use in r command. - * - */ -typedef struct _DEBUGGEE_REGISTER_READ_DESCRIPTION -{ - UINT32 RegisterID; // the number is from REGS_ENUM - UINT64 Value; - UINT32 KernelStatus; - -} DEBUGGEE_REGISTER_READ_DESCRIPTION, *PDEBUGGEE_REGISTER_READ_DESCRIPTION; - -/* ============================================================================================== - */ - -/** - * @file Symbols.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Header Files For Symbol Parsing - * @details This file contains definitions of symbol parsers - * @version 0.2 - * @date 2022-06-24 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Symbols Details // -////////////////////////////////////////////////// - -/** - * @brief structures for sending and saving details - * about each module and symbols details - * - */ -typedef struct _MODULE_SYMBOL_DETAIL -{ - BOOLEAN IsSymbolDetailsFound; // TRUE if the details of symbols found, FALSE if not found - BOOLEAN IsLocalSymbolPath; // TRUE if the ModuleSymbolPath is a real path - // and FALSE if ModuleSymbolPath is just a module name - BOOLEAN IsSymbolPDBAvaliable; // TRUE if the module's pdb is available(if exists in the sympath) - BOOLEAN IsUserMode; // TRUE if the module is a user-mode module - BOOLEAN Is32Bit; // TRUE if the module is a 32-bit - UINT64 BaseAddress; - char FilePath[MAX_PATH]; - char ModuleSymbolPath[MAX_PATH]; - char ModuleSymbolGuidAndAge[MAXIMUM_GUID_AND_AGE_SIZE]; - -} MODULE_SYMBOL_DETAIL, *PMODULE_SYMBOL_DETAIL; - -typedef struct _USERMODE_LOADED_MODULE_SYMBOLS -{ - UINT64 BaseAddress; - UINT64 Entrypoint; - wchar_t FilePath[MAX_PATH]; - -} USERMODE_LOADED_MODULE_SYMBOLS, *PUSERMODE_LOADED_MODULE_SYMBOLS; - -typedef struct _USERMODE_LOADED_MODULE_DETAILS -{ - UINT32 ProcessId; - BOOLEAN OnlyCountModules; - BOOLEAN Is32Bit; - UINT32 ModulesCount; - UINT32 Result; - - // - // Here is a list of USERMODE_LOADED_MODULE_SYMBOLS (appended) - // - -} USERMODE_LOADED_MODULE_DETAILS, *PUSERMODE_LOADED_MODULE_DETAILS; - -/** - * @brief Callback type that should be used to add - * list of Addresses to ObjectNames - * - */ -typedef VOID (*SymbolMapCallback)(UINT64 Address, char * ModuleName, char * ObjectName, unsigned int ObjectSize); - -/** - * @brief request to add new symbol detail or update a previous - * symbol table entry - * - */ -typedef struct _DEBUGGER_UPDATE_SYMBOL_TABLE -{ - UINT32 TotalSymbols; - UINT32 CurrentSymbolIndex; - MODULE_SYMBOL_DETAIL SymbolDetailPacket; - -} DEBUGGER_UPDATE_SYMBOL_TABLE, *PDEBUGGER_UPDATE_SYMBOL_TABLE; - -/** - * @brief check so the DEBUGGER_UPDATE_SYMBOL_TABLE should be smaller than packet size - * - */ -//static_assert(sizeof(DEBUGGER_UPDATE_SYMBOL_TABLE) < PacketChunkSize, -// "err (static_assert), size of PacketChunkSize should be bigger than DEBUGGER_UPDATE_SYMBOL_TABLE (MODULE_SYMBOL_DETAIL)"); - -/* -============================================================================================== - */ - -/** - * @brief request that shows, symbol reload process is finished - * - */ -typedef struct _DEBUGGEE_SYMBOL_UPDATE_RESULT -{ - UINT64 KernelStatus; // Kernel put the status in this field - -} DEBUGGEE_SYMBOL_UPDATE_RESULT, *PDEBUGGEE_SYMBOL_UPDATE_RESULT; - -/* -============================================================================================== - */ - -/** - * @file HardwareDebugger.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's Hardware Debugger (hwdbg) types and constants - * @details This file contains definitions of hwdbg elements - * used in HyperDbg - * @version 0.9 - * @date 2024-04-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Definitions // -////////////////////////////////////////////////// - -/** - * @brief Initial debuggee to debugger offset - * - */ -#define DEFAULT_INITIAL_DEBUGGEE_TO_DEBUGGER_OFFSET 0x200 - -/** - * @brief Initial debugger to debuggee offset - * - */ -#define DEFAULT_INITIAL_DEBUGGER_TO_DEBUGGEE_OFFSET 0x0 - -////////////////////////////////////////////////// -// Enums // -////////////////////////////////////////////////// - -/** - * @brief Different action of hwdbg - * @warning This file should be changed along with hwdbg files - * - */ -typedef enum _HWDBG_ACTION_ENUMS -{ - hwdbgActionSendInstanceInfo = 1, - hwdbgActionConfigureScriptBuffer = 2, - -} HWDBG_ACTION_ENUMS; - -/** - * @brief Different responses come from hwdbg - * @warning This file should be changed along with hwdbg files - * - */ -typedef enum _HWDBG_RESPONSE_ENUMS -{ - hwdbgResponseSuccessOrErrorMessage = 1, - hwdbgResponseInstanceInfo = 2, - -} HWDBG_RESPONSE_ENUMS; - -/** - * @brief Different success or error codes in hwdbg - * @warning This file should be changed along with hwdbg files - * - */ -typedef enum _HWDBG_SUCCESS_OR_ERROR_ENUMS -{ - hwdbgOperationWasSuccessful = 0x7FFFFFFF, - hwdbgErrorInvalidPacket = 1, - -} HWDBG_SUCCESS_OR_ERROR_ENUMS; - -////////////////////////////////////////////////// -// Structures // -////////////////////////////////////////////////// - -/** - * @brief The structure of port information (each item) in hwdbg - * - */ -typedef struct _HWDBG_PORT_INFORMATION_ITEMS -{ - UINT32 PortSize; - -} HWDBG_PORT_INFORMATION_ITEMS, *PHWDBG_PORT_INFORMATION_ITEMS; - -/** - * @brief The structure of script capabilities information in hwdbg - * - */ -typedef struct _HWDBG_INSTANCE_INFORMATION -{ - // - // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE - // - UINT32 version; // Target version of HyperDbg (same as hwdbg) - UINT32 maximumNumberOfStages; // Number of stages that this instance of hwdbg supports (NumberOfSupportedStages == 0 means script engine is disabled) - UINT32 scriptVariableLength; // maximum length of variables (and other script elements) - UINT32 maximumNumberOfSupportedGetScriptOperators; // Maximum supported GET operators in a single func - UINT32 maximumNumberOfSupportedSetScriptOperators; // Maximum supported SET operators in a single func - UINT32 sharedMemorySize; // Size of shared memory - UINT32 debuggerAreaOffset; // The memory offset of debugger - UINT32 debuggeeAreaOffset; // The memory offset of debuggee - UINT32 numberOfPins; // Number of pins - UINT32 numberOfPorts; // Number of ports - - // - // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE - // - - struct _HWDBG_SCRIPT_CAPABILITIES - { - // - // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities - // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file - // - UINT64 func_or : 1; - UINT64 func_xor : 1; - UINT64 func_and : 1; - UINT64 func_asr : 1; - UINT64 func_asl : 1; - UINT64 func_add : 1; - UINT64 func_sub : 1; - UINT64 func_mul : 1; - UINT64 func_div : 1; - UINT64 func_mod : 1; - UINT64 func_gt : 1; - UINT64 func_lt : 1; - UINT64 func_egt : 1; - UINT64 func_elt : 1; - UINT64 func_equal : 1; - UINT64 func_neq : 1; - UINT64 func_jmp : 1; - UINT64 func_jz : 1; - UINT64 func_jnz : 1; - UINT64 func_mov : 1; - UINT64 func_printf : 1; - - // - // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities - // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file - // - - } scriptCapabilities; - - UINT32 bramAddrWidth; // BRAM address width - UINT32 bramDataWidth; // BRAM data width - - // - // Here the details of port arrangements are located (HWDBG_PORT_INFORMATION_ITEMS) - // As the following type: - // HWDBG_PORT_INFORMATION_ITEMS portsConfiguration[numberOfPorts] ; Port arrangement - // - -} HWDBG_INSTANCE_INFORMATION, *PHWDBG_INSTANCE_INFORMATION; - -/** - * @brief The structure of script buffer in hwdbg - * - */ -typedef struct _HWDBG_SCRIPT_BUFFER -{ - UINT32 scriptNumberOfSymbols; // Number of symbols in the script - - // - // Here the script buffer is located - // - // UINT8 scriptBuffer[scriptNumberOfSymbols]; // The script buffer - // - -} HWDBG_SCRIPT_BUFFER, *PHWDBG_SCRIPT_BUFFER; diff --git a/gengo/bind/sdkMerge/merged_headers.h b/gengo/bind/sdkMerge/merged_headers.h deleted file mode 100644 index 7d34cb392..000000000 --- a/gengo/bind/sdkMerge/merged_headers.h +++ /dev/null @@ -1,6008 +0,0 @@ -//bugfix.h -typedef unsigned short wchar_t; -typedef int bool ; -#define PVOID void* -#define HANDLE void* -#define PIRP void*//todo -#define PDEVICE_OBJECT void*//todo -#define PSYMBOL_BUFFER void*//todo -#define PSYMBOL void*//todo -#define MAX_PATH 260 -typedef unsigned __int64 SIZE_T,*PSIZE_T; -typedef unsigned __int64 time_t; -typedef unsigned __int64 NTSTATUS; -typedef char * va_list; - -typedef struct _LIST_ENTRY { - struct _LIST_ENTRY *Flink; - struct _LIST_ENTRY *Blink; -} LIST_ENTRY, *PLIST_ENTRY, PRLIST_ENTRY; - -#ifndef _In_ -#define _In_ -#endif - -#ifndef _Out_ -#define _Out_ -#endif - -#ifndef _Inout_ -#define _Inout_ -#endif - -#ifndef _Out_writes_bytes_ -#define _Out_writes_bytes_(x) -#endif - -#ifndef _In_reads_ -#define _In_reads_(x) -#endif - -#ifndef _In_reads_bytes_ -#define _In_reads_bytes_(x) -#endif - -/* -typedef struct _IRP { - CSHORT Type; - USHORT Size; - PMDL MdlAddress; - ULONG Flags; - union { - struct _IRP *MasterIrp; - __volatile LONG IrpCount; - PVOID SystemBuffer; - } AssociatedIrp; - LIST_ENTRY ThreadListEntry; - IO_STATUS_BLOCK IoStatus; - KPROCESSOR_MODE RequestorMode; - BOOLEAN PendingReturned; - CHAR StackCount; - CHAR CurrentLocation; - BOOLEAN Cancel; - KIRQL CancelIrql; - CCHAR ApcEnvironment; - UCHAR AllocationFlags; - union { - PIO_STATUS_BLOCK UserIosb; - PVOID IoRingContext; - }; - PKEVENT UserEvent; - union { - struct { - union { - PIO_APC_ROUTINE UserApcRoutine; - PVOID IssuingProcess; - }; - union { - PVOID UserApcContext; -#if ... - _IORING_OBJECT *IoRing; -#else - struct _IORING_OBJECT *IoRing; -#endif - }; - } AsynchronousParameters; - LARGE_INTEGER AllocationSize; - } Overlay; - __volatile PDRIVER_CANCEL CancelRoutine; - PVOID UserBuffer; - union { - struct { - union { - KDEVICE_QUEUE_ENTRY DeviceQueueEntry; - struct { - PVOID DriverContext[4]; - }; - }; - PETHREAD Thread; - PCHAR AuxiliaryBuffer; - struct { - LIST_ENTRY ListEntry; - union { - struct _IO_STACK_LOCATION *CurrentStackLocation; - ULONG PacketType; - }; - }; - PFILE_OBJECT OriginalFileObject; - } Overlay; - KAPC Apc; - PVOID CompletionKey; - } Tail; -} IRP; -*/ - - - - -//..\..\..\bin\debug\SDK\Headers\BasicTypes.h -/** - * @file BasicTypes.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers For Basic Datatypes - * @details This file contains definitions of basic datatypes - * @version 0.2 - * @date 2022-06-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -#pragma warning(disable : 4201) // Suppress nameless struct/union warning - -////////////////////////////////////////////////// -// Basic Datatypes // -////////////////////////////////////////////////// - -typedef unsigned long long QWORD; -typedef unsigned __int64 UINT64, *PUINT64; -typedef unsigned long DWORD; -typedef int BOOL; -typedef unsigned char BYTE; -typedef unsigned short WORD; -typedef int INT; -typedef unsigned int UINT; -typedef unsigned int * PUINT; -typedef unsigned __int64 ULONG64, *PULONG64; -typedef unsigned __int64 DWORD64, *PDWORD64; -typedef char CHAR; -typedef wchar_t WCHAR; -#define VOID void - -typedef unsigned char UCHAR; -typedef unsigned short USHORT; -typedef unsigned long ULONG; - -typedef UCHAR BOOLEAN; // winnt -typedef BOOLEAN * PBOOLEAN; // winnt - -typedef signed char INT8, *PINT8; -typedef signed short INT16, *PINT16; -typedef signed int INT32, *PINT32; -typedef signed __int64 INT64, *PINT64; -typedef unsigned char UINT8, *PUINT8; -typedef unsigned short UINT16, *PUINT16; -typedef unsigned int UINT32, *PUINT32; -typedef unsigned __int64 UINT64, *PUINT64; - -#define NULL_ZERO 0 -#define NULL64_ZERO 0ull - -#define FALSE 0 -#define TRUE 1 - -#define UPPER_56_BITS 0xffffffffffffff00 -#define UPPER_48_BITS 0xffffffffffff0000 -#define UPPER_32_BITS 0xffffffff00000000 -#define LOWER_32_BITS 0x00000000ffffffff -#define LOWER_16_BITS 0x000000000000ffff -#define LOWER_8_BITS 0x00000000000000ff -#define SECOND_LOWER_8_BITS 0x000000000000ff00 -#define UPPER_48_BITS_AND_LOWER_8_BITS 0xffffffffffff00ff - -// -// DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA -// -typedef struct GUEST_REGS -{ - // - // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA - // - - UINT64 rax; // 0x00 - UINT64 rcx; // 0x08 - UINT64 rdx; // 0x10 - UINT64 rbx; // 0x18 - UINT64 rsp; // 0x20 - UINT64 rbp; // 0x28 - UINT64 rsi; // 0x30 - UINT64 rdi; // 0x38 - UINT64 r8; // 0x40 - UINT64 r9; // 0x48 - UINT64 r10; // 0x50 - UINT64 r11; // 0x58 - UINT64 r12; // 0x60 - UINT64 r13; // 0x68 - UINT64 r14; // 0x70 - UINT64 r15; // 0x78 - - // - // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA - // - -} GUEST_REGS, *PGUEST_REGS; - -/** - * @brief struct for extra registers - * - */ -typedef struct GUEST_EXTRA_REGISTERS -{ - UINT16 CS; - UINT16 DS; - UINT16 FS; - UINT16 GS; - UINT16 ES; - UINT16 SS; - UINT64 RFLAGS; - UINT64 RIP; -} GUEST_EXTRA_REGISTERS, *PGUEST_EXTRA_REGISTERS; - -/** - * @brief List of different variables - */ -typedef struct _SCRIPT_ENGINE_VARIABLES_LIST -{ - UINT64 * TempList; - UINT64 * GlobalVariablesList; - UINT64 * LocalVariablesList; - -} SCRIPT_ENGINE_VARIABLES_LIST, *PSCRIPT_ENGINE_VARIABLES_LIST; - -/** - * @brief CR3 Structure - * - */ -typedef struct _CR3_TYPE -{ - union - { - UINT64 Flags; - - struct - { - UINT64 Pcid : 12; - UINT64 PageFrameNumber : 36; - UINT64 Reserved1 : 12; - UINT64 Reserved_2 : 3; - UINT64 PcidInvalidate : 1; - } Fields; - }; -} CR3_TYPE, *PCR3_TYPE; - - -//..\..\..\bin\debug\SDK\Headers\Connection.h -/** - * @file Connection.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers For Native Structures, Enums and Constants - * @details These datatypes are used in all devices like HDL (FPGAs) - * @version 0.2 - * @date 2022-07-14 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -/** - * @brief enum for reasons why debuggee is paused - * - */ -typedef enum _DEBUGGEE_PAUSING_REASON -{ - - // - // For both kernel & user debugger - // - DEBUGGEE_PAUSING_REASON_NOT_PAUSED = 0, - DEBUGGEE_PAUSING_REASON_PAUSE, - DEBUGGEE_PAUSING_REASON_REQUEST_FROM_DEBUGGER, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_STEPPED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_TRACKING_STEPPED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_HARDWARE_DEBUG_REGISTER_HIT, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_CORE_SWITCHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_PROCESS_SWITCHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_THREAD_SWITCHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_COMMAND_EXECUTION_FINISHED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_EVENT_TRIGGERED, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED, - - // - // Only for user-debugger - // - DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_DEBUG_BREAK, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED, - - // - // Only used for hardware debugging - // - DEBUGGEE_PAUSING_REASON_HARDWARE_BASED_DEBUGGEE_GENERAL_BREAK, - -} DEBUGGEE_PAUSING_REASON; - -/** - * @brief enum for requested action for HyperDbg packet - * - */ -typedef enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION -{ - - // - // Debugger to debuggee (user-mode execution) - // - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_PAUSE = 1, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DO_NOT_READ_ANY_PACKET, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DEBUGGER_VERSION, - - // - // Debuggee to debugger (user-mode execution) - // - DEBUGGER_REMOTE_PACKET_PING_AND_SEND_SUPPORTED_VERSION, - - // - // Debugger to debuggee (vmx-root mode execution) - // - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_STEP, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CONTINUE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CLOSE_AND_UNLOAD_DEBUGGEE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_CORE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_FLUSH_BUFFERS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CALLSTACK, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_TEST_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_PROCESS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_THREAD, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_USER_INPUT_BUFFER, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SEARCH_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_REGISTER_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_ADD_ACTION_TO_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_AND_MODIFY_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_REGISTERS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_EDIT_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_BP, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_LIST_OR_MODIFY_BREAKPOINTS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_RELOAD, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_PA2VA_AND_VA2PA, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_QUERY_PTE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SET_SHORT_CIRCUITING_STATE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_INJECT_PAGE_FAULT, - - // - // Debuggee to debugger - // - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_NO_ACTION, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_STARTED, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_LOGGING_MECHANISM, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_PAUSED_AND_CURRENT_INSTRUCTION, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_CORE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_PROCESS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_THREAD, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_RUNNING_SCRIPT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FORMATS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FLUSH, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CALLSTACK, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_TEST_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_REGISTERING_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_ADDING_ACTION_TO_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_QUERY_AND_MODIFY_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_EVENT, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_REGISTERS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_EDITING_MEMORY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BP, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_STATE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_LIST_OR_MODIFY_BREAKPOINTS, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_UPDATE_SYMBOL_INFO, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SYMBOL_FINISHED, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SEARCH_QUERY, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_PTE, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_VA2PA_AND_PA2VA, - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BRINGING_PAGES_IN, - - // - // hardware debuggee to debugger - // - - // - // hardware debugger to debuggee - // - -} DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION; - -/** - * @brief enum for different packet types in HyperDbg packets - * @warning used in hwdbg - * - */ -typedef enum _DEBUGGER_REMOTE_PACKET_TYPE -{ - - // - // Debugger to debuggee (vmx-root) - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT = 1, - - // - // Debugger to debuggee (user-mode) - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_USER_MODE = 2, - - // - // Debuggee to debugger (user-mode and kernel-mode, vmx-root mode) - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER = 3, - - // - // Debugger to debuggee (hardware), used in hwdbg - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_HARDWARE_LEVEL = 4, - - // - // Debuggee to debugger (hardware), used in hwdbg - // - DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER_HARDWARE_LEVEL = 5, - -} DEBUGGER_REMOTE_PACKET_TYPE; - -/** - * @brief The structure of remote packets in HyperDbg - * - */ -typedef struct _DEBUGGER_REMOTE_PACKET -{ - BYTE Checksum; - UINT64 Indicator; /* Shows the type of the packet */ - DEBUGGER_REMOTE_PACKET_TYPE TypeOfThePacket; - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedActionOfThePacket; - -} DEBUGGER_REMOTE_PACKET, *PDEBUGGER_REMOTE_PACKET; - - -//..\..\..\bin\debug\SDK\Headers\Constants.h -/** - * @file Constants.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK constants - * @details This file contains definitions of constants - * used in HyperDbg - * @version 0.2 - * @date 2022-06-24 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Version Information // -////////////////////////////////////////////////// - -#define VERSION_MAJOR 1 -#define VERSION_MINOR 0 -#define VERSION_PATCH 0 - -// -// Example of __DATE__ string: "Jul 27 2012" -// 01234567890 - -#define BUILD_YEAR_CH0 (__DATE__[7]) -#define BUILD_YEAR_CH1 (__DATE__[8]) -#define BUILD_YEAR_CH2 (__DATE__[9]) -#define BUILD_YEAR_CH3 (__DATE__[10]) - -#define BUILD_MONTH_IS_JAN (__DATE__[0] == 'J' && __DATE__[1] == 'a' && __DATE__[2] == 'n') -#define BUILD_MONTH_IS_FEB (__DATE__[0] == 'F') -#define BUILD_MONTH_IS_MAR (__DATE__[0] == 'M' && __DATE__[1] == 'a' && __DATE__[2] == 'r') -#define BUILD_MONTH_IS_APR (__DATE__[0] == 'A' && __DATE__[1] == 'p') -#define BUILD_MONTH_IS_MAY (__DATE__[0] == 'M' && __DATE__[1] == 'a' && __DATE__[2] == 'y') -#define BUILD_MONTH_IS_JUN (__DATE__[0] == 'J' && __DATE__[1] == 'u' && __DATE__[2] == 'n') -#define BUILD_MONTH_IS_JUL (__DATE__[0] == 'J' && __DATE__[1] == 'u' && __DATE__[2] == 'l') -#define BUILD_MONTH_IS_AUG (__DATE__[0] == 'A' && __DATE__[1] == 'u') -#define BUILD_MONTH_IS_SEP (__DATE__[0] == 'S') -#define BUILD_MONTH_IS_OCT (__DATE__[0] == 'O') -#define BUILD_MONTH_IS_NOV (__DATE__[0] == 'N') -#define BUILD_MONTH_IS_DEC (__DATE__[0] == 'D') - -#define BUILD_MONTH_CH0 \ - ((BUILD_MONTH_IS_OCT || BUILD_MONTH_IS_NOV || BUILD_MONTH_IS_DEC) ? '1' : '0') - -#define BUILD_MONTH_CH1 \ - ( \ - (BUILD_MONTH_IS_JAN) ? '1' : (BUILD_MONTH_IS_FEB) ? '2' \ - : (BUILD_MONTH_IS_MAR) ? '3' \ - : (BUILD_MONTH_IS_APR) ? '4' \ - : (BUILD_MONTH_IS_MAY) ? '5' \ - : (BUILD_MONTH_IS_JUN) ? '6' \ - : (BUILD_MONTH_IS_JUL) ? '7' \ - : (BUILD_MONTH_IS_AUG) ? '8' \ - : (BUILD_MONTH_IS_SEP) ? '9' \ - : (BUILD_MONTH_IS_OCT) ? '0' \ - : (BUILD_MONTH_IS_NOV) ? '1' \ - : (BUILD_MONTH_IS_DEC) ? '2' \ - : /* error default */ '?') - -#define BUILD_DAY_CH0 ((__DATE__[4] >= '0') ? (__DATE__[4]) : '0') -#define BUILD_DAY_CH1 (__DATE__[5]) - -// -// Example of __TIME__ string: "21:06:19" -// 01234567 - -#define BUILD_HOUR_CH0 (__TIME__[0]) -#define BUILD_HOUR_CH1 (__TIME__[1]) - -#define BUILD_MIN_CH0 (__TIME__[3]) -#define BUILD_MIN_CH1 (__TIME__[4]) - -#define BUILD_SEC_CH0 (__TIME__[6]) -#define BUILD_SEC_CH1 (__TIME__[7]) - -#if VERSION_MAJOR > 100 - -# define VERSION_MAJOR_INIT \ - ((VERSION_MAJOR / 100) + '0'), \ - (((VERSION_MAJOR % 100) / 10) + '0'), \ - ((VERSION_MAJOR % 10) + '0') - -#elif VERSION_MAJOR > 10 - -# define VERSION_MAJOR_INIT \ - ((VERSION_MAJOR / 10) + '0'), \ - ((VERSION_MAJOR % 10) + '0') - -#else - -# define VERSION_MAJOR_INIT \ - (VERSION_MAJOR + '0') - -#endif - -#if VERSION_MINOR > 100 - -# define VERSION_MINOR_INIT \ - ((VERSION_MINOR / 100) + '0'), \ - (((VERSION_MINOR % 100) / 10) + '0'), \ - ((VERSION_MINOR % 10) + '0') - -#elif VERSION_MINOR > 10 - -# define VERSION_MINOR_INIT \ - ((VERSION_MINOR / 10) + '0'), \ - ((VERSION_MINOR % 10) + '0') - -#else - -# define VERSION_MINOR_INIT \ - (VERSION_MINOR + '0') - -#endif - -#if VERSION_PATCH > 100 - -# define VERSION_PATCH_INIT \ - ((VERSION_PATCH / 100) + '0'), \ - (((VERSION_PATCH % 100) / 10) + '0'), \ - ((VERSION_PATCH % 10) + '0') - -#elif VERSION_PATCH > 10 - -# define VERSION_PATCH_INIT \ - ((VERSION_PATCH / 10) + '0'), \ - ((VERSION_PATCH % 10) + '0') - -#else - -# define VERSION_PATCH_INIT \ - (VERSION_PATCH + '0') - -#endif - -#ifndef HYPERDBG_KERNEL_MODE - -const unsigned char BuildDateTime[] = { - BUILD_YEAR_CH0, - BUILD_YEAR_CH1, - BUILD_YEAR_CH2, - BUILD_YEAR_CH3, - '-', - BUILD_MONTH_CH0, - BUILD_MONTH_CH1, - '-', - BUILD_DAY_CH0, - BUILD_DAY_CH1, - ' ', - BUILD_HOUR_CH0, - BUILD_HOUR_CH1, - ':', - BUILD_MIN_CH0, - BUILD_MIN_CH1, - ':', - BUILD_SEC_CH0, - BUILD_SEC_CH1, - - '\0'}; - -const unsigned char CompleteVersion[] = { - 'v', - VERSION_MAJOR_INIT, - '.', - VERSION_MINOR_INIT, - '.', - VERSION_PATCH_INIT, - '\0'}; - -const unsigned char BuildVersion[] = { - BUILD_YEAR_CH0, - BUILD_YEAR_CH1, - BUILD_YEAR_CH2, - BUILD_YEAR_CH3, - BUILD_MONTH_CH0, - BUILD_MONTH_CH1, - BUILD_DAY_CH0, - BUILD_DAY_CH1, - '.', - BUILD_HOUR_CH0, - BUILD_HOUR_CH1, - BUILD_MIN_CH0, - BUILD_MIN_CH1, - - '\0'}; - -const unsigned char BuildSignature[] = { - VERSION_MAJOR_INIT, - '.', - VERSION_MINOR_INIT, - '.', - VERSION_PATCH_INIT, - '-', - BUILD_YEAR_CH0, - BUILD_YEAR_CH1, - BUILD_YEAR_CH2, - BUILD_YEAR_CH3, - BUILD_MONTH_CH0, - BUILD_MONTH_CH1, - BUILD_DAY_CH0, - BUILD_DAY_CH1, - '.', - BUILD_HOUR_CH0, - BUILD_HOUR_CH1, - BUILD_MIN_CH0, - BUILD_MIN_CH1, - - '\0'}; - -#endif // SCRIPT_ENGINE_KERNEL_MODE - -////////////////////////////////////////////////// -// Message Tracing // -////////////////////////////////////////////////// - -/** - * @brief Default buffer count of packets for message tracing - * @details number of packets storage for regular buffers - */ -#define MaximumPacketsCapacity 1000 - -/** - * @brief Default buffer count of packets for message tracing - * @details number of packets storage for priority buffers - */ -#define MaximumPacketsCapacityPriority 50 - -/** - * @brief Size of normal OS (processor) pages - */ -#define NORMAL_PAGE_SIZE 4096 // PAGE_SIZE - -/** - * @brief Size of each packet - */ -#define PacketChunkSize NORMAL_PAGE_SIZE - -/** - * @brief size of user-mode buffer - * @details Because of operation code at the start of the - * buffer + 1 for null-termminating - * - */ -#define UsermodeBufferSize sizeof(UINT32) + PacketChunkSize + 1 - -/** - * @brief size of buffer for serial - * @details the maximum packet size for sending over serial - * - */ -#define MaxSerialPacketSize 10 * NORMAL_PAGE_SIZE - -/** - * @brief Final storage size of message tracing - * - */ -#define LogBufferSize \ - MaximumPacketsCapacity *(PacketChunkSize + sizeof(BUFFER_HEADER)) - -/** - * @brief Final storage size of message tracing - * - */ -#define LogBufferSizePriority \ - MaximumPacketsCapacityPriority *(PacketChunkSize + sizeof(BUFFER_HEADER)) - -/** - * @brief limitation of Windows DbgPrint message size - * @details currently is not functional - * - */ -#define DbgPrintLimitation 512 - -/** - * @brief The seeds that user-mode codes use as the starter - * of their events' tag - * - */ -#define DebuggerEventTagStartSeed 0x1000000 - -/** - * @brief The seeds that user-mode thread detail token start with it - * @details This seed should not start with zero (0), otherwise it's - * interpreted as error - */ -#define DebuggerThreadDebuggingTagStartSeed 0x1000000 - -/** - * @brief The seeds that user-mode codes use as the starter - * of their output source tag - * - */ -#define DebuggerOutputSourceTagStartSeed 0x1 - -/** - * @brief Determines how many sources a debugger can have for - * a single event - * - */ -#define DebuggerOutputSourceMaximumRemoteSourceForSingleEvent 0x5 - -/** - * @brief The size of each chunk of memory used in the 'memcpy' function - * of the script engine for transferring buffers in the VMX-root mode - * - */ -#define DebuggerScriptEngineMemcpyMovingBufferSize 64 - -////////////////////////////////////////////////// -// EPT Hook // -////////////////////////////////////////////////// - -/** - * @brief Maximum number of initial pre-allocated EPT hooks - * - */ -#define MAXIMUM_NUMBER_OF_INITIAL_PREALLOCATED_EPT_HOOKS 5 - -////////////////////////////////////////////////// -// Instant Event Configs // -////////////////////////////////////////////////// - -/** - * @brief Maximum number of (regular) instant events that are pre-allocated - * - */ -#define MAXIMUM_REGULAR_INSTANT_EVENTS 20 - -/** - * @brief Maximum number of (big) instant events that are pre-allocated - * - */ -#define MAXIMUM_BIG_INSTANT_EVENTS 0 - -/** - * @brief Pre-allocated size for a regular event + conditions buffer - * - */ -#define REGULAR_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + 100 - -/** - * @brief Pre-allocated size for a big event + conditions buffer - * - */ -#define BIG_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + PAGE_SIZE - -/** - * @brief Pre-allocated size for a regular action + custom code or script buffer - * - */ -#define REGULAR_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + (PAGE_SIZE * 2) - -/** - * @brief Pre-allocated size for a big action + custom code or script buffer - * - */ -#define BIG_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + MaxSerialPacketSize - -/** - * @brief Pre-allocated size for a regular requested safe buffer - * - */ -#define REGULAR_INSTANT_EVENT_REQUESTED_SAFE_BUFFER PAGE_SIZE - -/** - * @brief Pre-allocated size for a big requested safe buffer - * - */ -#define BIG_INSTANT_EVENT_REQUESTED_SAFE_BUFFER MaxSerialPacketSize - -////////////////////////////////////////////////// -// Remote Connection // -////////////////////////////////////////////////// - -/** - * @brief default port of HyperDbg for listening by - * debuggee (server, guest) - * - */ -#define DEFAULT_PORT "50000" - -/** - * @brief Packet size for TCP connections - * @details Note that we might add something to the kernel buffers - * that's why we add 0x100 to it - */ -#define COMMUNICATION_BUFFER_SIZE PacketChunkSize + 0x100 - -////////////////////////////////////////////////// -// VMCALL Numbers // -////////////////////////////////////////////////// - -/** - * @brief The start number of VMCALL number allowed to be - * used by top-level drivers - * - */ -#define TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER 0x00000200 - -/** - * @brief The start number of VMCALL number allowed to be - * used by top-level drivers - * - */ -#define TOP_LEVEL_DRIVERS_VMCALL_ENDING_NUMBER TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER + 0x100 - -////////////////////////////////////////////////// -// Operation Codes // -////////////////////////////////////////////////// - -/** - * @brief If a operation use this bit in its Operation code, - * then it means that the operation should be performed - * mandatorily in debuggee and should not be sent to the debugger - */ -#define OPERATION_MANDATORY_DEBUGGEE_BIT (1 << 31) - -/** - * @brief Message logs id that comes from kernel-mode to - * user-mode - * @details Message area >= 0x5 - */ -#define OPERATION_LOG_INFO_MESSAGE 1U -#define OPERATION_LOG_WARNING_MESSAGE 2U -#define OPERATION_LOG_ERROR_MESSAGE 3U -#define OPERATION_LOG_NON_IMMEDIATE_MESSAGE 4U -#define OPERATION_LOG_WITH_TAG 5U - -#define OPERATION_COMMAND_FROM_DEBUGGER_CLOSE_AND_UNLOAD_VMM \ - 6U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_USER_INPUT 7U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_REGISTER_EVENT 8U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_ADD_ACTION_TO_EVENT \ - 9 | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_CLEAR_EVENTS 10U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_DEBUGGEE_CLEAR_EVENTS_WITHOUT_NOTIFYING_DEBUGGER 11U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED \ - 12U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS \ - 13U | OPERATION_MANDATORY_DEBUGGEE_BIT -#define OPERATION_COMMAND_FROM_DEBUGGER_RELOAD_SYMBOL \ - 14U | OPERATION_MANDATORY_DEBUGGEE_BIT - -#define OPERATION_NOTIFICATION_FROM_USER_DEBUGGER_PAUSE \ - 15U | OPERATION_MANDATORY_DEBUGGEE_BIT - -////////////////////////////////////////////////// -// Breakpoints & Debug Breakpoints // -////////////////////////////////////////////////// - -/** - * @brief maximum number of buffers to be allocated for a single - * breakpoint - */ -#define MAXIMUM_BREAKPOINTS_WITHOUT_CONTINUE 100 - -/** - * @brief maximum number of thread/process ids to be allocated for a simultaneous - * debugging - * @details it shows the maximum number of threads/processes that HyperDbg sets - * trap flag for them - * - */ -#define MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_TRAPS 200 - -////////////////////////////////////////////////// -// Pool tags used in HyperDbg // -////////////////////////////////////////////////// - -/** - * @brief Pool tag - * - */ -#define POOLTAG 0x48444247 // [H]yper[DBG] (HDBG) - -////////////////////////////////////////////////// -// End of Buffer Detection // -////////////////////////////////////////////////// - -/** - * @brief count of characters for serial end of buffer - */ -#define SERIAL_END_OF_BUFFER_CHARS_COUNT 0x4 - -/** - * @brief characters of the buffer that we set at the end of - * buffers for serial - */ -#define SERIAL_END_OF_BUFFER_CHAR_1 0x00 -#define SERIAL_END_OF_BUFFER_CHAR_2 0x80 -#define SERIAL_END_OF_BUFFER_CHAR_3 0xEE -#define SERIAL_END_OF_BUFFER_CHAR_4 0xFF - -/** - * @brief count of characters for tcp end of buffer - */ -#define TCP_END_OF_BUFFER_CHARS_COUNT 0x4 - -/** - * @brief characters of the buffer that we set at the end of - * buffers for tcp - */ -#define TCP_END_OF_BUFFER_CHAR_1 0x10 -#define TCP_END_OF_BUFFER_CHAR_2 0x20 -#define TCP_END_OF_BUFFER_CHAR_3 0x33 -#define TCP_END_OF_BUFFER_CHAR_4 0x44 - -////////////////////////////////////////////////// -// Name of OS // -////////////////////////////////////////////////// - -/** - * @brief maximum name for OS name buffer - * - */ -#define MAXIMUM_CHARACTER_FOR_OS_NAME 256 - -////////////////////////////////////////////////// -// Processor Details // -////////////////////////////////////////////////// - -/** - * @brief maximum instruction size in Intel - */ -#define MAXIMUM_INSTR_SIZE 16 - -/** - * @brief maximum size for call instruction in Intel - */ -#define MAXIMUM_CALL_INSTR_SIZE 7 - -////////////////////////////////////////////////// -// Symbols Details // -////////////////////////////////////////////////// - -/** - * @brief maximum supported modules to load - * their symbol information - */ -#define MAXIMUM_SUPPORTED_SYMBOLS 1000 - -/** - * @brief maximum size for GUID and Age of PE - * @detail It seems that 33 bytes is enough but let's - * have more space because there might be sth that we - * missed :) - */ -#define MAXIMUM_GUID_AND_AGE_SIZE 60 - -////////////////////////////////////////////////// -// Debuggee Communication // -////////////////////////////////////////////////// - -/** - * @brief constant indicator of a HyperDbg packet - * @warning used in hwdbg - * - */ -#define INDICATOR_OF_HYPERDBG_PACKET \ - 0x4859504552444247 // HYPERDBG = 0x4859504552444247 - -////////////////////////////////////////////////// -// Command Details // -////////////////////////////////////////////////// - -/** - * @brief maximum results that will be returned by !s* s* - * command - * - */ -#define MaximumSearchResults 0x1000 - -////////////////////////////////////////////////// -// Script Engine // -////////////////////////////////////////////////// - -/** - * @brief EFLAGS/RFLAGS - * - */ -#define X86_FLAGS_CF (1 << 0) -#define X86_FLAGS_PF (1 << 2) -#define X86_FLAGS_AF (1 << 4) -#define X86_FLAGS_ZF (1 << 6) -#define X86_FLAGS_SF (1 << 7) -#define X86_FLAGS_TF (1 << 8) -#define X86_FLAGS_IF (1 << 9) -#define X86_FLAGS_DF (1 << 10) -#define X86_FLAGS_OF (1 << 11) -#define X86_FLAGS_STATUS_MASK (0xfff) -#define X86_FLAGS_IOPL_MASK (3 << 12) -#define X86_FLAGS_IOPL_SHIFT (12) -#define X86_FLAGS_IOPL_SHIFT_2ND_BIT (13) -#define X86_FLAGS_NT (1 << 14) -#define X86_FLAGS_RF (1 << 16) -#define X86_FLAGS_VM (1 << 17) -#define X86_FLAGS_AC (1 << 18) -#define X86_FLAGS_VIF (1 << 19) -#define X86_FLAGS_VIP (1 << 20) -#define X86_FLAGS_ID (1 << 21) -#define X86_FLAGS_RESERVED_ONES 0x2 -#define X86_FLAGS_RESERVED 0xffc0802a - -#define X86_FLAGS_RESERVED_BITS 0xffc38028 -#define X86_FLAGS_FIXED 0x00000002 - -#ifndef LOWORD -# define LOWORD(l) ((WORD)(l)) -#endif // !LOWORD - -#ifndef HIWORD -# define HIWORD(l) ((WORD)(((DWORD)(l) >> 16) & 0xFFFF)) -#endif // !HIWORD - -#ifndef LOBYTE -# define LOBYTE(w) ((BYTE)(w)) -#endif // !LOBYTE - -#ifndef HIBYTE -# define HIBYTE(w) ((BYTE)(((WORD)(w) >> 8) & 0xFF)) -#endif // !HIBYTE - -#define MAX_TEMP_COUNT 128 - -#define MAX_STACK_BUFFER_COUNT 128 - -// TODO: Extract number of variables from input of ScriptEngine -// and allocate variableList Dynamically. -#define MAX_VAR_COUNT 512 - -#define MAX_FUNCTION_NAME_LENGTH 32 - -////////////////////////////////////////////////// -// Debugger // -////////////////////////////////////////////////// - -/** - * @brief Apply event modifications to all tags - * - */ -#define DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG 0xffffffffffffffff - -/** - * @brief Maximum length for a function (to be used in showing distance - * from symbol functions in the 'u' command) - * - */ -#define DISASSEMBLY_MAXIMUM_DISTANCE_FROM_OBJECT_NAME 0xffff - -/** - * @brief Read and write MSRs to all cores - * - */ -#define DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES 0xffffffff - -/** - * @brief Apply the event to all the cores - * - */ -#define DEBUGGER_DEBUGGEE_IS_RUNNING_NO_CORE 0xffffffff - -/** - * @brief Apply the event to all the cores - * - */ -#define DEBUGGER_EVENT_APPLY_TO_ALL_CORES 0xffffffff - -/** - * @brief Apply the event to all the processes - * - */ -#define DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES 0xffffffff - -/** - * @brief Apply to all Model Specific Registers - * - */ -#define DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS 0xffffffff - -/** - * @brief Apply to all first 32 exceptions - * - */ -#define DEBUGGER_EVENT_EXCEPTIONS_ALL_FIRST_32_ENTRIES 0xffffffff - -/** - * @brief Apply to all syscalls and sysrets - * - */ -#define DEBUGGER_EVENT_SYSCALL_ALL_SYSRET_OR_SYSCALLS 0xffffffff - -/** - * @brief Apply to all I/O ports - * - */ -#define DEBUGGER_EVENT_ALL_IO_PORTS 0xffffffff - -/** - * @brief The constant to apply to all cores for bp command - * - */ -#define DEBUGGEE_BP_APPLY_TO_ALL_CORES 0xffffffff - -/** - * @brief The constant to apply to all processes for bp command - * - */ -#define DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES 0xffffffff - -/** - * @brief The constant to apply to all threads for bp command - * - */ -#define DEBUGGEE_BP_APPLY_TO_ALL_THREADS 0xffffffff - -/** - * @brief for reading all registers in r command. - * - */ -#define DEBUGGEE_SHOW_ALL_REGISTERS 0xffffffff - - -//..\..\..\bin\debug\SDK\Headers\DataTypes.h -/** - * @file DataTypes.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK data type definitions - * @details This file contains definitions of structures, enums, etc. - * used in HyperDbg - * @version 0.2 - * @date 2022-06-22 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Memory Stages // -////////////////////////////////////////////////// - -/** - * @brief Different levels of paging - * - */ -typedef enum _PAGING_LEVEL -{ - PagingLevelPageTable = 0, - PagingLevelPageDirectory, - PagingLevelPageDirectoryPointerTable, - PagingLevelPageMapLevel4 -} PAGING_LEVEL; - -////////////////////////////////////////////////// -// Pool Manager // -////////////////////////////////////////////////// - -/** - * @brief Inum of intentions for buffers (buffer tag) - * - */ -typedef enum _POOL_ALLOCATION_INTENTION -{ - TRACKING_HOOKED_PAGES, - EXEC_TRAMPOLINE, - SPLIT_2MB_PAGING_TO_4KB_PAGE, - DETOUR_HOOK_DETAILS, - BREAKPOINT_DEFINITION_STRUCTURE, - PROCESS_THREAD_HOLDER, - - // - // Instant event buffers - // - INSTANT_REGULAR_EVENT_BUFFER, - INSTANT_BIG_EVENT_BUFFER, - INSTANT_REGULAR_EVENT_ACTION_BUFFER, - INSTANT_BIG_EVENT_ACTION_BUFFER, - - // - // Use for request safe buffers of the event - // - INSTANT_REGULAR_SAFE_BUFFER_FOR_EVENTS, - INSTANT_BIG_SAFE_BUFFER_FOR_EVENTS, - -} POOL_ALLOCATION_INTENTION; - -////////////////////////////////////////////////// -// Debug Registers Modifications // -////////////////////////////////////////////////// - -typedef enum _DEBUG_REGISTER_TYPE -{ - BREAK_ON_INSTRUCTION_FETCH, - BREAK_ON_WRITE_ONLY, - BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED, - BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH -} DEBUG_REGISTER_TYPE; - -////////////////////////////////////////////////// -// Execution Stages // -////////////////////////////////////////////////// - -typedef enum _VMX_EXECUTION_MODE -{ - VmxExecutionModeNonRoot = FALSE, - VmxExecutionModeRoot = TRUE -} VMX_EXECUTION_MODE; - -/** - * @brief Type of calling the event - * - */ -typedef enum _VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE -{ - VMM_CALLBACK_CALLING_STAGE_INVALID_EVENT_EMULATION = 0, - VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION = 1, - VMM_CALLBACK_CALLING_STAGE_POST_EVENT_EMULATION = 2, - VMM_CALLBACK_CALLING_STAGE_ALL_EVENT_EMULATION = 3 - -} VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE; - -/** - * @brief enum to query different process and thread interception mechanisms - * - */ -typedef enum _DEBUGGER_THREAD_PROCESS_TRACING -{ - - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_THREAD_CHANGE, - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_PROCESS_CHANGE, - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_DEBUG_REGISTER_INTERCEPTION, - DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_WAITING_FOR_MOV_CR3_VM_EXITS, - -} DEBUGGER_THREAD_PROCESS_TRACING; - -////////////////////////////////////////////////// -// Callback Definitions // -////////////////////////////////////////////////// - -/** - * @brief Callback type that can be used to be used - * as a custom ShowMessages function - * - */ -typedef int (*Callback)(const char * Text); - -////////////////////////////////////////////////// -// Communications // -////////////////////////////////////////////////// - -/** - * @brief The structure of user-input packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_USER_INPUT_PACKET -{ - UINT32 CommandLen; - BOOLEAN IgnoreFinishedSignal; - UINT32 Result; - - // - // The user's input is here - // - -} DEBUGGEE_USER_INPUT_PACKET, *PDEBUGGEE_USER_INPUT_PACKET; - -/** - * @brief The structure of user-input packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET -{ - UINT32 Length; - - // - // The buffer for event and action is here - // - -} DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET, - *PDEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET; - -////////////////////////////////////////////////// -// Pausing // -////////////////////////////////////////////////// - -#define SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED \ - sizeof(DEBUGGER_PAUSE_PACKET_RECEIVED) - -/** - * @brief request to pause and halt the system - * - */ -typedef struct _DEBUGGER_PAUSE_PACKET_RECEIVED -{ - UINT32 Result; // Result from kernel - -} DEBUGGER_PAUSE_PACKET_RECEIVED, *PDEBUGGER_PAUSE_PACKET_RECEIVED; - -/* ============================================================================================== - */ - -/** - * @brief The structure of detail of a triggered event in HyperDbg - * @details This structure is also used for transferring breakpoint ids, RIP as the context, etc. - * - */ -typedef struct _DEBUGGER_TRIGGERED_EVENT_DETAILS -{ - UINT64 Tag; /* in breakpoints Tag is breakpoint id, not event tag */ - PVOID Context; - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE Stage; - -} DEBUGGER_TRIGGERED_EVENT_DETAILS, *PDEBUGGER_TRIGGERED_EVENT_DETAILS; - -/* ============================================================================================== - */ - -/** - * @brief The structure of pausing packet in kHyperDbg - * - */ -typedef struct _DEBUGGEE_KD_PAUSED_PACKET -{ - UINT64 Rip; - BOOLEAN IsProcessorOn32BitMode; // if true shows that the address should be interpreted in 32-bit mode - BOOLEAN IgnoreDisassembling; // if check if diassembling should be ignored or not - DEBUGGEE_PAUSING_REASON PausingReason; - ULONG CurrentCore; - UINT64 EventTag; - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; - UINT64 Rflags; - BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; - UINT16 ReadInstructionLen; - -} DEBUGGEE_KD_PAUSED_PACKET, *PDEBUGGEE_KD_PAUSED_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of pausing packet in uHyperDbg - * - */ -typedef struct _DEBUGGEE_UD_PAUSED_PACKET -{ - UINT64 Rip; - UINT64 ProcessDebuggingToken; - BOOLEAN Is32Bit; // if true shows that the address should be interpreted in 32-bit mode - DEBUGGEE_PAUSING_REASON PausingReason; - UINT32 ProcessId; - UINT32 ThreadId; - UINT64 Rflags; - UINT64 EventTag; - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; - BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; - UINT16 ReadInstructionLen; - GUEST_REGS GuestRegs; - -} DEBUGGEE_UD_PAUSED_PACKET, *PDEBUGGEE_UD_PAUSED_PACKET; - -////////////////////////////////////////////////// -// Message Tracing Enums // -////////////////////////////////////////////////// - -/** - * @brief Type of transferring buffer between user-to-kernel - * - */ -typedef enum _NOTIFY_TYPE -{ - IRP_BASED, - EVENT_BASED -} NOTIFY_TYPE; - -////////////////////////////////////////////////// -// Structures // -////////////////////////////////////////////////// - -/** - * @brief The structure of message packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_MESSAGE_PACKET -{ - UINT32 OperationCode; - CHAR Message[PacketChunkSize]; - -} DEBUGGEE_MESSAGE_PACKET, *PDEBUGGEE_MESSAGE_PACKET; - -/** - * @brief Used to register event for transferring buffer between user-to-kernel - * - */ -typedef struct _REGISTER_NOTIFY_BUFFER -{ - NOTIFY_TYPE Type; - HANDLE hEvent; - -} REGISTER_NOTIFY_BUFFER, *PREGISTER_NOTIFY_BUFFER; - -////////////////////////////////////////////////// -// Direct VMCALL // -////////////////////////////////////////////////// - -/** - * @brief Used for sending direct VMCALLs on the VMX root-mode - * - */ -typedef struct _DIRECT_VMCALL_PARAMETERS -{ - UINT64 OptionalParam1; - UINT64 OptionalParam2; - UINT64 OptionalParam3; - -} DIRECT_VMCALL_PARAMETERS, *PDIRECT_VMCALL_PARAMETERS; - -////////////////////////////////////////////////// -// EPT Hook // -////////////////////////////////////////////////// - -/** - * @brief different type of memory addresses - * - */ -typedef enum _DEBUGGER_HOOK_MEMORY_TYPE -{ - DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS, - DEBUGGER_MEMORY_HOOK_PHYSICAL_ADDRESS -} DEBUGGER_HOOK_MEMORY_TYPE; - -/** - * @brief Temporary $context used in some EPT hook commands - * - */ -typedef struct _EPT_HOOKS_CONTEXT -{ - UINT64 HookingTag; // This is same as the event tag - UINT64 PhysicalAddress; - UINT64 VirtualAddress; -} EPT_HOOKS_CONTEXT, *PEPT_HOOKS_CONTEXT; - -/** - * @brief Setting details for EPT Hooks (!monitor) - * - */ -typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR -{ - UINT64 StartAddress; - UINT64 EndAddress; - BOOLEAN SetHookForRead; - BOOLEAN SetHookForWrite; - BOOLEAN SetHookForExec; - DEBUGGER_HOOK_MEMORY_TYPE MemoryType; - UINT64 Tag; - -} EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR; - -/** - * @brief Setting details for EPT Hooks (!epthook2) - * - */ -typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2 -{ - PVOID TargetAddress; - PVOID HookFunction; - -} EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2; - -/** - * @brief Details of unhooking single EPT hooks - * - */ -typedef struct _EPT_SINGLE_HOOK_UNHOOKING_DETAILS -{ - BOOLEAN CallerNeedsToRestoreEntryAndInvalidateEpt; - BOOLEAN RemoveBreakpointInterception; - SIZE_T PhysicalAddress; - UINT64 /* EPT_PML1_ENTRY */ OriginalEntry; - -} EPT_SINGLE_HOOK_UNHOOKING_DETAILS, *PEPT_SINGLE_HOOK_UNHOOKING_DETAILS; - -////////////////////////////////////////////////// -// Segment Types // -////////////////////////////////////////////////// - -/** - * @brief Describe segment selector in VMX - * @details This structure is copied from ia32.h to the SDK to - * be used as a data type for functions - * - */ -typedef union -{ - struct - { - /** - * [Bits 3:0] Segment type. - */ - UINT32 Type : 4; - - /** - * [Bit 4] S - Descriptor type (0 = system; 1 = code or data). - */ - UINT32 DescriptorType : 1; - - /** - * [Bits 6:5] DPL - Descriptor privilege level. - */ - UINT32 DescriptorPrivilegeLevel : 2; - - /** - * [Bit 7] P - Segment present. - */ - UINT32 Present : 1; - - UINT32 Reserved1 : 4; - - /** - * [Bit 12] AVL - Available for use by system software. - */ - UINT32 AvailableBit : 1; - - /** - * [Bit 13] Reserved (except for CS). L - 64-bit mode active (for CS only). - */ - UINT32 LongMode : 1; - - /** - * [Bit 14] D/B - Default operation size (0 = 16-bit segment; 1 = 32-bit segment). - */ - UINT32 DefaultBig : 1; - - /** - * [Bit 15] G - Granularity. - */ - UINT32 Granularity : 1; - /** - * [Bit 16] Segment unusable (0 = usable; 1 = unusable). - */ - UINT32 Unusable : 1; - UINT32 Reserved2 : 15; - }; - - UINT32 AsUInt; -} VMX_SEGMENT_ACCESS_RIGHTS_TYPE; - -/** - * @brief Segment selector - * - */ -typedef struct _VMX_SEGMENT_SELECTOR -{ - UINT16 Selector; - VMX_SEGMENT_ACCESS_RIGHTS_TYPE Attributes; - UINT32 Limit; - UINT64 Base; -} VMX_SEGMENT_SELECTOR, *PVMX_SEGMENT_SELECTOR; - - -//..\..\..\bin\debug\SDK\Headers\ErrorCodes.h -/** - * @file ErrorCodes.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Error codes - * @details This file contains definitions of error codes used in HyperDbg - * @version 0.2 - * @date 2022-06-24 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Success Codes // -////////////////////////////////////////////////// - -/** - * @brief General value to indicate that the operation or - * request was successful - * - */ -#define DEBUGGER_OPERATION_WAS_SUCCESSFUL 0xFFFFFFFF - -////////////////////////////////////////////////// -// Error Codes // -////////////////////////////////////////////////// - -/** - * @brief error, the tag not exist - * - */ -#define DEBUGGER_ERROR_TAG_NOT_EXISTS 0xc0000000 - -/** - * @brief error, invalid type of action - * - */ -#define DEBUGGER_ERROR_INVALID_ACTION_TYPE 0xc0000001 - -/** - * @brief error, the action buffer size is invalid - * - */ -#define DEBUGGER_ERROR_ACTION_BUFFER_SIZE_IS_ZERO 0xc0000002 - -/** - * @brief error, the event type is unknown - * - */ -#define DEBUGGER_ERROR_EVENT_TYPE_IS_INVALID 0xc0000003 - -/** - * @brief error, enable to create event - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_CREATE_EVENT 0xc0000004 - -/** - * @brief error, invalid address specified for debugger - * - */ -#define DEBUGGER_ERROR_INVALID_ADDRESS 0xc0000005 - -/** - * @brief error, the core id is invalid - * - */ -#define DEBUGGER_ERROR_INVALID_CORE_ID 0xc0000006 - -/** - * @brief error, the index is greater than 32 in !exception command - * - */ -#define DEBUGGER_ERROR_EXCEPTION_INDEX_EXCEED_FIRST_32_ENTRIES 0xc0000007 - -/** - * @brief error, the index for !interrupt command is not between 32 to 256 - * - */ -#define DEBUGGER_ERROR_INTERRUPT_INDEX_IS_NOT_VALID 0xc0000008 - -/** - * @brief error, unable to hide the debugger and enter to transparent-mode - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER 0xc0000009 - -/** - * @brief error, the debugger is already in transparent-mode - * - */ -#define DEBUGGER_ERROR_DEBUGGER_ALREADY_UHIDE 0xc000000a - -/** - * @brief error, invalid parameters in !e* e* commands - * - */ -#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_PARAMETER 0xc000000b - -/** - * @brief error, an invalid address is specified based on current cr3 - * in !e* or e* commands - * - */ -#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_CURRENT_PROCESS \ - 0xc000000c - -/** - * @brief error, an invalid address is specified based on anotehr process's cr3 - * in !e* or e* commands - * - */ -#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_OTHER_PROCESS \ - 0xc000000d - -/** - * @brief error, invalid tag for 'events' command (tag id is unknown for kernel) - * - */ -#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TAG 0xc000000e - -/** - * @brief error, type of action (enable/disable/clear) is wrong - * - */ -#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TYPE_OF_ACTION 0xc000000f - -/** - * @brief error, invalid parameters steppings actions - * - */ -#define DEBUGGER_ERROR_STEPPING_INVALID_PARAMETER 0xc0000010 - -/** - * @brief error, thread is invalid (not found) or disabled in - * stepping (step-in & step-out) requests - * - */ -#define DEBUGGER_ERROR_STEPPINGS_EITHER_THREAD_NOT_FOUND_OR_DISABLED 0xc0000011 - -/** - * @brief error, baud rate is invalid - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_BAUDRATE 0xc0000012 - -/** - * @brief error, serial port address is invalid - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_SERIAL_PORT 0xc0000013 - -/** - * @brief error, invalid core selected in changing core in remote debuggee - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_CORE_IN_REMOTE_DEBUGGE \ - 0xc0000014 - -/** - * @brief error, invalid process selected in changing process in remote debuggee - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_UNABLE_TO_SWITCH_TO_NEW_PROCESS \ - 0xc0000015 - -/** - * @brief error, unable to run script in remote debuggee - * - */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT 0xc0000016 - -/** - * @brief error, invalid register number - * - */ -#define DEBUGGER_ERROR_INVALID_REGISTER_NUMBER 0xc0000017 - -/** - * @brief error, maximum pools were used without continuing debuggee - * - */ -#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_WITHOUT_CONTINUE 0xc0000018 - -/** - * @brief error, breakpoint already exists on the target address - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_EXISTS_ON_THE_ADDRESS 0xc0000019 - -/** - * @brief error, breakpoint id not found - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND 0xc000001a - -/** - * @brief error, breakpoint already disabled - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_DISABLED 0xc000001b - -/** - * @brief error, breakpoint already enabled - * - */ -#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_ENABLED 0xc000001c - -/** - * @brief error, memory type is invalid - * - */ -#define DEBUGGER_ERROR_MEMORY_TYPE_INVALID 0xc000001d - -/** - * @brief error, the process id is invalid - * - */ -#define DEBUGGER_ERROR_INVALID_PROCESS_ID 0xc000001e - -/** - * @brief error, for event specific reasons the event is not - * applied - * - */ -#define DEBUGGER_ERROR_EVENT_IS_NOT_APPLIED 0xc000001f - -/** - * @brief error, for process switch or process details, invalid parameter - * - */ -#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_PROCESS_INVALID_PARAMETER 0xc0000020 - -/** - * @brief error, for thread switch or thread details, invalid parameter - * - */ -#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER 0xc0000021 - -/** - * @brief error, maximum breakpoint for a single page is hit - * - */ -#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_FOR_A_SINGLE_PAGE_IS_HIT 0xc0000022 - -/** - * @brief error, there is no pre-allocated buffer - * - */ -#define DEBUGGER_ERROR_PRE_ALLOCATED_BUFFER_IS_EMPTY 0xc0000023 - -/** - * @brief error, in the EPT handler, it could not split the 2MB pages to - * 512 entries of 4 KB pages - * - */ -#define DEBUGGER_ERROR_EPT_COULD_NOT_SPLIT_THE_LARGE_PAGE_TO_4KB_PAGES 0xc0000024 - -/** - * @brief error, failed to get PML1 entry of the target address - * - */ -#define DEBUGGER_ERROR_EPT_FAILED_TO_GET_PML1_ENTRY_OF_TARGET_ADDRESS 0xc0000025 - -/** - * @brief error, multiple EPT Hooks or Monitors are applied on a single page - * - */ -#define DEBUGGER_ERROR_EPT_MULTIPLE_HOOKS_IN_A_SINGLE_PAGE 0xc0000026 - -/** - * @brief error, could not build the EPT Hook - * - */ -#define DEBUGGER_ERROR_COULD_NOT_BUILD_THE_EPT_HOOK 0xc0000027 - -/** - * @brief error, could not find the type of allocation - * - */ -#define DEBUGGER_ERROR_COULD_NOT_FIND_ALLOCATION_TYPE 0xc0000028 - -/** - * @brief error, could not find the index of test query - * - */ -#define DEBUGGER_ERROR_INVALID_TEST_QUERY_INDEX 0xc0000029 - -/** - * @brief error, failed to attach to the target user-mode process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS 0xc000002a - -/** - * @brief error, failed to remove hooks as entrypoint is not reached yet - * @details The caller of this functionality should keep sending the previous - * IOCTL until the hook is remove successfully - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED 0xc000002b - -/** - * @brief error, could not remove the previous hook - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS 0xc000002c - -/** - * @brief error, the needed routines for debugging is not initialized - * - */ -#define DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED 0xc000002d - -/** - * @brief error, unable to get 32-bit or 64-bit of the target process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS 0xc000002e - -/** - * @brief error, unable to kill the target process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS 0xc000002f - -/** - * @brief error, invalid thread debugging token - * - */ -#define DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN 0xc0000030 - -/** - * @brief error, unable to pause the process's threads - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS 0xc0000031 - -/** - * @brief error, user debugger already attached to this process - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS 0xc0000032 - -/** - * @brief error, the user debugger is not attached to the target process - * - */ -#define DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS 0xc0000033 - -/** - * @brief error, cannot detach from the process as there are paused threads - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS 0xc0000034 - -/** - * @brief error, cannot switch to new thread as the process id or thread id is not found - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID 0xc0000035 - -/** - * @brief error, cannot switch to new thread the process doesn't contain an active thread - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS 0xc0000036 - -/** - * @brief error, unable to get modules - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS 0xc0000037 - -/** - * @brief error, unable to get the callstack - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_GET_CALLSTACK 0xc0000038 - -/** - * @brief error, unable to query count of processes or threads - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_QUERY_COUNT_OF_PROCESSES_OR_THREADS 0xc0000039 - -/** - * @brief error, using short-circuiting event with post-event mode is - * not supported in HyperDbg - * - */ -#define DEBUGGER_ERROR_USING_SHORT_CIRCUITING_EVENT_WITH_POST_EVENT_MODE_IS_FORBIDDEDN 0xc000003a - -/** - * @brief error, unknown test query is received - * - */ -#define DEBUGGER_ERROR_UNKNOWN_TEST_QUERY_RECEIVED 0xc000003b - -/** - * @brief error, for reading from memory in case of invalid parameters - * - */ -#define DEBUGGER_ERROR_READING_MEMORY_INVALID_PARAMETER 0xc000003c - -/** - * @brief error, the list of threads/process trap flag is full - * - */ -#define DEBUGGER_ERROR_THE_TRAP_FLAG_LIST_IS_FULL 0xc000003d - -/** - * @brief error, unable to kill the target process. process does not exists - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS 0xc000003e - -/** - * @brief error, the execution mode is incorrect - * - */ -#define DEBUGGER_ERROR_MODE_EXECUTION_IS_INVALID 0xc000003f - -/** - * @brief error, the process id cannot be specified while the debugger is in VMX-root mode - * - */ -#define DEBUGGER_ERROR_PROCESS_ID_CANNOT_BE_SPECIFIED_WHILE_APPLYING_EVENT_FROM_VMX_ROOT_MODE 0xc0000040 - -/** - * @brief error, the preallocated buffer is not enough for storing event+conditional buffer - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_EVENT_AND_CONDITIONALS 0xc0000041 - -/** - * @brief error, the regular preallocated buffer not found - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000042 - -/** - * @brief error, the big preallocated buffer not found - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000043 - -/** - * @brief error, enable to create action (cannot allocate buffer) - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_CREATE_ACTION_CANNOT_ALLOCATE_BUFFER 0xc0000044 - -/** - * @brief error, the regular preallocated buffer not found (for action) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000045 - -/** - * @brief error, the big preallocated buffer not found (for action) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000046 - -/** - * @brief error, the preallocated buffer is not enough for storing action buffer - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_ACTION_BUFFER 0xc0000047 - -/** - * @brief error, the requested optional buffer is bigger than send/receive stack of the debugger - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_REQUESTED_OPTIONAL_BUFFER_IS_BIGGER_THAN_DEBUGGERS_SEND_RECEIVE_STACK 0xc0000048 - -/** - * @brief error, the requested safe buffer does not exist (regular) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc0000049 - -/** - * @brief error, the requested safe buffer does not exists (big) - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc000004a - -/** - * @brief error, the preallocated buffer is not enough for storing safe requested buffer - * - */ -#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_REQUESTED_SAFE_BUFFER 0xc000004b - -/** - * @brief error, enable to create requested safe buffer (cannot allocate buffer) - * - */ -#define DEBUGGER_ERROR_UNABLE_TO_ALLOCATE_REQUESTED_SAFE_BUFFER 0xc000004c - -/** - * @brief error, could not find the type of preactivation - * - */ -#define DEBUGGER_ERROR_COULD_NOT_FIND_PREACTIVATION_TYPE 0xc000004d - -/** - * @brief error, the mode exec trap is not already initialized - * - */ -#define DEBUGGER_ERROR_THE_MODE_EXEC_TRAP_IS_NOT_INITIALIZED 0xc000004e - -/** - * @brief error, the target event(s) is/are disabled but cannot clear them because the buffer of the user-mode - * priority is full - * - */ -#define DEBUGGER_ERROR_THE_TARGET_EVENT_IS_DISABLED_BUT_CANNOT_BE_CLEARED_PRIRITY_BUFFER_IS_FULL 0xc000004f - -/** - * @brief error, not all cores are locked (probably due to a race condition in HyperDbg) in - * instant-event mechanism - * - */ -#define DEBUGGER_ERROR_NOT_ALL_CORES_ARE_LOCKED_FOR_APPLYING_INSTANT_EVENT 0xc0000050 - -/** - * @brief error, switching to the target core is not possible because core is not locked - * (probably due to a race condition in HyperDbg) - * - */ -#define DEBUGGER_ERROR_TARGET_SWITCHING_CORE_IS_NOT_LOCKED 0xc0000051 - -/** - * @brief error, invalid physical address - * - */ -#define DEBUGGER_ERROR_INVALID_PHYSICAL_ADDRESS 0xc0000052 - -// -// WHEN YOU ADD ANYTHING TO THIS LIST OF ERRORS, THEN -// MAKE SURE TO ADD AN ERROR MESSAGE TO ShowErrorMessage(UINT32 Error) -// FUNCTION -// - - -//..\..\..\bin\debug\SDK\Headers\Events.h -/** - * @file Events.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers for Events - * @details This file contains definitions of event datatypes - * @version 0.2 - * @date 2022-06-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// System Events // -////////////////////////////////////////////////// - -/** - * @brief Exceptions enum - * - */ -typedef enum _EXCEPTION_VECTORS -{ - EXCEPTION_VECTOR_DIVIDE_ERROR, - EXCEPTION_VECTOR_DEBUG_BREAKPOINT, - EXCEPTION_VECTOR_NMI, - EXCEPTION_VECTOR_BREAKPOINT, - EXCEPTION_VECTOR_OVERFLOW, - EXCEPTION_VECTOR_BOUND_RANGE_EXCEEDED, - EXCEPTION_VECTOR_UNDEFINED_OPCODE, - EXCEPTION_VECTOR_NO_MATH_COPROCESSOR, - EXCEPTION_VECTOR_DOUBLE_FAULT, - EXCEPTION_VECTOR_RESERVED0, - EXCEPTION_VECTOR_INVALID_TASK_SEGMENT_SELECTOR, - EXCEPTION_VECTOR_SEGMENT_NOT_PRESENT, - EXCEPTION_VECTOR_STACK_SEGMENT_FAULT, - EXCEPTION_VECTOR_GENERAL_PROTECTION_FAULT, - EXCEPTION_VECTOR_PAGE_FAULT, - EXCEPTION_VECTOR_RESERVED1, - EXCEPTION_VECTOR_MATH_FAULT, - EXCEPTION_VECTOR_ALIGNMENT_CHECK, - EXCEPTION_VECTOR_MACHINE_CHECK, - EXCEPTION_VECTOR_SIMD_FLOATING_POINT_NUMERIC_ERROR, - EXCEPTION_VECTOR_VIRTUAL_EXCEPTION, - EXCEPTION_VECTOR_RESERVED2, - EXCEPTION_VECTOR_RESERVED3, - EXCEPTION_VECTOR_RESERVED4, - EXCEPTION_VECTOR_RESERVED5, - EXCEPTION_VECTOR_RESERVED6, - EXCEPTION_VECTOR_RESERVED7, - EXCEPTION_VECTOR_RESERVED8, - EXCEPTION_VECTOR_RESERVED9, - EXCEPTION_VECTOR_RESERVED10, - EXCEPTION_VECTOR_RESERVED11, - EXCEPTION_VECTOR_RESERVED12, - - // - // NT (Windows) specific exception vectors. - // - APC_INTERRUPT = 31, - DPC_INTERRUPT = 47, - CLOCK_INTERRUPT = 209, - IPI_INTERRUPT = 225, - PMI_INTERRUPT = 254, - -} EXCEPTION_VECTORS; - -////////////////////////////////////////////////// -// Callback Enums // -////////////////////////////////////////////////// - -/** - * @brief The status of triggering events - * - */ -typedef enum _VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE -{ - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED = 0, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL = 0, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT = 1, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_DEBUGGER_NOT_ENABLED = 2, - VMM_CALLBACK_TRIGGERING_EVENT_STATUS_INVALID_EVENT_TYPE = 3, - -} VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE; - -////////////////////////////////////////////////// -// Event Details // -////////////////////////////////////////////////// - -/** - * @brief enum to show type of all HyperDbg events - * - */ -typedef enum _VMM_EVENT_TYPE_ENUM -{ - - // - // EPT Memory Monitoring Events - // - HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE, - HIDDEN_HOOK_READ_AND_WRITE, - HIDDEN_HOOK_READ_AND_EXECUTE, - HIDDEN_HOOK_WRITE_AND_EXECUTE, - HIDDEN_HOOK_READ, - HIDDEN_HOOK_WRITE, - HIDDEN_HOOK_EXECUTE, - - // - // EPT Hook Events - // - HIDDEN_HOOK_EXEC_DETOURS, - HIDDEN_HOOK_EXEC_CC, - - // - // System-call Events - // - SYSCALL_HOOK_EFER_SYSCALL, - SYSCALL_HOOK_EFER_SYSRET, - - // - // CPUID Instruction Execution Events - // - CPUID_INSTRUCTION_EXECUTION, - - // - // Model-Specific Registers (MSRs) Reads/Modifications Events - // - RDMSR_INSTRUCTION_EXECUTION, - WRMSR_INSTRUCTION_EXECUTION, - - // - // PMIO Events - // - IN_INSTRUCTION_EXECUTION, - OUT_INSTRUCTION_EXECUTION, - - // - // Interrupts/Exceptions/Faults Events - // - EXCEPTION_OCCURRED, - EXTERNAL_INTERRUPT_OCCURRED, - - // - // Debug Registers Events - // - DEBUG_REGISTERS_ACCESSED, - - // - // Timing & Performance Events - // - TSC_INSTRUCTION_EXECUTION, - PMC_INSTRUCTION_EXECUTION, - - // - // VMCALL Instruction Execution Events - // - VMCALL_INSTRUCTION_EXECUTION, - - // - // Control Registers Events - // - CONTROL_REGISTER_MODIFIED, - CONTROL_REGISTER_READ, - CONTROL_REGISTER_3_MODIFIED, - - // - // Execution Trap Events - // - TRAP_EXECUTION_MODE_CHANGED, - TRAP_EXECUTION_INSTRUCTION_TRACE, - -} VMM_EVENT_TYPE_ENUM; - -/** - * @brief Type of Actions - * - */ -typedef enum _DEBUGGER_EVENT_ACTION_TYPE_ENUM -{ - BREAK_TO_DEBUGGER, - RUN_SCRIPT, - RUN_CUSTOM_CODE - -} DEBUGGER_EVENT_ACTION_TYPE_ENUM; - -/** - * @brief Type of handling !syscall or !sysret - * - */ -typedef enum _DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE -{ - DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY = 0, - DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD = 1, - -} DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE; - -#define SIZEOF_DEBUGGER_MODIFY_EVENTS sizeof(DEBUGGER_MODIFY_EVENTS) - -/** - * @brief Type of mode change traps - * - */ -typedef enum _DEBUGGER_EVENT_MODE_TYPE -{ - DEBUGGER_EVENT_MODE_TYPE_USER_MODE_AND_KERNEL_MODE = 1, - DEBUGGER_EVENT_MODE_TYPE_USER_MODE = 3, - DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE = 0, - DEBUGGER_EVENT_MODE_TYPE_INVALID = 0xffffffff, - -} DEBUGGER_EVENT_MODE_TYPE; - -/** - * @brief Type of tracing events - * - */ -typedef enum _DEBUGGER_EVENT_TRACE_TYPE -{ - DEBUGGER_EVENT_TRACE_TYPE_INVALID = 0, - DEBUGGER_EVENT_TRACE_TYPE_STEP_IN = 1, - DEBUGGER_EVENT_TRACE_TYPE_STEP_OUT = 2, - DEBUGGER_EVENT_TRACE_TYPE_INSTRUMENTATION_STEP_IN = 3, - -} DEBUGGER_EVENT_TRACE_TYPE; - -/** - * @brief different types of modifying events request (enable/disable/clear) - * - */ -typedef enum _DEBUGGER_MODIFY_EVENTS_TYPE -{ - DEBUGGER_MODIFY_EVENTS_QUERY_STATE, - DEBUGGER_MODIFY_EVENTS_ENABLE, - DEBUGGER_MODIFY_EVENTS_DISABLE, - DEBUGGER_MODIFY_EVENTS_CLEAR, -} DEBUGGER_MODIFY_EVENTS_TYPE; - -/** - * @brief request for modifying events (enable/disable/clear) - * - */ -typedef struct _DEBUGGER_MODIFY_EVENTS -{ - UINT64 Tag; // Tag of the target event that we want to modify - UINT64 KernelStatus; // Kernel put the status in this field - DEBUGGER_MODIFY_EVENTS_TYPE - TypeOfAction; // Determines what's the action (enable | disable | clear) - BOOLEAN IsEnabled; // Determines what's the action (enable | disable | clear) - -} DEBUGGER_MODIFY_EVENTS, *PDEBUGGER_MODIFY_EVENTS; - -/** - * @brief request for performing a short-circuiting event - * - */ -typedef struct _DEBUGGER_SHORT_CIRCUITING_EVENT -{ - UINT64 KernelStatus; // Kernel put the status in this field - BOOLEAN IsShortCircuiting; // Determines whether to perform short circuting (on | off) - -} DEBUGGER_SHORT_CIRCUITING_EVENT, *PDEBUGGER_SHORT_CIRCUITING_EVENT; - -////////////////////////////////////////////////// -// Event Options // -////////////////////////////////////////////////// - -/** - * @brief request for performing a short-circuiting event - * - */ -typedef struct _DEBUGGER_EVENT_OPTIONS -{ - UINT64 OptionalParam1; // Optional parameter - UINT64 OptionalParam2; // Optional parameter - UINT64 OptionalParam3; // Optional parameter - UINT64 OptionalParam4; // Optional parameter - UINT64 OptionalParam5; // Optional parameter - UINT64 OptionalParam6; // Optional parameter - -} DEBUGGER_EVENT_OPTIONS, *PDEBUGGER_EVENT_OPTIONS; - -////////////////////////////////////////////////// -// Enums For Event And Debugger Resources // -////////////////////////////////////////////////// - -/** - * @brief Things to consider when applying resources - * - */ -typedef enum _PROTECTED_HV_RESOURCES_PASSING_OVERS -{ - // - // for exception bitmap - // - PASSING_OVER_NONE = 0, - PASSING_OVER_UD_EXCEPTIONS_FOR_SYSCALL_SYSRET_HOOK = 1, - PASSING_OVER_EXCEPTION_EVENTS, - - // - // for external interupts-exitings - // - PASSING_OVER_INTERRUPT_EVENTS, - - // - // for external rdtsc/p exitings - // - PASSING_OVER_TSC_EVENTS, - - // - // for external mov to hardware debug registers exitings - // - PASSING_OVER_MOV_TO_HW_DEBUG_REGS_EVENTS, - - // - // for external mov to control registers exitings - // - PASSING_OVER_MOV_TO_CONTROL_REGS_EVENTS, - -} PROTECTED_HV_RESOURCES_PASSING_OVERS; - -/** - * @brief Type of protected (multi-used) resources - * - */ -typedef enum _PROTECTED_HV_RESOURCES_TYPE -{ - PROTECTED_HV_RESOURCES_EXCEPTION_BITMAP, - - PROTECTED_HV_RESOURCES_EXTERNAL_INTERRUPT_EXITING, - - PROTECTED_HV_RESOURCES_RDTSC_RDTSCP_EXITING, - - PROTECTED_HV_RESOURCES_MOV_TO_DEBUG_REGISTER_EXITING, - - PROTECTED_HV_RESOURCES_MOV_CONTROL_REGISTER_EXITING, - - PROTECTED_HV_RESOURCES_MOV_TO_CR3_EXITING, - -} PROTECTED_HV_RESOURCES_TYPE; - -////////////////////////////////////////////////// -// Event Details // -////////////////////////////////////////////////// - -/** - * @brief Each command is like the following struct, it also used for - * tracing works in user mode and sending it to the kernl mode - * @details THIS IS NOT WHAT HYPERDBG SAVES FOR EVENTS IN KERNEL-MODE - */ -typedef struct _DEBUGGER_GENERAL_EVENT_DETAIL -{ - LIST_ENTRY - CommandsEventList; // Linked-list of commands list (used for tracing purpose - // in user mode) - - time_t CreationTime; // Date of creating this event - - UINT32 CoreId; // determines the core index to apply this event to, if it's - // 0xffffffff means that we have to apply it to all cores - - UINT32 ProcessId; // determines the process id to apply this to - // only that 0xffffffff means that we have to - // apply it to all processes - - BOOLEAN IsEnabled; - - BOOLEAN EnableShortCircuiting; // indicates whether the short-circuiting event - // is enabled or not for this event - - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventStage; // reveals the calling stage of the event - // (whether it's a all- pre- or post- event) - - BOOLEAN HasCustomOutput; // Shows whether this event has a custom output - // source or not - - UINT64 - OutputSourceTags - [DebuggerOutputSourceMaximumRemoteSourceForSingleEvent]; // tags of - // multiple - // sources which - // can be used to - // send the event - // results of - // scripts to - // remote sources - - UINT32 CountOfActions; - - UINT64 Tag; // is same as operation code - VMM_EVENT_TYPE_ENUM EventType; - - DEBUGGER_EVENT_OPTIONS Options; - - PVOID CommandStringBuffer; - - UINT32 ConditionBufferSize; - -} DEBUGGER_GENERAL_EVENT_DETAIL, *PDEBUGGER_GENERAL_EVENT_DETAIL; - -/** - * @brief Each event can have multiple actions - * @details THIS STRUCTURE IS ONLY USED IN USER MODE - * WE USE SEPARATE STRUCTURE FOR ACTIONS IN - * KERNEL MODE - */ -typedef struct _DEBUGGER_GENERAL_ACTION -{ - UINT64 EventTag; - DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType; - BOOLEAN ImmediateMessagePassing; - UINT32 PreAllocatedBuffer; - - UINT32 CustomCodeBufferSize; - UINT32 ScriptBufferSize; - UINT32 ScriptBufferPointer; - -} DEBUGGER_GENERAL_ACTION, *PDEBUGGER_GENERAL_ACTION; - -/** - * @brief Status of register buffers - * - */ -typedef struct _DEBUGGER_EVENT_AND_ACTION_RESULT -{ - BOOLEAN IsSuccessful; - UINT32 Error; // If IsSuccessful was, FALSE - -} DEBUGGER_EVENT_AND_ACTION_RESULT, *PDEBUGGER_EVENT_AND_ACTION_RESULT; - -#define SIZEOF_REGISTER_EVENT sizeof(REGISTER_NOTIFY_BUFFER) - - -//..\..\..\bin\debug\SDK\Headers\HardwareDebugger.h -/** - * @file HardwareDebugger.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's Hardware Debugger (hwdbg) types and constants - * @details This file contains definitions of hwdbg elements - * used in HyperDbg - * @version 0.9 - * @date 2024-04-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Definitions // -////////////////////////////////////////////////// - -/** - * @brief Initial debuggee to debugger offset - * - */ -#define DEFAULT_INITIAL_DEBUGGEE_TO_DEBUGGER_OFFSET 0x200 - -/** - * @brief Initial debugger to debuggee offset - * - */ -#define DEFAULT_INITIAL_DEBUGGER_TO_DEBUGGEE_OFFSET 0x0 - -////////////////////////////////////////////////// -// Enums // -////////////////////////////////////////////////// - -/** - * @brief Different action of hwdbg - * @warning This file should be changed along with hwdbg files - * - */ -typedef enum _HWDBG_ACTION_ENUMS -{ - hwdbgActionSendInstanceInfo = 1, - hwdbgActionConfigureScriptBuffer = 2, - -} HWDBG_ACTION_ENUMS; - -/** - * @brief Different responses come from hwdbg - * @warning This file should be changed along with hwdbg files - * - */ -typedef enum _HWDBG_RESPONSE_ENUMS -{ - hwdbgResponseSuccessOrErrorMessage = 1, - hwdbgResponseInstanceInfo = 2, - -} HWDBG_RESPONSE_ENUMS; - -/** - * @brief Different success or error codes in hwdbg - * @warning This file should be changed along with hwdbg files - * - */ -typedef enum _HWDBG_SUCCESS_OR_ERROR_ENUMS -{ - hwdbgOperationWasSuccessful = 0x7FFFFFFF, - hwdbgErrorInvalidPacket = 1, - -} HWDBG_SUCCESS_OR_ERROR_ENUMS; - -////////////////////////////////////////////////// -// Structures // -////////////////////////////////////////////////// - -/** - * @brief The structure of port information (each item) in hwdbg - * - */ -typedef struct _HWDBG_PORT_INFORMATION_ITEMS -{ - UINT32 PortSize; - -} HWDBG_PORT_INFORMATION_ITEMS, *PHWDBG_PORT_INFORMATION_ITEMS; - -/** - * @brief The structure of script capabilities information in hwdbg - * - */ -typedef struct _HWDBG_INSTANCE_INFORMATION -{ - // - // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE - // - UINT32 version; // Target version of HyperDbg (same as hwdbg) - UINT32 maximumNumberOfStages; // Number of stages that this instance of hwdbg supports (NumberOfSupportedStages == 0 means script engine is disabled) - UINT32 scriptVariableLength; // maximum length of variables (and other script elements) - UINT32 maximumNumberOfSupportedGetScriptOperators; // Maximum supported GET operators in a single func - UINT32 maximumNumberOfSupportedSetScriptOperators; // Maximum supported SET operators in a single func - UINT32 sharedMemorySize; // Size of shared memory - UINT32 debuggerAreaOffset; // The memory offset of debugger - UINT32 debuggeeAreaOffset; // The memory offset of debuggee - UINT32 numberOfPins; // Number of pins - UINT32 numberOfPorts; // Number of ports - - // - // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE - // - - struct _HWDBG_SCRIPT_CAPABILITIES - { - // - // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities - // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file - // - UINT64 func_or : 1; - UINT64 func_xor : 1; - UINT64 func_and : 1; - UINT64 func_asr : 1; - UINT64 func_asl : 1; - UINT64 func_add : 1; - UINT64 func_sub : 1; - UINT64 func_mul : 1; - UINT64 func_div : 1; - UINT64 func_mod : 1; - UINT64 func_gt : 1; - UINT64 func_lt : 1; - UINT64 func_egt : 1; - UINT64 func_elt : 1; - UINT64 func_equal : 1; - UINT64 func_neq : 1; - UINT64 func_jmp : 1; - UINT64 func_jz : 1; - UINT64 func_jnz : 1; - UINT64 func_mov : 1; - UINT64 func_printf : 1; - - // - // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities - // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file - // - - } scriptCapabilities; - - UINT32 bramAddrWidth; // BRAM address width - UINT32 bramDataWidth; // BRAM data width - - // - // Here the details of port arrangements are located (HWDBG_PORT_INFORMATION_ITEMS) - // As the following type: - // HWDBG_PORT_INFORMATION_ITEMS portsConfiguration[numberOfPorts] ; Port arrangement - // - -} HWDBG_INSTANCE_INFORMATION, *PHWDBG_INSTANCE_INFORMATION; - -/** - * @brief The structure of script buffer in hwdbg - * - */ -typedef struct _HWDBG_SCRIPT_BUFFER -{ - UINT32 scriptNumberOfSymbols; // Number of symbols in the script - - // - // Here the script buffer is located - // - // UINT8 scriptBuffer[scriptNumberOfSymbols]; // The script buffer - // - -} HWDBG_SCRIPT_BUFFER, *PHWDBG_SCRIPT_BUFFER; - - -//..\..\..\bin\debug\SDK\Headers\Ioctls.h -/** - * @file Ioctls.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK IOCTL codes - * @details This file contains definitions of IOCTLs used in HyperDbg - * @version 0.2 - * @date 2022-06-24 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Definitions // -////////////////////////////////////////////////// - -// -// The following controls are mainly defined in -// - -// -// Macro definition for defining IOCTL and FSCTL function control codes. Note -// that function codes 0-2047 are reserved for Microsoft Corporation, and -// 2048-4095 are reserved for customers. -// -#ifndef CTL_CODE - -# define CTL_CODE(DeviceType, Function, Method, Access) ( \ - ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method)) - -#endif // ! CTL_CODE - -#ifndef FILE_ANY_ACCESS - -# define FILE_ANY_ACCESS 0 - -#endif // !FILE_ANY_ACCESS - -// -// Define the method codes for how buffers are passed for I/O and FS controls -// - -#ifndef METHOD_BUFFERED - -# define METHOD_BUFFERED 0 - -#endif // !METHOD_BUFFERED - -#ifndef FILE_DEVICE_UNKNOWN - -# define FILE_DEVICE_UNKNOWN 0x00000022 - -#endif // !FILE_DEVICE_UNKNOWN - -////////////////////////////////////////////////// -// IOCTLs // -////////////////////////////////////////////////// - -/** - * @brief ioctl, register a new event - * - */ -#define IOCTL_REGISTER_EVENT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, irp pending mechanism for reading from message tracing buffers - * - */ -#define IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to terminate vmx and exit form debugger - * - */ -#define IOCTL_TERMINATE_VMX \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to read memory - * - */ -#define IOCTL_DEBUGGER_READ_MEMORY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to read or write on a special MSR - * - */ -#define IOCTL_DEBUGGER_READ_OR_WRITE_MSR \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to read page table entries - * - */ -#define IOCTL_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, register an event - * - */ -#define IOCTL_DEBUGGER_REGISTER_EVENT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, add action to event - * - */ -#define IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to enable or disable transparent-mode - * - */ -#define IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, for !va2pa and !pa2va commands - * - */ -#define IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to edit virtual and physical memory - * - */ -#define IOCTL_DEBUGGER_EDIT_MEMORY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to search virtual and physical memory - * - */ -#define IOCTL_DEBUGGER_SEARCH_MEMORY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to modify an event (enable/disable/clear) - * - */ -#define IOCTL_DEBUGGER_MODIFY_EVENTS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80c, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, flush the kernel buffers - * - */ -#define IOCTL_DEBUGGER_FLUSH_LOGGING_BUFFERS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80d, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, attach or detach user-mode processes - * - */ -#define IOCTL_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80e, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, print states (Deprecated) - * - * - */ -#define IOCTL_DEBUGGER_PRINT \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80f, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, prepare debuggee - * - */ -#define IOCTL_PREPARE_DEBUGGEE \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, pause and halt the system - * - */ -#define IOCTL_PAUSE_PACKET_RECEIVED \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x811, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, send a signal that execution of command finished - * - */ -#define IOCTL_SEND_SIGNAL_EXECUTION_IN_DEBUGGEE_FINISHED \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x812, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, send user-mode messages to the debugger - * - */ -#define IOCTL_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x813, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, send general buffer from debuggee to debugger - * - */ -#define IOCTL_SEND_GENERAL_BUFFER_FROM_DEBUGGEE_TO_DEBUGGER \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x814, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to perform kernel-side tests - * - */ -#define IOCTL_PERFROM_KERNEL_SIDE_TESTS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to reserve pre-allocated pools - * - */ -#define IOCTL_RESERVE_PRE_ALLOCATED_POOLS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x816, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to send user debugger commands - * - */ -#define IOCTL_SEND_USER_DEBUGGER_COMMANDS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x817, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to get active threads/processes that are debugging - * - */ -#define IOCTL_GET_DETAIL_OF_ACTIVE_THREADS_AND_PROCESSES \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x818, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to get user mode modules details - * - */ -#define IOCTL_GET_USER_MODE_MODULE_DETAILS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x819, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, query count of active threads or processes - * - */ -#define IOCTL_QUERY_COUNT_OF_ACTIVE_PROCESSES_OR_THREADS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81a, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to get list threads/processes - * - */ -#define IOCTL_GET_LIST_OF_THREADS_AND_PROCESSES \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81b, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, query the current process details - * - */ -#define IOCTL_QUERY_CURRENT_PROCESS \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81c, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, query the current thread details - * - */ -#define IOCTL_QUERY_CURRENT_THREAD \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81d, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request service from the reversing machine - * - */ -#define IOCTL_REQUEST_REV_MACHINE_SERVICE \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81e, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, request to bring pages in - * - */ -#define IOCTL_DEBUGGER_BRING_PAGES_IN \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81f, METHOD_BUFFERED, FILE_ANY_ACCESS) - -/** - * @brief ioctl, to preactivate a functionality - * - */ -#define IOCTL_PREACTIVATE_FUNCTIONALITY \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x820, METHOD_BUFFERED, FILE_ANY_ACCESS) - - -//..\..\..\bin\debug\SDK\Headers\RequestStructures.h -/** - * @file RequestStructures.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Headers Request Packets - * @details This file contains definitions of request packets (enums, structs) - * @version 0.2 - * @date 2022-06-28 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -#define SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ - sizeof(DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS) - -/** - * @brief request for !pte command - * - */ -typedef struct _DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS -{ - UINT64 VirtualAddress; - UINT32 ProcessId; - - UINT64 Pml4eVirtualAddress; - UINT64 Pml4eValue; - - UINT64 PdpteVirtualAddress; - UINT64 PdpteValue; - - UINT64 PdeVirtualAddress; - UINT64 PdeValue; - - UINT64 PteVirtualAddress; - UINT64 PteValue; - - UINT32 KernelStatus; - -} DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, - *PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ - sizeof(DEBUGGER_VA2PA_AND_PA2VA_COMMANDS) - -/** - * @brief requests for !va2pa and !pa2va commands - * - */ -typedef struct _DEBUGGER_VA2PA_AND_PA2VA_COMMANDS -{ - UINT64 VirtualAddress; - UINT64 PhysicalAddress; - UINT32 ProcessId; - BOOLEAN IsVirtual2Physical; - UINT32 KernelStatus; - -} DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, *PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS; - -/* ============================================================================================== - */ -#define SIZEOF_DEBUGGER_PAGE_IN_REQUEST \ - sizeof(DEBUGGER_PAGE_IN_REQUEST) - -/** - * @brief requests for the '.pagein' command - * - */ -typedef struct _DEBUGGER_PAGE_IN_REQUEST -{ - UINT64 VirtualAddressFrom; - UINT64 VirtualAddressTo; - UINT32 ProcessId; - UINT32 PageFaultErrorCode; - UINT32 KernelStatus; - -} DEBUGGER_PAGE_IN_REQUEST, *PDEBUGGER_PAGE_IN_REQUEST; - -/* ============================================================================================== - */ - -/** - * @brief different modes of reconstruct requests - * - */ -typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE -{ - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN = 0, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_USER_MODE, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_KERNEL_MODE, -} REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE; - -/** - * @brief different types of reconstruct requests - * - */ -typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE -{ - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN = 0, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT, - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN, -} REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE; - -#define SIZEOF_REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST \ - sizeof(REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST) - -/** - * @brief requests for !rev command - * - */ -typedef struct _REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST -{ - UINT32 ProcessId; - UINT32 Size; - REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE Mode; - REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE Type; - UINT32 KernelStatus; - -} REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST, *PREVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_DT_COMMAND_OPTIONS \ - sizeof(DEBUGGER_DT_COMMAND_OPTIONS) - -/** - * @brief requests options for dt and struct command - * - */ -typedef struct _DEBUGGER_DT_COMMAND_OPTIONS -{ - const char * TypeName; - UINT64 SizeOfTypeName; - UINT64 Address; - BOOLEAN IsStruct; - PVOID BufferAddress; - UINT32 TargetPid; - const char * AdditionalParameters; - -} DEBUGGER_DT_COMMAND_OPTIONS, *PDEBUGGER_DT_COMMAND_OPTIONS; - -/* ============================================================================================== - */ - -/** - * @brief different types of prealloc requests - * - */ -typedef enum _DEBUGGER_PREALLOC_COMMAND_TYPE -{ - DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION, - DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR, - DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK, - DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK2, - DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_EVENT, - DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_EVENT, - DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_SAFE_BUFFER, - DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_SAFE_BUFFER, - -} DEBUGGER_PREALLOC_COMMAND_TYPE; - -#define SIZEOF_DEBUGGER_PREALLOC_COMMAND \ - sizeof(DEBUGGER_PREALLOC_COMMAND) - -/** - * @brief requests for the 'prealloc' command - * - */ -typedef struct _DEBUGGER_PREALLOC_COMMAND -{ - DEBUGGER_PREALLOC_COMMAND_TYPE Type; - UINT32 Count; - UINT32 KernelStatus; - -} DEBUGGER_PREALLOC_COMMAND, *PDEBUGGER_PREALLOC_COMMAND; - -/* ============================================================================================== - */ - -/** - * @brief different types of preactivate requests - * - */ -typedef enum _DEBUGGER_PREACTIVATE_COMMAND_TYPE -{ - DEBUGGER_PREACTIVATE_COMMAND_TYPE_MODE, - -} DEBUGGER_PREACTIVATE_COMMAND_TYPE; - -#define SIZEOF_DEBUGGER_PREACTIVATE_COMMAND \ - sizeof(DEBUGGER_PREACTIVATE_COMMAND) - -/** - * @brief requests for the 'preactivate' command - * - */ -typedef struct _DEBUGGER_PREACTIVATE_COMMAND -{ - DEBUGGER_PREACTIVATE_COMMAND_TYPE Type; - UINT32 KernelStatus; - -} DEBUGGER_PREACTIVATE_COMMAND, *PDEBUGGER_PREACTIVATE_COMMAND; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_READ_MEMORY sizeof(DEBUGGER_READ_MEMORY) - -/** - * @brief different types of reading memory - * - */ -typedef enum _DEBUGGER_READ_READING_TYPE -{ - READ_FROM_KERNEL, - READ_FROM_VMX_ROOT -} DEBUGGER_READ_READING_TYPE; - -/** - * @brief different type of addresses - * - */ -typedef enum _DEBUGGER_READ_MEMORY_TYPE -{ - DEBUGGER_READ_PHYSICAL_ADDRESS, - DEBUGGER_READ_VIRTUAL_ADDRESS -} DEBUGGER_READ_MEMORY_TYPE; - -/** - * @brief the way that debugger should show - * the details of memory or disassemble them - * - */ -typedef enum _DEBUGGER_SHOW_MEMORY_STYLE -{ - DEBUGGER_SHOW_COMMAND_DT = 1, - DEBUGGER_SHOW_COMMAND_DISASSEMBLE64, - DEBUGGER_SHOW_COMMAND_DISASSEMBLE32, - DEBUGGER_SHOW_COMMAND_DB, - DEBUGGER_SHOW_COMMAND_DC, - DEBUGGER_SHOW_COMMAND_DQ, - DEBUGGER_SHOW_COMMAND_DD, - DEBUGGER_SHOW_COMMAND_DUMP -} DEBUGGER_SHOW_MEMORY_STYLE; - -/** - * @brief request for reading virtual and physical memory - * - */ -typedef struct _DEBUGGER_READ_MEMORY -{ - UINT32 Pid; // Read from cr3 of what process - UINT64 Address; - UINT32 Size; - BOOLEAN IsForDisasm; // Debugger sets whether the read memory is for diassembler or not - BOOLEAN Is32BitAddress; // Debuggee sets the status of address - DEBUGGER_READ_MEMORY_TYPE MemoryType; - DEBUGGER_READ_READING_TYPE ReadingType; - PDEBUGGER_DT_COMMAND_OPTIONS DtDetails; - DEBUGGER_SHOW_MEMORY_STYLE Style; // not used in local debugging - UINT32 ReturnLength; // not used in local debugging - UINT32 KernelStatus; // not used in local debugging - - // - // Here is the target buffer (actual memory) - // - -} DEBUGGER_READ_MEMORY, *PDEBUGGER_READ_MEMORY; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_FLUSH_LOGGING_BUFFERS \ - sizeof(DEBUGGER_FLUSH_LOGGING_BUFFERS) - -/** - * @brief request for flushing buffers - * - */ -typedef struct _DEBUGGER_FLUSH_LOGGING_BUFFERS -{ - UINT32 KernelStatus; - UINT32 CountOfMessagesThatSetAsReadFromVmxRoot; - UINT32 CountOfMessagesThatSetAsReadFromVmxNonRoot; - -} DEBUGGER_FLUSH_LOGGING_BUFFERS, *PDEBUGGER_FLUSH_LOGGING_BUFFERS; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_TEST_QUERY_BUFFER \ - sizeof(DEBUGGER_TEST_QUERY_BUFFER) - -/** - * @brief test query used for test purposed - * - */ -typedef enum _DEBUGGER_TEST_QUERY_STATE -{ - TEST_QUERY_HALTING_CORE_STATUS = 1, // Query constant to show detail of halting of core - TEST_QUERY_PREALLOCATED_POOL_STATE = 2, // Query pre-allocated pool state - TEST_QUERY_TRAP_STATE = 3, // Query trap state - TEST_BREAKPOINT_TURN_OFF_BPS = 4, // Turn off the breakpoints (#BP) - TEST_BREAKPOINT_TURN_ON_BPS = 5, // Turn on the breakpoints (#BP) - TEST_BREAKPOINT_TURN_OFF_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 6, // Turn off the breakpoints and events for executing the commands in the remote computer - TEST_BREAKPOINT_TURN_ON_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 7, // Turn on the breakpoints and events for executing the commands in the remote computer - TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_SYNCHRONOUS = 8, // For testing synchronized event - TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_ASYNCHRONOUS = 9, // For testing unsynchronized event - TEST_SETTING_TARGET_TASKS_ON_TARGET_HALTED_CORES = 10, // Send the task to the halted core - TEST_BREAKPOINT_TURN_OFF_DBS = 11, // Turn off the debug breaks (#DB) - TEST_BREAKPOINT_TURN_ON_DBS = 12, // Turn on the debug breaks (#DB) - -} DEBUGGER_TEST_QUERY_STATE; - -/** - * @brief request for test query buffers - * - */ -typedef struct _DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER -{ - DEBUGGER_TEST_QUERY_STATE RequestType; - UINT64 Context; - UINT32 KernelStatus; - -} DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER, *PDEBUGGER_DEBUGGER_TEST_QUERY_BUFFER; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_PERFORM_KERNEL_TESTS \ - sizeof(DEBUGGER_PERFORM_KERNEL_TESTS) - -/** - * @brief request performing kernel tests - * - */ -typedef struct _DEBUGGER_PERFORM_KERNEL_TESTS -{ - UINT32 KernelStatus; - -} DEBUGGER_PERFORM_KERNEL_TESTS, *PDEBUGGER_PERFORM_KERNEL_TESTS; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL \ - sizeof(DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL) - -/** - * @brief request for send a signal that command execution finished - * - */ -typedef struct _DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL -{ - UINT32 KernelStatus; - -} DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL, - *PDEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER \ - sizeof(DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER) - -/** - * @brief request for send general packets from debuggee to debugger - * - */ -typedef struct _DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER -{ - DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction; - UINT32 LengthOfBuffer; - BOOLEAN PauseDebuggeeWhenSent; - UINT32 KernelResult; - - // - // The buffer for the general packet is here - // - -} DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER, - *PDEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ - sizeof(DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER) - -/** - * @brief request for send a user-mode message to debugger - * - */ -typedef struct _DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER -{ - UINT32 KernelStatus; - UINT32 Length; - - // - // Here is the messages - // - -} DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER, - *PDEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR \ - sizeof(DEBUGGER_READ_AND_WRITE_ON_MSR) - -/** - * @brief different types of actions on MSRs - * - */ -typedef enum _DEBUGGER_MSR_ACTION_TYPE -{ - DEBUGGER_MSR_READ, - DEBUGGER_MSR_WRITE -} DEBUGGER_MSR_ACTION_TYPE; - -/** - * @brief request to read or write on MSRs - * - */ -typedef struct _DEBUGGER_READ_AND_WRITE_ON_MSR -{ - UINT64 Msr; // It's actually a 32-Bit value but let's not mess with a register - UINT32 CoreNumber; // specifies the core to execute wrmsr or read the msr - // (DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES mean all - // the cores) - DEBUGGER_MSR_ACTION_TYPE - ActionType; // Detects whether user needs wrmsr or rdmsr - UINT64 Value; - -} DEBUGGER_READ_AND_WRITE_ON_MSR, *PDEBUGGER_READ_AND_WRITE_ON_MSR; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_EDIT_MEMORY sizeof(DEBUGGER_EDIT_MEMORY) - -/** - * @brief different type of addresses for editing memory - * - */ -typedef enum _DEBUGGER_EDIT_MEMORY_TYPE -{ - EDIT_PHYSICAL_MEMORY, - EDIT_VIRTUAL_MEMORY -} DEBUGGER_EDIT_MEMORY_TYPE; - -/** - * @brief size of editing memory - * - */ -typedef enum _DEBUGGER_EDIT_MEMORY_BYTE_SIZE -{ - EDIT_BYTE, - EDIT_DWORD, - EDIT_QWORD -} DEBUGGER_EDIT_MEMORY_BYTE_SIZE; - -/** - * @brief request for edit virtual and physical memory - * - */ -typedef struct _DEBUGGER_EDIT_MEMORY -{ - UINT32 Result; // Result from kernel - UINT64 Address; // Target address to modify - UINT32 ProcessId; // specifies the process id - DEBUGGER_EDIT_MEMORY_TYPE MemoryType; // Type of memory - DEBUGGER_EDIT_MEMORY_BYTE_SIZE ByteSize; // Modification size - UINT32 CountOf64Chunks; - UINT32 FinalStructureSize; - UINT32 KernelStatus; // not used in local debugging - -} DEBUGGER_EDIT_MEMORY, *PDEBUGGER_EDIT_MEMORY; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_SEARCH_MEMORY sizeof(DEBUGGER_SEARCH_MEMORY) - -/** - * @brief different types of address for searching on memory - * - */ -typedef enum _DEBUGGER_SEARCH_MEMORY_TYPE -{ - SEARCH_PHYSICAL_MEMORY, - SEARCH_VIRTUAL_MEMORY, - SEARCH_PHYSICAL_FROM_VIRTUAL_MEMORY, - -} DEBUGGER_SEARCH_MEMORY_TYPE; - -/** - * @brief different sizes on searching memory - * - */ -typedef enum _DEBUGGER_SEARCH_MEMORY_BYTE_SIZE -{ - SEARCH_BYTE, - SEARCH_DWORD, - SEARCH_QWORD - -} DEBUGGER_SEARCH_MEMORY_BYTE_SIZE; - -/** - * @brief request for searching memory - * - */ -typedef struct _DEBUGGER_SEARCH_MEMORY -{ - UINT64 Address; // Target address to start searching - UINT64 Length; // Length of bytes to search - UINT32 ProcessId; // specifies the process id - DEBUGGER_SEARCH_MEMORY_TYPE MemoryType; // Type of memory - DEBUGGER_SEARCH_MEMORY_BYTE_SIZE ByteSize; // Modification size - UINT32 CountOf64Chunks; - UINT32 FinalStructureSize; - -} DEBUGGER_SEARCH_MEMORY, *PDEBUGGER_SEARCH_MEMORY; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE \ - sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) - -/** - * @brief request for enable or disable transparent-mode - * - */ -typedef struct _DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE -{ - BOOLEAN IsHide; - - UINT64 CpuidAverage; - UINT64 CpuidStandardDeviation; - UINT64 CpuidMedian; - - UINT64 RdtscAverage; - UINT64 RdtscStandardDeviation; - UINT64 RdtscMedian; - - BOOLEAN TrueIfProcessIdAndFalseIfProcessName; - UINT32 ProcId; - UINT32 LengthOfProcessName; // in the case of !hide name xxx, this parameter - // shows the length of xxx - - UINT64 KernelStatus; /* DEBUGGER_OPERATION_WAS_SUCCESSFUL , - DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER - */ - -} DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, - *PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE; - -/* ============================================================================================== - */ - -#define SIZEOF_DEBUGGER_PREPARE_DEBUGGEE sizeof(DEBUGGER_PREPARE_DEBUGGEE) - -/** - * @brief request to make this computer to a debuggee - * - */ -typedef struct _DEBUGGER_PREPARE_DEBUGGEE -{ - UINT32 PortAddress; - UINT32 Baudrate; - UINT64 NtoskrnlBaseAddress; - UINT32 Result; // Result from the kernel - CHAR OsName[MAXIMUM_CHARACTER_FOR_OS_NAME]; - -} DEBUGGER_PREPARE_DEBUGGEE, *PDEBUGGER_PREPARE_DEBUGGEE; - -/* ============================================================================================== - */ - -/** - * @brief The structure of changing core packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_CHANGE_CORE_PACKET -{ - UINT32 NewCore; - UINT32 Result; - -} DEBUGGEE_CHANGE_CORE_PACKET, *PDEBUGGEE_CHANGE_CORE_PACKET; - -/* ============================================================================================== - */ -#define SIZEOF_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ - sizeof(DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS) - -/** - * @brief different actions of switchings - * - */ -typedef enum _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE -{ - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD, - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS, - -} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE; - -/** - * @brief request for attaching user-mode process - * - */ -typedef struct _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS -{ - BOOLEAN IsStartingNewProcess; - UINT32 ProcessId; - UINT32 ThreadId; - BOOLEAN CheckCallbackAtFirstInstruction; - BOOLEAN Is32Bit; - BOOLEAN IsPaused; // used in switching to threads - DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE Action; - UINT32 CountOfActiveDebuggingThreadsAndProcesses; // used in showing the list of active threads/processes - UINT64 Token; - UINT64 Result; - -} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS, - *PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS; - -/* ============================================================================================== - */ -#define SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS \ - sizeof(DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS) - -/** - * @brief different type of process or thread queries - * - */ -typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES -{ - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT = 1, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT = 2, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST = 3, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST = 4, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_PROCESS = 5, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_THREAD = 6, - -} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES; - -/** - * @brief different actions on showing or querying list of process or threads - * - */ -typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS -{ - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_SHOW_INSTANTLY = 1, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT = 2, - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_SAVE_DETAILS = 3, - -} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS; - -/** - * @brief The structure of needed information to get the details - * of the process from nt!_EPROCESS and location of needed variables - * - */ -typedef struct _DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS -{ - UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead - ULONG ImageFileNameOffset; // nt!_EPROCESS.ImageFileName - ULONG UniquePidOffset; // nt!_EPROCESS.UniqueProcessId - ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks - -} DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS, *PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS; - -/** - * @brief The structure of needed information to get the details - * of the thread from nt!_ETHREAD and location of needed variables - * - */ -typedef struct _DEBUGGEE_THREAD_LIST_NEEDED_DETAILS -{ - UINT32 ThreadListHeadOffset; // nt!_EPROCESS.ThreadListHead - UINT32 ThreadListEntryOffset; // nt!_ETHREAD.ThreadListEntry - UINT32 CidOffset; // nt!_ETHREAD.Cid - UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead - ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks - UINT64 Process; - -} DEBUGGEE_THREAD_LIST_NEEDED_DETAILS, *PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS; - -/** - * @brief The structure showing list of processes (details of each - * entry) - * - */ -typedef struct _DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY -{ - UINT64 Eprocess; - UINT32 ProcessId; - UINT64 Cr3; - UCHAR ImageFileName[15 + 1]; - -} DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY, *PDEBUGGEE_PROCESS_LIST_DETAILS_ENTRY; - -/** - * @brief The structure showing list of threads (details of each - * entry) - * - */ -typedef struct _DEBUGGEE_THREAD_LIST_DETAILS_ENTRY -{ - UINT64 Eprocess; - UINT64 Ethread; - UINT32 ProcessId; - UINT32 ThreadId; - UCHAR ImageFileName[15 + 1]; - -} DEBUGGEE_THREAD_LIST_DETAILS_ENTRY, *PDEBUGGEE_THREAD_LIST_DETAILS_ENTRY; - -/** - * @brief request for query count of active processes and threads - * - */ -typedef struct _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS -{ - DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededDetails; - DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListNeededDetails; - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES QueryType; - DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS QueryAction; - UINT32 Count; - UINT64 Result; - -} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS, - *PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS; - -/* ============================================================================================== - */ - -/** - * @brief The structure for saving the callstack frame of one parameter - * - */ -typedef struct _DEBUGGER_SINGLE_CALLSTACK_FRAME -{ - BOOLEAN IsStackAddressValid; - BOOLEAN IsValidAddress; - BOOLEAN IsExecutable; - UINT64 Value; - BYTE InstructionBytesOnRip[MAXIMUM_CALL_INSTR_SIZE]; - -} DEBUGGER_SINGLE_CALLSTACK_FRAME, *PDEBUGGER_SINGLE_CALLSTACK_FRAME; - -#define SIZEOF_DEBUGGER_CALLSTACK_REQUEST \ - sizeof(DEBUGGER_CALLSTACK_REQUEST) - -/** - * @brief callstack showing method - * - */ -typedef enum _DEBUGGER_CALLSTACK_DISPLAY_METHOD -{ - DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITHOUT_PARAMS, - DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS, - -} DEBUGGER_CALLSTACK_DISPLAY_METHOD; - -/** - * @brief request for callstack frames - * - */ -typedef struct _DEBUGGER_CALLSTACK_REQUEST -{ - BOOLEAN Is32Bit; - UINT32 KernelStatus; - DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod; - UINT32 Size; - UINT32 FrameCount; - UINT64 BaseAddress; - UINT64 BufferSize; - - // - // Here is the size of stack frames - // - -} DEBUGGER_CALLSTACK_REQUEST, *PDEBUGGER_CALLSTACK_REQUEST; - -/* ============================================================================================== - */ -#define SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS \ - sizeof(USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS) - -typedef struct _USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS -{ - UINT32 ProcessId; - UINT32 ThreadId; - BOOLEAN IsProcess; - -} USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS, *PUSERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS; - -/* ============================================================================================== - */ - -/** - * @brief Used for run the script - * - */ -typedef struct _DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION -{ - UINT64 ScriptBuffer; - UINT32 ScriptLength; - UINT32 ScriptPointer; - UINT32 OptionalRequestedBufferSize; - -} DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION, - *PDEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION; - -/** - * @brief used in the case of requesting a "request buffer" - * - */ -typedef struct _DEBUGGER_EVENT_REQUEST_BUFFER -{ - BOOLEAN EnabledRequestBuffer; - UINT32 RequestBufferSize; - UINT64 RequstBufferAddress; - -} DEBUGGER_EVENT_REQUEST_BUFFER, *PDEBUGGER_EVENT_REQUEST_BUFFER; - -/** - * @brief used in the case of custom code requests to the debugger - * - */ -typedef struct _DEBUGGER_EVENT_REQUEST_CUSTOM_CODE -{ - UINT32 CustomCodeBufferSize; - PVOID CustomCodeBufferAddress; - UINT32 OptionalRequestedBufferSize; - -} DEBUGGER_EVENT_REQUEST_CUSTOM_CODE, *PDEBUGGER_EVENT_REQUEST_CUSTOM_CODE; - -/* ============================================================================================== - */ - -/** - * @brief User-mode debugging actions - * - */ -typedef enum _DEBUGGER_UD_COMMAND_ACTION_TYPE -{ - DEBUGGER_UD_COMMAND_ACTION_TYPE_NONE = 0, - DEBUGGER_UD_COMMAND_ACTION_TYPE_PAUSE, - DEBUGGER_UD_COMMAND_ACTION_TYPE_CONTINUE, - DEBUGGER_UD_COMMAND_ACTION_TYPE_REGULAR_STEP, - -} DEBUGGER_UD_COMMAND_ACTION_TYPE; - -/** - * @brief Description of user-mode debugging actions - * - */ -typedef struct _DEBUGGER_UD_COMMAND_ACTION -{ - DEBUGGER_UD_COMMAND_ACTION_TYPE ActionType; - UINT64 OptionalParam1; - UINT64 OptionalParam2; - UINT64 OptionalParam3; - UINT64 OptionalParam4; - -} DEBUGGER_UD_COMMAND_ACTION, *PDEBUGGER_UD_COMMAND_ACTION; - -/** - * @brief The structure of command packet in uHyperDbg - * - */ -typedef struct _DEBUGGER_UD_COMMAND_PACKET -{ - DEBUGGER_UD_COMMAND_ACTION UdAction; - UINT64 ProcessDebuggingDetailToken; - UINT32 TargetThreadId; - BOOLEAN ApplyToAllPausedThreads; - UINT32 Result; - -} DEBUGGER_UD_COMMAND_PACKET, *PDEBUGGER_UD_COMMAND_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Debugger process switch and process details - * - */ -typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE -{ - - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS, - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST, - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH, - -} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE; - -/** - * @brief The structure of changing process and show process - * packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET -{ - DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType; - UINT32 ProcessId; - UINT64 Process; - BOOLEAN IsSwitchByClkIntr; - UCHAR ProcessName[16]; - DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListSymDetails; - UINT32 Result; - -} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET - * - */ -#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET \ - sizeof(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET) - -/** - * @brief Debugger thread switch and thread details - * - */ -typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE -{ - - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH, - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS, - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LIST, - -} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE; - -/** - * @brief The structure of changing thead and show thread - * packet in HyperDbg - */ -typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET -{ - DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType; - UINT32 ThreadId; - UINT32 ProcessId; - UINT64 Thread; - UINT64 Process; - BOOLEAN CheckByClockInterrupt; - UCHAR ProcessName[16]; - DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListSymDetails; - UINT32 Result; - -} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET; - -/** - * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET - * - */ -#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET \ - sizeof(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET) - -/* ============================================================================================== - */ - -/** - * @brief stepping and tracking types - * - */ -typedef enum _DEBUGGER_REMOTE_STEPPING_REQUEST -{ - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_IN, - DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN, - DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN_FOR_TRACKING, - - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER, - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU, - DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU_LAST_INSTRUCTION, - -} DEBUGGER_REMOTE_STEPPING_REQUEST; - -/** - * @brief The structure of stepping packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_STEP_PACKET -{ - DEBUGGER_REMOTE_STEPPING_REQUEST StepType; - - // - // Only in the case of call instructions - // the 'p' command - // - BOOLEAN IsCurrentInstructionACall; - UINT32 CallLength; - -} DEBUGGEE_STEP_PACKET, *PDEBUGGEE_STEP_PACKET; - -/** - * @brief default number of instructions used in tracking and stepping - * - */ -#define DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING 0xffffffff - -/* ============================================================================================== - */ - -/** - * @brief The structure of .formats result packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_FORMATS_PACKET -{ - UINT64 Value; - UINT32 Result; - -} DEBUGGEE_FORMATS_PACKET, *PDEBUGGEE_FORMATS_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of .sym reload packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_SYMBOL_REQUEST_PACKET -{ - UINT32 ProcessId; - -} DEBUGGEE_SYMBOL_REQUEST_PACKET, *PDEBUGGEE_SYMBOL_REQUEST_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of bp command packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_BP_PACKET -{ - UINT64 Address; - UINT32 Pid; - UINT32 Tid; - UINT32 Core; - BOOLEAN RemoveAfterHit; - BOOLEAN CheckForCallbacks; - UINT32 Result; - -} DEBUGGEE_BP_PACKET, *PDEBUGGEE_BP_PACKET; - -/** - * @brief breakpoint modification types - * - */ -typedef enum _DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST -{ - - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS, - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE, - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE, - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR, - -} DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST; - -/** - * @brief The structure of breakpoint modification requests packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_BP_LIST_OR_MODIFY_PACKET -{ - UINT64 BreakpointId; - DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST Request; - UINT32 Result; - -} DEBUGGEE_BP_LIST_OR_MODIFY_PACKET, *PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Whether a jump is taken or not taken - * - */ -typedef enum _DEBUGGER_CONDITIONAL_JUMP_STATUS -{ - - DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR = 0, - DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP, - DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN, - DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN, - -} DEBUGGER_CONDITIONAL_JUMP_STATUS; - -/* ============================================================================================== - */ - -/** - * @brief The structure of script packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_SCRIPT_PACKET -{ - UINT32 ScriptBufferSize; - UINT32 ScriptBufferPointer; - BOOLEAN IsFormat; - UINT32 Result; - - // - // The script buffer is here - // - -} DEBUGGEE_SCRIPT_PACKET, *PDEBUGGEE_SCRIPT_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief The structure of result of search packet in HyperDbg - * - */ -typedef struct _DEBUGGEE_RESULT_OF_SEARCH_PACKET -{ - UINT32 CountOfResults; - UINT32 Result; - -} DEBUGGEE_RESULT_OF_SEARCH_PACKET, *PDEBUGGEE_RESULT_OF_SEARCH_PACKET; - -/* ============================================================================================== - */ - -/** - * @brief Register Descriptor Structure to use in r command. - * - */ -typedef struct _DEBUGGEE_REGISTER_READ_DESCRIPTION -{ - UINT32 RegisterID; // the number is from REGS_ENUM - UINT64 Value; - UINT32 KernelStatus; - -} DEBUGGEE_REGISTER_READ_DESCRIPTION, *PDEBUGGEE_REGISTER_READ_DESCRIPTION; - -/* ============================================================================================== - */ - - -//..\..\..\bin\debug\SDK\Headers\Symbols.h -/** - * @file Symbols.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK Header Files For Symbol Parsing - * @details This file contains definitions of symbol parsers - * @version 0.2 - * @date 2022-06-24 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Symbols Details // -////////////////////////////////////////////////// - -/** - * @brief structures for sending and saving details - * about each module and symbols details - * - */ -typedef struct _MODULE_SYMBOL_DETAIL -{ - BOOLEAN IsSymbolDetailsFound; // TRUE if the details of symbols found, FALSE if not found - BOOLEAN IsLocalSymbolPath; // TRUE if the ModuleSymbolPath is a real path - // and FALSE if ModuleSymbolPath is just a module name - BOOLEAN IsSymbolPDBAvaliable; // TRUE if the module's pdb is available(if exists in the sympath) - BOOLEAN IsUserMode; // TRUE if the module is a user-mode module - BOOLEAN Is32Bit; // TRUE if the module is a 32-bit - UINT64 BaseAddress; - char FilePath[MAX_PATH]; - char ModuleSymbolPath[MAX_PATH]; - char ModuleSymbolGuidAndAge[MAXIMUM_GUID_AND_AGE_SIZE]; - -} MODULE_SYMBOL_DETAIL, *PMODULE_SYMBOL_DETAIL; - -typedef struct _USERMODE_LOADED_MODULE_SYMBOLS -{ - UINT64 BaseAddress; - UINT64 Entrypoint; - wchar_t FilePath[MAX_PATH]; - -} USERMODE_LOADED_MODULE_SYMBOLS, *PUSERMODE_LOADED_MODULE_SYMBOLS; - -typedef struct _USERMODE_LOADED_MODULE_DETAILS -{ - UINT32 ProcessId; - BOOLEAN OnlyCountModules; - BOOLEAN Is32Bit; - UINT32 ModulesCount; - UINT32 Result; - - // - // Here is a list of USERMODE_LOADED_MODULE_SYMBOLS (appended) - // - -} USERMODE_LOADED_MODULE_DETAILS, *PUSERMODE_LOADED_MODULE_DETAILS; - -/** - * @brief Callback type that should be used to add - * list of Addresses to ObjectNames - * - */ -typedef VOID (*SymbolMapCallback)(UINT64 Address, char * ModuleName, char * ObjectName, unsigned int ObjectSize); - -/** - * @brief request to add new symbol detail or update a previous - * symbol table entry - * - */ -typedef struct _DEBUGGER_UPDATE_SYMBOL_TABLE -{ - UINT32 TotalSymbols; - UINT32 CurrentSymbolIndex; - MODULE_SYMBOL_DETAIL SymbolDetailPacket; - -} DEBUGGER_UPDATE_SYMBOL_TABLE, *PDEBUGGER_UPDATE_SYMBOL_TABLE; - -/* -============================================================================================== - */ - -/** - * @brief request that shows, symbol reload process is finished - * - */ -typedef struct _DEBUGGEE_SYMBOL_UPDATE_RESULT -{ - UINT64 KernelStatus; // Kernel put the status in this field - -} DEBUGGEE_SYMBOL_UPDATE_RESULT, *PDEBUGGEE_SYMBOL_UPDATE_RESULT; - -/* -============================================================================================== - */ - - -//..\..\..\bin\debug\SDK\Modules\HyperLog.h -/** - * @file HyperLog.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK for HyperLog project - * @details This file contains definitions of HyperLog routines - * @version 0.2 - * @date 2023-01-15 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Callback Types // -////////////////////////////////////////////////// - -/** - * @brief A function that checks whether the current operation - * is on vmx-root mode or not - * - */ -typedef BOOLEAN (*CHECK_VMX_OPERATION)(); - -/** - * @brief A function that checks whether the immediate message - * sending is needed or not - * - */ -typedef BOOLEAN (*CHECK_IMMEDIATE_MESSAGE_SENDING)(UINT32 OperationCode); - -/** - * @brief A function that sends immediate messages - * - */ -typedef BOOLEAN (*SEND_IMMEDIATE_MESSAGE)(CHAR * OptionalBuffer, - UINT32 OptionalBufferLength, - UINT32 OperationCode); - -////////////////////////////////////////////////// -// Callback Structure // -////////////////////////////////////////////////// - -/** - * @brief Prototype of each function needed by message tracer - * - */ -typedef struct _MESSAGE_TRACING_CALLBACKS -{ - CHECK_VMX_OPERATION VmxOperationCheck; - CHECK_IMMEDIATE_MESSAGE_SENDING CheckImmediateMessageSending; - SEND_IMMEDIATE_MESSAGE SendImmediateMessage; - -} MESSAGE_TRACING_CALLBACKS, *PMESSAGE_TRACING_CALLBACKS; - - -//..\..\..\bin\debug\SDK\Modules\VMM.h -/** - * @file VMM.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief HyperDbg's SDK for VMM project - * @details This file contains definitions of HyperLog routines - * @version 0.2 - * @date 2023-01-15 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Callback Types // -////////////////////////////////////////////////// - -/** - * @brief A function from the message tracer that send the inputs to the - * queue of the messages - * - */ -typedef BOOLEAN (*LOG_CALLBACK_PREPARE_AND_SEND_MESSAGE_TO_QUEUE)(UINT32 OperationCode, - BOOLEAN IsImmediateMessage, - BOOLEAN ShowCurrentSystemTime, - BOOLEAN Priority, - const char * Fmt, - va_list ArgList); - -/** - * @brief A function that sends the messages to message tracer buffers - * - */ -typedef BOOLEAN (*LOG_CALLBACK_SEND_MESSAGE_TO_QUEUE)(UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR * LogMessage, UINT32 BufferLen, BOOLEAN Priority); - -/** - * @brief A function that sends the messages to message tracer buffers - * - */ -typedef BOOLEAN (*LOG_CALLBACK_SEND_BUFFER)(_In_ UINT32 OperationCode, - _In_reads_bytes_(BufferLength) PVOID Buffer, - _In_ UINT32 BufferLength, - _In_ BOOLEAN Priority); - -/** - * @brief A function that checks whether the priority or regular buffer is full or not - * - */ -typedef BOOLEAN (*LOG_CALLBACK_CHECK_IF_BUFFER_IS_FULL)(BOOLEAN Priority); - -/** - * @brief A function that handles trigger events - * - */ -typedef VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE (*VMM_CALLBACK_TRIGGER_EVENTS)(VMM_EVENT_TYPE_ENUM EventType, - VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE CallingStage, - PVOID Context, - BOOLEAN * PostEventRequired, - GUEST_REGS * Regs); - -/** - * @brief A function that checks and handles breakpoints - * - */ -typedef BOOLEAN (*DEBUGGING_CALLBACK_HANDLE_BREAKPOINT_EXCEPTION)(UINT32 CoreId); - -/** - * @brief A function that checks and handles debug breakpoints - * - */ -typedef BOOLEAN (*DEBUGGING_CALLBACK_HANDLE_DEBUG_BREAKPOINT_EXCEPTION)(UINT32 CoreId); - -/** - * @brief Check for page-faults in user-debugger - * - */ -typedef BOOLEAN (*DEBUGGING_CALLBACK_CONDITIONAL_PAGE_FAULT_EXCEPTION)(UINT32 CoreId, - UINT64 Address, - UINT32 PageFaultErrorCode); - -/** - * @brief Check for commands in user-debugger - * - */ -typedef BOOLEAN (*UD_CHECK_FOR_COMMAND)(); - -/** - * @brief Handle registered MTF callback - * - */ -typedef VOID (*VMM_CALLBACK_REGISTERED_MTF_HANDLER)(UINT32 CoreId); - -/** - * @brief Check for user-mode access for loaded module details - * - */ -typedef BOOLEAN (*VMM_CALLBACK_RESTORE_EPT_STATE)(UINT32 CoreId); - -/** - * @brief Check for unhandled EPT violations - * - */ -typedef BOOLEAN (*VMM_CALLBACK_CHECK_UNHANDLED_EPT_VIOLATION)(UINT32 CoreId, UINT64 ViolationQualification, UINT64 GuestPhysicalAddr); - -/** - * @brief Handle cr3 process change callbacks - * - */ -typedef VOID (*INTERCEPTION_CALLBACK_TRIGGER_CR3_CHANGE)(UINT32 CoreId); - -/** - * @brief Check for process or thread change callback - * - */ -typedef BOOLEAN (*INTERCEPTION_CALLBACK_TRIGGER_CLOCK_AND_IPI)(_In_ UINT32 CoreId); - -/** - * @brief Check to handle cr3 events for thread interception - * - */ -typedef BOOLEAN (*ATTACHING_HANDLE_CR3_EVENTS_FOR_THREAD_INTERCEPTION)(UINT32 CoreId, CR3_TYPE NewCr3); - -/** - * @brief Check and handle reapplying breakpoint - * - */ -typedef BOOLEAN (*BREAKPOINT_CHECK_AND_HANDLE_REAPPLYING_BREAKPOINT)(UINT32 CoreId); - -/** - * @brief Handle NMI broadcast - * - */ -typedef VOID (*VMM_CALLBACK_NMI_BROADCAST_REQUEST_HANDLER)(UINT32 CoreId, BOOLEAN IsOnVmxNmiHandler); - -/** - * @brief Check and handle NMI callbacks - * - */ -typedef BOOLEAN (*KD_CHECK_AND_HANDLE_NMI_CALLBACK)(UINT32 CoreId); - -/** - * @brief Set the top-level driver's error status - * - */ -typedef VOID (*VMM_CALLBACK_SET_LAST_ERROR)(UINT32 LastError); - -/** - * @brief Check and modify the protected resources of the hypervisor - * - */ -typedef BOOLEAN (*VMM_CALLBACK_QUERY_TERMINATE_PROTECTED_RESOURCE)(UINT32 CoreId, - PROTECTED_HV_RESOURCES_TYPE ResourceType, - PVOID Context, - PROTECTED_HV_RESOURCES_PASSING_OVERS PassOver); - -/** - * @brief Query debugger thread or process tracing details by core ID - * - */ -typedef BOOLEAN (*KD_QUERY_DEBUGGER_THREAD_OR_PROCESS_TRACING_DETAILS_BY_CORE_ID)(UINT32 CoreId, - DEBUGGER_THREAD_PROCESS_TRACING TracingType); -/** - * @brief Handler of debugger specific VMCALLs - * - */ -typedef BOOLEAN (*VMM_CALLBACK_VMCALL_HANDLER)(UINT32 CoreId, - UINT64 VmcallNumber, - UINT64 OptionalParam1, - UINT64 OptionalParam2, - UINT64 OptionalParam3); - -////////////////////////////////////////////////// -// Callback Structure // -////////////////////////////////////////////////// - -/** - * @brief Prototype of each function needed by VMM module - * - */ -typedef struct _VMM_CALLBACKS -{ - // - // Log (Hyperlog) callbacks - // - LOG_CALLBACK_PREPARE_AND_SEND_MESSAGE_TO_QUEUE LogCallbackPrepareAndSendMessageToQueueWrapper; // Fixed - LOG_CALLBACK_SEND_MESSAGE_TO_QUEUE LogCallbackSendMessageToQueue; // Fixed - LOG_CALLBACK_SEND_BUFFER LogCallbackSendBuffer; // Fixed - LOG_CALLBACK_CHECK_IF_BUFFER_IS_FULL LogCallbackCheckIfBufferIsFull; // Fixed - - // - // VMM callbacks - // - VMM_CALLBACK_TRIGGER_EVENTS VmmCallbackTriggerEvents; // Fixed - VMM_CALLBACK_SET_LAST_ERROR VmmCallbackSetLastError; // Fixed - VMM_CALLBACK_VMCALL_HANDLER VmmCallbackVmcallHandler; // Fixed - VMM_CALLBACK_NMI_BROADCAST_REQUEST_HANDLER VmmCallbackNmiBroadcastRequestHandler; // Fixed - VMM_CALLBACK_QUERY_TERMINATE_PROTECTED_RESOURCE VmmCallbackQueryTerminateProtectedResource; // Fixed - VMM_CALLBACK_RESTORE_EPT_STATE VmmCallbackRestoreEptState; // Fixed - VMM_CALLBACK_CHECK_UNHANDLED_EPT_VIOLATION VmmCallbackCheckUnhandledEptViolations; // Fixed - - // - // Debugging callbacks - // - DEBUGGING_CALLBACK_HANDLE_BREAKPOINT_EXCEPTION DebuggingCallbackHandleBreakpointException; // Fixed - DEBUGGING_CALLBACK_HANDLE_DEBUG_BREAKPOINT_EXCEPTION DebuggingCallbackHandleDebugBreakpointException; // Fixed - DEBUGGING_CALLBACK_CONDITIONAL_PAGE_FAULT_EXCEPTION DebuggingCallbackConditionalPageFaultException; // Fixed - - // - // Interception callbacks - // - INTERCEPTION_CALLBACK_TRIGGER_CR3_CHANGE InterceptionCallbackTriggerCr3ProcessChange; // Fixed - - // - // Callbacks to be removed - // - BREAKPOINT_CHECK_AND_HANDLE_REAPPLYING_BREAKPOINT BreakpointCheckAndHandleReApplyingBreakpoint; - UD_CHECK_FOR_COMMAND UdCheckForCommand; - KD_CHECK_AND_HANDLE_NMI_CALLBACK KdCheckAndHandleNmiCallback; - VMM_CALLBACK_REGISTERED_MTF_HANDLER VmmCallbackRegisteredMtfHandler; // Fixed but not good - INTERCEPTION_CALLBACK_TRIGGER_CLOCK_AND_IPI DebuggerCheckProcessOrThreadChange; - ATTACHING_HANDLE_CR3_EVENTS_FOR_THREAD_INTERCEPTION AttachingHandleCr3VmexitsForThreadInterception; - KD_QUERY_DEBUGGER_THREAD_OR_PROCESS_TRACING_DETAILS_BY_CORE_ID KdQueryDebuggerQueryThreadOrProcessTracingDetailsByCoreId; - -} VMM_CALLBACKS, *PVMM_CALLBACKS; - - -//..\..\..\bin\debug\SDK\Imports\HyperDbgCtrlImports.h -/** - * @file HyperDbgCtrlImports.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Headers relating exported functions from controller interface - * @version 0.2 - * @date 2023-02-02 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -#ifdef HYPERDBG_HPRDBGCTRL -# define IMPORT_EXPORT_CTRL __declspec(dllexport) -#else -# define IMPORT_EXPORT_CTRL __declspec(dllimport) -#endif - -// -// Header file of HPRDBGCTRL -// Imports -// -#ifdef __cplusplus -extern "C" { -#endif - -// -// Support Detection -// -IMPORT_EXPORT_CTRL bool HyperDbgVmxSupportDetection(); -IMPORT_EXPORT_CTRL void HyperDbgReadVendorString(char *); - -// -// VMM Module -// -IMPORT_EXPORT_CTRL int HyperDbgLoadVmm(); -IMPORT_EXPORT_CTRL int HyperDbgUnloadVmm(); -IMPORT_EXPORT_CTRL int HyperDbgInstallVmmDriver(); -IMPORT_EXPORT_CTRL int HyperDbgUninstallVmmDriver(); -IMPORT_EXPORT_CTRL int HyperDbgStopVmmDriver(); - -// -// General imports -// -IMPORT_EXPORT_CTRL int HyperDbgInterpreter(char * Command); -IMPORT_EXPORT_CTRL void HyperDbgShowSignature(); -IMPORT_EXPORT_CTRL void HyperDbgSetTextMessageCallback(Callback handler); -IMPORT_EXPORT_CTRL int HyperDbgScriptReadFileAndExecuteCommandline(int argc, char * argv[]); -IMPORT_EXPORT_CTRL bool HyperDbgContinuePreviousCommand(); -IMPORT_EXPORT_CTRL bool HyperDbgCheckMultilineCommand(char * CurrentCommand, bool Reset); - -#ifdef __cplusplus -} -#endif - - -//..\..\..\bin\debug\SDK\Imports\HyperDbgHyperLogImports.h -/** - * @file HyperDbgHyperLogImports.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Headers relating exported functions from hyperlog project - * @version 0.1 - * @date 2023-01-15 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -#ifdef HYPERDBG_HYPER_LOG -# define IMPORT_EXPORT_HYPERLOG __declspec(dllexport) -#else -# define IMPORT_EXPORT_HYPERLOG __declspec(dllimport) -#endif - -////////////////////////////////////////////////// -// Functions // -////////////////////////////////////////////////// - -IMPORT_EXPORT_HYPERLOG BOOLEAN -LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks); - -IMPORT_EXPORT_HYPERLOG VOID -LogUnInitialize(); - -IMPORT_EXPORT_HYPERLOG UINT32 -LogMarkAllAsRead(BOOLEAN IsVmxRoot); - -IMPORT_EXPORT_HYPERLOG BOOLEAN -LogCallbackPrepareAndSendMessageToQueue(UINT32 OperationCode, - BOOLEAN IsImmediateMessage, - BOOLEAN ShowCurrentSystemTime, - BOOLEAN Priority, - const char * Fmt, - ...); - -IMPORT_EXPORT_HYPERLOG BOOLEAN -LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode, - BOOLEAN IsImmediateMessage, - BOOLEAN ShowCurrentSystemTime, - BOOLEAN Priority, - const char * Fmt, - va_list ArgList); - -IMPORT_EXPORT_HYPERLOG BOOLEAN -LogCallbackSendBuffer(_In_ UINT32 OperationCode, - _In_reads_bytes_(BufferLength) PVOID Buffer, - _In_ UINT32 BufferLength, - _In_ BOOLEAN Priority); - -IMPORT_EXPORT_HYPERLOG BOOLEAN -LogCallbackCheckIfBufferIsFull(BOOLEAN Priority); - -IMPORT_EXPORT_HYPERLOG BOOLEAN -LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR * LogMessage, UINT32 BufferLen, BOOLEAN Priority); - -IMPORT_EXPORT_HYPERLOG NTSTATUS -LogRegisterEventBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp); - -IMPORT_EXPORT_HYPERLOG NTSTATUS -LogRegisterIrpBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp); - - -//..\..\..\bin\debug\SDK\Imports\HyperDbgHyperLogIntrinsics.h -/** - * @file HyperDbgHyperLogIntrinsics.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Headers relating exported functions from hyperlog project - * @version 0.1 - * @date 2023-01-15 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Enums // -////////////////////////////////////////////////// - -/** - * @brief Types of log messages - * - */ -typedef enum _LOG_TYPE -{ - LOG_INFO, - LOG_WARNING, - LOG_ERROR - -} LOG_TYPE; - -////////////////////////////////////////////////// -// Logging // -////////////////////////////////////////////////// - -/** - * @brief Define log variables - * - */ -#if UseDbgPrintInsteadOfUsermodeMessageTracking -/* Use DbgPrint */ -# define Logformat, ...) \ - DbgPrint("[+] Information (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__) - -# define LogWarning(format, ...) \ - DbgPrint("[-] Warning (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__) - -# define LogError(format, ...) \ - DbgPrint("[!] Error (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__); \ - DbgBreakPoint() - -/** - * @brief Log without any prefix - * - */ -# define Log(format, ...) \ - DbgPrint(format, __VA_ARGS__) - -#else - -/** - * @brief Log, general - * - */ -# define LogInfo(format, ...) \ - LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ - UseImmediateMessaging, \ - ShowSystemTimeOnDebugMessages, \ - FALSE, \ - "[+] Information (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__) - -/** - * @brief Log in the case of priority message - * - */ -# define LogInfoPriority(format, ...) \ - LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ - TRUE, \ - ShowSystemTimeOnDebugMessages, \ - TRUE, \ - "[+] Information (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__) - -/** - * @brief Log in the case of warning - * - */ -# define LogWarning(format, ...) \ - LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_WARNING_MESSAGE, \ - UseImmediateMessaging, \ - ShowSystemTimeOnDebugMessages, \ - TRUE, \ - "[-] Warning (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__) - -/** - * @brief Log in the case of error - * - */ -# define LogError(format, ...) \ - LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_ERROR_MESSAGE, \ - UseImmediateMessaging, \ - ShowSystemTimeOnDebugMessages, \ - TRUE, \ - "[!] Error (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__); \ - if (DebugMode) \ - DbgBreakPoint() - -/** - * @brief Log without any prefix - * - */ -# define Log(format, ...) \ - LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ - TRUE, \ - FALSE, \ - FALSE, \ - format, \ - __VA_ARGS__) - -/** - * @brief Log without any prefix and bypass the stack - * problem (getting two temporary stacks in preparing phase) - * - */ -# define LogSimpleWithTag(tag, isimmdte, buffer, len) \ - LogCallbackSendMessageToQueue(tag, \ - isimmdte, \ - buffer, \ - len, \ - FALSE) - -#endif // UseDbgPrintInsteadOfUsermodeMessageTracking - -/** - * @brief Log, initialize boot information and debug information - * - */ -#define LogDebugInfo(format, ...) \ - if (DebugMode) \ - LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ - UseImmediateMessaging, \ - ShowSystemTimeOnDebugMessages, \ - FALSE, \ - "[+] Information (%s:%d) | " format "\n", \ - __func__, \ - __LINE__, \ - __VA_ARGS__) - - -//..\..\..\bin\debug\SDK\Imports\HyperDbgRevImports.h -/** - * @file HyperDbgRevImports.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Headers relating exported functions from reversing machine interface - * @version 0.2 - * @date 2023-02-02 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -// -// Header file of hpr -// Imports -// -#ifdef __cplusplus -extern "C" { -#endif - -// -// Reversing Machine Module -// -__declspec(dllimport) int ReversingMachineStart(); -__declspec(dllimport) int ReversingMachineStop(); - -#ifdef __cplusplus -} -#endif - - -//..\..\..\bin\debug\SDK\Imports\HyperDbgScriptImports.h -/** - * @file HyperDbgScriptImports.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Headers relating exported functions from script engine - * @version 0.2 - * @date 2023-02-02 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -// -// Header file of script-engine -// Imports -// -#ifdef __cplusplus -extern "C" { -#endif - -// -// Script engine -// -__declspec(dllimport) PSYMBOL_BUFFER -ScriptEngineParse(char * str); -__declspec(dllimport) void -PrintSymbolBuffer(const PSYMBOL_BUFFER SymbolBuffer); -__declspec(dllimport) void -PrintSymbol(PSYMBOL Symbol); -__declspec(dllimport) void -RemoveSymbolBuffer(PSYMBOL_BUFFER SymbolBuffer); -__declspec(dllimport) BOOLEAN -FuncGetNumberOfOperands(UINT64 FuncType, UINT32 * NumberOfGetOperands, UINT32 * NumberOfSetOperands); -__declspec(dllimport) BOOLEAN -ScriptEngineSetHwdbgInstanceInfo(HWDBG_INSTANCE_INFORMATION * InstancInfo); - -; - -// -// pdb parser -// -__declspec(dllimport) VOID -ScriptEngineSetTextMessageCallback(PVOID Handler); -__declspec(dllimport) VOID -ScriptEngineSymbolAbortLoading(); -__declspec(dllimport) UINT64 -ScriptEngineConvertNameToAddress(const char * FunctionOrVariableName, PBOOLEAN WasFound); -__declspec(dllimport) UINT32 -ScriptEngineLoadFileSymbol(UINT64 BaseAddress, const char * PdbFileName, const char * CustomModuleName); -__declspec(dllimport) UINT32 -ScriptEngineUnloadAllSymbols(); -__declspec(dllimport) UINT32 -ScriptEngineUnloadModuleSymbol(char * ModuleName); -__declspec(dllimport) UINT32 -ScriptEngineSearchSymbolForMask(const char * SearchMask); -__declspec(dllimport) BOOLEAN -ScriptEngineGetFieldOffset(CHAR * TypeName, CHAR * FieldName, UINT32 * FieldOffset); -__declspec(dllimport) BOOLEAN -ScriptEngineGetDataTypeSize(CHAR * TypeName, UINT64 * TypeSize); -__declspec(dllimport) BOOLEAN -ScriptEngineCreateSymbolTableForDisassembler(void * CallbackFunction); -__declspec(dllimport) BOOLEAN -ScriptEngineConvertFileToPdbPath(const char * LocalFilePath, char * ResultPath); -__declspec(dllimport) BOOLEAN -ScriptEngineConvertFileToPdbFileAndGuidAndAgeDetails(const char * LocalFilePath, char * PdbFilePath, char * GuidAndAgeDetails, BOOLEAN Is32BitModule); -__declspec(dllimport) BOOLEAN -ScriptEngineSymbolInitLoad(PVOID BufferToStoreDetails, UINT32 StoredLength, BOOLEAN DownloadIfAvailable, const char * SymbolPath, BOOLEAN IsSilentLoad); -__declspec(dllimport) BOOLEAN -ScriptEngineShowDataBasedOnSymbolTypes(const char * TypeName, UINT64 Address, BOOLEAN IsStruct, PVOID BufferAddress, const char * AdditionalParameters); - -#ifdef __cplusplus -} -#endif - - -//..\..\..\bin\debug\SDK\Imports\HyperDbgSymImports.h -/** - * @file HyperDbgSymImports.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Headers relating exported functions from symbol parser - * @version 0.2 - * @date 2023-02-02 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -// -// Header file of symbol-parser -// Imports -// -#ifdef __cplusplus -extern "C" { -#endif - -__declspec(dllimport) VOID - SymSetTextMessageCallback(PVOID Handler); -__declspec(dllimport) VOID - SymbolAbortLoading(); -__declspec(dllimport) UINT64 - SymConvertNameToAddress(const char * FunctionOrVariableName, PBOOLEAN WasFound); -__declspec(dllimport) UINT32 - SymLoadFileSymbol(UINT64 BaseAddress, const char * PdbFileName, const char * CustomModuleName); -__declspec(dllimport) UINT32 - SymUnloadAllSymbols(); -__declspec(dllimport) UINT32 - SymUnloadModuleSymbol(char * ModuleName); -__declspec(dllimport) UINT32 - SymSearchSymbolForMask(const char * SearchMask); -__declspec(dllimport) BOOLEAN - SymGetFieldOffset(CHAR * TypeName, CHAR * FieldName, UINT32 * FieldOffset); -__declspec(dllimport) BOOLEAN - SymGetDataTypeSize(CHAR * TypeName, UINT64 * TypeSize); -__declspec(dllimport) BOOLEAN - SymCreateSymbolTableForDisassembler(void * CallbackFunction); -__declspec(dllimport) BOOLEAN - SymConvertFileToPdbPath(const char * LocalFilePath, char * ResultPath); -__declspec(dllimport) BOOLEAN - SymConvertFileToPdbFileAndGuidAndAgeDetails(const char * LocalFilePath, - char * PdbFilePath, - char * GuidAndAgeDetails, - BOOLEAN Is32BitModule); -__declspec(dllimport) BOOLEAN - SymbolInitLoad(PVOID BufferToStoreDetails, - UINT32 StoredLength, - BOOLEAN DownloadIfAvailable, - const char * SymbolPath, - BOOLEAN IsSilentLoad); -__declspec(dllimport) BOOLEAN - SymShowDataBasedOnSymbolTypes(const char * TypeName, - UINT64 Address, - BOOLEAN IsStruct, - PVOID BufferAddress, - const char * AdditionalParameters); -__declspec(dllimport) BOOLEAN - SymQuerySizeof(_In_ const char * StructNameOrTypeName, _Out_ UINT32 * SizeOfField); -__declspec(dllimport) BOOLEAN - SymCastingQueryForFiledsAndTypes(_In_ const char * StructName, - _In_ const char * FiledOfStructName, - _Out_ PBOOLEAN IsStructNamePointerOrNot, - _Out_ PBOOLEAN IsFiledOfStructNamePointerOrNot, - _Out_ char ** NewStructOrTypeName, - _Out_ UINT32 * OffsetOfFieldFromTop, - _Out_ UINT32 * SizeOfField); - -#ifdef __cplusplus -} -#endif - - -//..\..\..\bin\debug\SDK\Imports\HyperDbgVmmImports.h -/** - * @file HyperDbgVmmImports.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Headers relating exported functions from hypervisor - * @version 0.1 - * @date 2022-12-09 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -#ifdef HYPERDBG_VMM -# define IMPORT_EXPORT_VMM __declspec(dllexport) -#else -# define IMPORT_EXPORT_VMM __declspec(dllimport) -#endif - -////////////////////////////////////////////////// -// VM Functions // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM NTSTATUS -VmFuncVmxVmcall(unsigned long long VmcallNumber, - unsigned long long OptionalParam1, - unsigned long long OptionalParam2, - unsigned long long OptionalParam3); - -IMPORT_EXPORT_VMM VOID -VmFuncPerformRipIncrement(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncSuppressRipIncrement(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncChangeMtfUnsettingState(UINT32 CoreId, BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncChangeIgnoreOneMtfState(UINT32 CoreId, BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetMonitorTrapFlag(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetRflagTrapFlag(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncRegisterMtfBreak(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncUnRegisterMtfBreak(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncSetLoadDebugControls(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetSaveDebugControls(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetPmcVmexit(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetMovControlRegsExiting(BOOLEAN Set, UINT64 ControlRegister, UINT64 MaskRegister); - -IMPORT_EXPORT_VMM VOID -VmFuncSetMovToCr3Vmexit(UINT32 CoreId, BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncWriteExceptionBitmap(UINT32 BitmapMask); - -IMPORT_EXPORT_VMM VOID -VmFuncSetInterruptWindowExiting(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetNmiWindowExiting(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetNmiExiting(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetExceptionBitmap(UINT32 CoreId, UINT32 IdtIndex); - -IMPORT_EXPORT_VMM VOID -VmFuncUnsetExceptionBitmap(UINT32 CoreId, UINT32 IdtIndex); - -IMPORT_EXPORT_VMM VOID -VmFuncSetExternalInterruptExiting(UINT32 CoreId, BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetRdtscExiting(UINT32 CoreId, BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetMovDebugRegsExiting(UINT32 CoreId, BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncInjectPendingExternalInterrupts(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncSetRflags(UINT64 Rflags); - -IMPORT_EXPORT_VMM VOID -VmFuncSetRip(UINT64 Rip); - -IMPORT_EXPORT_VMM VOID -VmFuncSetTriggerEventForVmcalls(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetTriggerEventForCpuids(BOOLEAN Set); - -IMPORT_EXPORT_VMM VOID -VmFuncSetInterruptibilityState(UINT64 InterruptibilityState); - -IMPORT_EXPORT_VMM VOID -VmFuncCheckAndEnableExternalInterrupts(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncDisableExternalInterruptsAndInterruptWindow(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncEventInjectPageFaultWithCr2(UINT32 CoreId, UINT64 Address, UINT32 PageFaultCode); - -IMPORT_EXPORT_VMM VOID -VmFuncEventInjectPageFaultRangeAddress(UINT32 CoreId, - UINT64 AddressFrom, - UINT64 AddressTo, - UINT32 PageFaultCode); - -IMPORT_EXPORT_VMM VOID -VmFuncEventInjectInterruption(UINT32 InterruptionType, - UINT32 Vector, - BOOLEAN DeliverErrorCode, - UINT32 ErrorCode); - -IMPORT_EXPORT_VMM VOID -VmFuncVmxBroadcastInitialize(); - -IMPORT_EXPORT_VMM VOID -VmFuncVmxBroadcastUninitialize(); - -IMPORT_EXPORT_VMM VOID -VmFuncEventInjectBreakpoint(); - -IMPORT_EXPORT_VMM VOID -VmFuncInvalidateEptSingleContext(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncInvalidateEptAllContexts(); - -IMPORT_EXPORT_VMM VOID -VmFuncUninitVmm(); - -IMPORT_EXPORT_VMM VOID -VmFuncEnableMtfAndChangeExternalInterruptState(UINT32 CoreId); - -IMPORT_EXPORT_VMM VOID -VmFuncEnableAndCheckForPreviousExternalInterrupts(UINT32 CoreId); - -IMPORT_EXPORT_VMM UINT16 -VmFuncGetCsSelector(); - -IMPORT_EXPORT_VMM UINT32 -VmFuncReadExceptionBitmap(); - -IMPORT_EXPORT_VMM UINT64 -VmFuncGetLastVmexitRip(UINT32 CoreId); - -IMPORT_EXPORT_VMM UINT64 -VmFuncGetRflags(); - -IMPORT_EXPORT_VMM UINT64 -VmFuncGetRip(); - -IMPORT_EXPORT_VMM UINT64 -VmFuncGetInterruptibilityState(); - -IMPORT_EXPORT_VMM UINT64 -VmFuncClearSteppingBits(UINT64 Interruptibility); - -IMPORT_EXPORT_VMM BOOLEAN -VmFuncInitVmm(VMM_CALLBACKS * VmmCallbacks); - -IMPORT_EXPORT_VMM UINT32 -VmFuncVmxCompatibleStrlen(const CHAR * s); - -IMPORT_EXPORT_VMM UINT32 -VmFuncVmxCompatibleWcslen(const wchar_t * s); - -IMPORT_EXPORT_VMM BOOLEAN -VmFuncNmiBroadcastRequest(UINT32 CoreId); - -IMPORT_EXPORT_VMM BOOLEAN -VmFuncNmiBroadcastInvalidateEptSingleContext(UINT32 CoreId); - -IMPORT_EXPORT_VMM BOOLEAN -VmFuncNmiBroadcastInvalidateEptAllContexts(UINT32 CoreId); - -IMPORT_EXPORT_VMM BOOLEAN -VmFuncVmxGetCurrentExecutionMode(); - -IMPORT_EXPORT_VMM BOOLEAN -VmFuncQueryModeExecTrap(); - -IMPORT_EXPORT_VMM INT32 -VmFuncVmxCompatibleStrcmp(const CHAR * Address1, const CHAR * Address2); - -IMPORT_EXPORT_VMM INT32 -VmFuncVmxCompatibleStrncmp(const CHAR * Address1, const CHAR * Address2, SIZE_T Num); - -IMPORT_EXPORT_VMM INT32 -VmFuncVmxCompatibleWcscmp(const wchar_t * Address1, const wchar_t * Address2); - -IMPORT_EXPORT_VMM INT32 -VmFuncVmxCompatibleWcsncmp(const wchar_t * Address1, const wchar_t * Address2, SIZE_T Num); - -IMPORT_EXPORT_VMM INT32 -VmFuncVmxCompatibleMemcmp(const CHAR * Address1, const CHAR * Address2, size_t Count); - -////////////////////////////////////////////////// -// Configuration Functions // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM VOID -ConfigureEnableMovToCr3ExitingOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -ConfigureDisableMovToCr3ExitingOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -ConfigureEnableEferSyscallEventsOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -ConfigureDisableEferSyscallEventsOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -ConfigureSetExternalInterruptExitingOnSingleCore(UINT32 TargetCoreId); - -IMPORT_EXPORT_VMM VOID -ConfigureEnableRdtscExitingOnSingleCore(UINT32 TargetCoreId); - -IMPORT_EXPORT_VMM VOID -ConfigureEnableRdpmcExitingOnSingleCore(UINT32 TargetCoreId); - -IMPORT_EXPORT_VMM VOID -ConfigureEnableMovToDebugRegistersExitingOnSingleCore(UINT32 TargetCoreId); - -IMPORT_EXPORT_VMM VOID -ConfigureSetExceptionBitmapOnSingleCore(UINT32 TargetCoreId, UINT32 BitMask); - -IMPORT_EXPORT_VMM VOID -ConfigureEnableMovToControlRegisterExitingOnSingleCore(UINT32 TargetCoreId, DEBUGGER_EVENT_OPTIONS * BroadcastingOption); - -IMPORT_EXPORT_VMM VOID -ConfigureChangeMsrBitmapWriteOnSingleCore(UINT32 TargetCoreId, UINT64 MsrMask); - -IMPORT_EXPORT_VMM VOID -ConfigureChangeMsrBitmapReadOnSingleCore(UINT32 TargetCoreId, UINT64 MsrMask); - -IMPORT_EXPORT_VMM VOID -ConfigureChangeIoBitmapOnSingleCore(UINT32 TargetCoreId, UINT64 Port); - -IMPORT_EXPORT_VMM VOID -ConfigureEnableEferSyscallHookOnSingleCore(UINT32 TargetCoreId); - -IMPORT_EXPORT_VMM VOID -ConfigureSetEferSyscallOrSysretHookType(DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE SyscallHookType); - -IMPORT_EXPORT_VMM VOID -ConfigureDirtyLoggingInitializeOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -ConfigureDirtyLoggingUninitializeOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -ConfigureModeBasedExecHookUninitializeOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -ConfigureUninitializeExecTrapOnAllProcessors(); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureInitializeExecTrapOnAllProcessors(); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHook(PVOID TargetAddress, UINT32 ProcessId); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookFromVmxRoot(PVOID TargetAddress); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHook2(UINT32 CoreId, - PVOID TargetAddress, - PVOID HookFunction, - UINT32 ProcessId); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHook2FromVmxRoot(UINT32 CoreId, - PVOID TargetAddress, - PVOID HookFunction); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookMonitor(UINT32 CoreId, - EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR * HookingDetails, - UINT32 ProcessId); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookMonitorFromVmxRoot(UINT32 CoreId, - EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR * MemoryAddressDetails); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookModifyInstructionFetchState(UINT32 CoreId, - PVOID PhysicalAddress, - BOOLEAN IsUnset); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookModifyPageReadState(UINT32 CoreId, - PVOID PhysicalAddress, - BOOLEAN IsUnset); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookModifyPageWriteState(UINT32 CoreId, - PVOID PhysicalAddress, - BOOLEAN IsUnset); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookUnHookSingleAddress(UINT64 VirtualAddress, - UINT64 PhysAddress, - UINT32 ProcessId); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureEptHookUnHookSingleAddressFromVmxRoot(UINT64 VirtualAddress, - UINT64 PhysAddress, - EPT_SINGLE_HOOK_UNHOOKING_DETAILS * TargetUnhookingDetails); - -IMPORT_EXPORT_VMM VOID -ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks(UINT32 Count); - -IMPORT_EXPORT_VMM VOID -ConfigureEptHookReservePreallocatedPoolsForEptHooks(UINT32 Count); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureExecTrapAddProcessToWatchingList(UINT32 ProcessId); - -IMPORT_EXPORT_VMM BOOLEAN -ConfigureExecTrapRemoveProcessFromWatchingList(UINT32 ProcessId); - -////////////////////////////////////////////////// -// Direct VMCALL Functions // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallTest(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallPerformVmcall(UINT32 CoreId, UINT64 VmcallNumber, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallChangeMsrBitmapRead(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallChangeMsrBitmapWrite(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallChangeIoBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallEnableRdpmcExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallEnableRdtscpExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallEnableMov2DebugRegsExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallSetExceptionBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallEnableExternalInterruptExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallEnableMovToCrExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallEnableEferSyscall(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallSetHiddenBreakpointHook(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallInvalidateEptAllContexts(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallInvalidateSingleContext(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallUnsetExceptionBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallUnhookSinglePage(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallResetMsrBitmapRead(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallResetMsrBitmapWrite(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallResetIoBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallDisableRdtscExitingForClearingTscEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallDisableRdpmcExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallDisableEferSyscallEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallDisableMov2DrExitingForClearingDrEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -IMPORT_EXPORT_VMM NTSTATUS -DirectVmcallDisableMov2CrExitingForClearingCrEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); - -////////////////////////////////////////////////// -// Disassembler // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM BOOLEAN -DisassemblerShowInstructionsInVmxNonRootMode(PVOID Address, UINT32 Length, BOOLEAN Is32Bit); - -IMPORT_EXPORT_VMM BOOLEAN -DisassemblerShowOneInstructionInVmxNonRootMode(PVOID Address, UINT64 ActualRip, BOOLEAN Is32Bit); - -IMPORT_EXPORT_VMM UINT32 -DisassemblerShowOneInstructionInVmxRootMode(PVOID Address, BOOLEAN Is32Bit); - -////////////////////////////////////////////////// -// General Functions // -////////////////////////////////////////////////// - -// ---------------------------------------------------------------------------- -// Exported Interfaces For Virtual Addresses -// - -IMPORT_EXPORT_VMM UINT64 -VirtualAddressToPhysicalAddress(_In_ PVOID VirtualAddress); - -IMPORT_EXPORT_VMM UINT64 -VirtualAddressToPhysicalAddressByProcessId(_In_ PVOID VirtualAddress, - _In_ UINT32 ProcessId); - -IMPORT_EXPORT_VMM UINT64 -VirtualAddressToPhysicalAddressByProcessCr3(_In_ PVOID VirtualAddress, - _In_ CR3_TYPE TargetCr3); - -IMPORT_EXPORT_VMM UINT64 -VirtualAddressToPhysicalAddressOnTargetProcess(_In_ PVOID VirtualAddress); - -// ---------------------------------------------------------------------------- -// Exported Interfaces For Physical Addresses -// -IMPORT_EXPORT_VMM UINT64 -PhysicalAddressToVirtualAddress(_In_ UINT64 PhysicalAddress); - -IMPORT_EXPORT_VMM UINT64 -PhysicalAddressToVirtualAddressByProcessId(_In_ PVOID PhysicalAddress, _In_ UINT32 ProcessId); - -IMPORT_EXPORT_VMM UINT64 -PhysicalAddressToVirtualAddressByCr3(_In_ PVOID PhysicalAddress, _In_ CR3_TYPE TargetCr3); - -IMPORT_EXPORT_VMM UINT64 -PhysicalAddressToVirtualAddressOnTargetProcess(_In_ PVOID PhysicalAddress); - -// ---------------------------------------------------------------------------- -// Exported Interfaces For Layout Switching Functions -// -IMPORT_EXPORT_VMM CR3_TYPE -SwitchToProcessMemoryLayout(_In_ UINT32 ProcessId); - -IMPORT_EXPORT_VMM CR3_TYPE -SwitchToCurrentProcessMemoryLayout(); - -IMPORT_EXPORT_VMM CR3_TYPE -SwitchToProcessMemoryLayoutByCr3(_In_ CR3_TYPE TargetCr3); - -IMPORT_EXPORT_VMM VOID -SwitchToPreviousProcess(_In_ CR3_TYPE PreviousProcess); - -// ---------------------------------------------------------------------------- -// Exported Interfaces For Check Validity of Addresses -// -IMPORT_EXPORT_VMM BOOLEAN -CheckAddressValidityUsingTsx(CHAR * Address); - -IMPORT_EXPORT_VMM BOOLEAN -CheckAccessValidityAndSafety(UINT64 TargetAddress, UINT32 Size); - -IMPORT_EXPORT_VMM BOOLEAN -CheckAddressPhysical(UINT64 PAddr); - -IMPORT_EXPORT_VMM UINT32 -CheckAddressMaximumInstructionLength(PVOID Address); - -// ---------------------------------------------------------------------------- -// Exported Interfaces For Layout Functions -// -IMPORT_EXPORT_VMM CR3_TYPE -LayoutGetCurrentProcessCr3(); - -IMPORT_EXPORT_VMM CR3_TYPE -LayoutGetExactGuestProcessCr3(); - -////////////////////////////////////////////////// -// Memory Management Functions // -////////////////////////////////////////////////// - -// ---------------------------------------------------------------------------- -// PTE-related Functions -// - -IMPORT_EXPORT_VMM PVOID -MemoryMapperGetPteVa(_In_ PVOID Va, - _In_ PAGING_LEVEL Level); - -IMPORT_EXPORT_VMM PVOID -MemoryMapperGetPteVaByCr3(_In_ PVOID Va, - _In_ PAGING_LEVEL Level, - _In_ CR3_TYPE TargetCr3); - -IMPORT_EXPORT_VMM PVOID -MemoryMapperGetPteVaWithoutSwitchingByCr3(_In_ PVOID Va, - _In_ PAGING_LEVEL Level, - _In_ CR3_TYPE TargetCr3); - -IMPORT_EXPORT_VMM PVOID -MemoryMapperGetPteVaOnTargetProcess(_In_ PVOID Va, - _In_ PAGING_LEVEL Level); - -IMPORT_EXPORT_VMM PVOID -MemoryMapperSetExecuteDisableToPteOnTargetProcess(_In_ PVOID Va, - _In_ BOOLEAN Set); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperCheckPteIsPresentOnTargetProcess(PVOID Va, - PAGING_LEVEL Level); - -// ---------------------------------------------------------------------------- -// Reading Memory Functions -// -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperReadMemorySafe(_In_ UINT64 VaAddressToRead, - _Inout_ PVOID BufferToSaveMemory, - _In_ SIZE_T SizeToRead); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperReadMemorySafeByPhysicalAddress(_In_ UINT64 PaAddressToRead, - _Inout_ UINT64 BufferToSaveMemory, - _In_ SIZE_T SizeToRead); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperReadMemorySafeOnTargetProcess(_In_ UINT64 VaAddressToRead, - _Inout_ PVOID BufferToSaveMemory, - _In_ SIZE_T SizeToRead); - -// ---------------------------------------------------------------------------- -// Disassembler Functions -// -IMPORT_EXPORT_VMM UINT32 -DisassemblerLengthDisassembleEngine(PVOID Address, BOOLEAN Is32Bit); - -IMPORT_EXPORT_VMM UINT32 -DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess(PVOID Address, BOOLEAN Is32Bit); - -// ---------------------------------------------------------------------------- -// Writing Memory Functions -// -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperWriteMemorySafe(_Inout_ UINT64 Destination, - _In_ PVOID Source, - _In_ SIZE_T SizeToWrite, - _In_ CR3_TYPE TargetProcessCr3); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperWriteMemorySafeOnTargetProcess(_Inout_ UINT64 Destination, - _In_ PVOID Source, - _In_ SIZE_T Size); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperWriteMemorySafeByPhysicalAddress(_Inout_ UINT64 DestinationPa, - _In_ UINT64 Source, - _In_ SIZE_T SizeToWrite); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperWriteMemoryUnsafe(_Inout_ UINT64 Destination, - _In_ PVOID Source, - _In_ SIZE_T SizeToWrite, - _In_ UINT32 TargetProcessId); - -// ---------------------------------------------------------------------------- -// Reserving Memory Functions -// -IMPORT_EXPORT_VMM UINT64 -MemoryMapperReserveUsermodeAddressOnTargetProcess(_In_ UINT32 ProcessId, - _In_ BOOLEAN Allocate); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperFreeMemoryOnTargetProcess(_In_ UINT32 ProcessId, - _Inout_ PVOID BaseAddress); - -// ---------------------------------------------------------------------------- -// Miscellaneous Memory Functions -// -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperSetSupervisorBitWithoutSwitchingByCr3(_In_ PVOID Va, - _In_ BOOLEAN Set, - _In_ PAGING_LEVEL Level, - _In_ CR3_TYPE TargetCr3); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess(_In_ PVOID Va); - -IMPORT_EXPORT_VMM BOOLEAN -MemoryMapperCheckIfPdeIsLargePageOnTargetProcess(_In_ PVOID Va); - -////////////////////////////////////////////////// -// Memory Manager // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM BOOLEAN -MemoryManagerReadProcessMemoryNormal(HANDLE PID, PVOID Address, DEBUGGER_READ_MEMORY_TYPE MemType, PVOID UserBuffer, SIZE_T Size, PSIZE_T ReturnSize); - -////////////////////////////////////////////////// -// Pool Manager // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM BOOLEAN -PoolManagerCheckAndPerformAllocationAndDeallocation(); - -IMPORT_EXPORT_VMM BOOLEAN -PoolManagerRequestAllocation(SIZE_T Size, UINT32 Count, POOL_ALLOCATION_INTENTION Intention); - -IMPORT_EXPORT_VMM UINT64 -PoolManagerRequestPool(POOL_ALLOCATION_INTENTION Intention, BOOLEAN RequestNewPool, UINT32 Size); - -IMPORT_EXPORT_VMM BOOLEAN -PoolManagerFreePool(UINT64 AddressToFree); - -IMPORT_EXPORT_VMM VOID -PoolManagerShowPreAllocatedPools(); - -////////////////////////////////////////////////// -// VMX Registers Modification // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM VOID -SetGuestCsSel(PVMX_SEGMENT_SELECTOR Cs); - -IMPORT_EXPORT_VMM VOID -SetGuestCs(PVMX_SEGMENT_SELECTOR Cs); - -IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR -GetGuestCs(); - -IMPORT_EXPORT_VMM VOID -SetGuestSsSel(PVMX_SEGMENT_SELECTOR Ss); - -IMPORT_EXPORT_VMM VOID -SetGuestSs(PVMX_SEGMENT_SELECTOR Ss); - -IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR -GetGuestSs(); - -IMPORT_EXPORT_VMM VOID -SetGuestDsSel(PVMX_SEGMENT_SELECTOR Ds); - -IMPORT_EXPORT_VMM VOID -SetGuestDs(PVMX_SEGMENT_SELECTOR Ds); - -IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR -GetGuestDs(); - -IMPORT_EXPORT_VMM VOID -SetGuestFsSel(PVMX_SEGMENT_SELECTOR Fs); - -IMPORT_EXPORT_VMM VOID -SetGuestFs(PVMX_SEGMENT_SELECTOR Fs); - -IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR -GetGuestFs(); - -IMPORT_EXPORT_VMM VOID -SetGuestGsSel(PVMX_SEGMENT_SELECTOR Gs); - -IMPORT_EXPORT_VMM VOID -SetGuestGs(PVMX_SEGMENT_SELECTOR Gs); - -IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR -GetGuestGs(); - -IMPORT_EXPORT_VMM VOID -SetGuestEsSel(PVMX_SEGMENT_SELECTOR Es); - -IMPORT_EXPORT_VMM VOID -SetGuestEs(PVMX_SEGMENT_SELECTOR Es); - -IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR -GetGuestEs(); - -IMPORT_EXPORT_VMM VOID -SetGuestIdtr(UINT64 Idtr); - -IMPORT_EXPORT_VMM UINT64 -GetGuestIdtr(); - -IMPORT_EXPORT_VMM VOID -SetGuestLdtr(UINT64 Ldtr); - -IMPORT_EXPORT_VMM UINT64 -GetGuestLdtr(); - -IMPORT_EXPORT_VMM VOID -SetGuestGdtr(UINT64 Gdtr); - -IMPORT_EXPORT_VMM UINT64 -GetGuestGdtr(); - -IMPORT_EXPORT_VMM VOID -SetGuestTr(UINT64 Tr); - -IMPORT_EXPORT_VMM UINT64 -GetGuestTr(); - -IMPORT_EXPORT_VMM VOID -SetGuestRFlags(UINT64 RFlags); - -IMPORT_EXPORT_VMM UINT64 -GetGuestRFlags(); - -IMPORT_EXPORT_VMM VOID -SetGuestRIP(UINT64 RIP); - -IMPORT_EXPORT_VMM VOID -SetGuestRSP(UINT64 RSP); - -IMPORT_EXPORT_VMM UINT64 -GetGuestRIP(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestCr0(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestCr2(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestCr3(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestCr4(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestCr8(); - -IMPORT_EXPORT_VMM VOID -SetGuestCr0(UINT64 Cr0); - -IMPORT_EXPORT_VMM VOID -SetGuestCr2(UINT64 Cr2); - -IMPORT_EXPORT_VMM VOID -SetGuestCr3(UINT64 Cr3); - -IMPORT_EXPORT_VMM VOID -SetGuestCr4(UINT64 Cr4); - -IMPORT_EXPORT_VMM VOID -SetGuestCr8(UINT64 Cr8); - -IMPORT_EXPORT_VMM UINT64 -GetGuestDr0(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestDr1(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestDr2(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestDr3(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestDr6(); - -IMPORT_EXPORT_VMM UINT64 -GetGuestDr7(); - -IMPORT_EXPORT_VMM VOID -SetGuestDr0(UINT64 value); - -IMPORT_EXPORT_VMM VOID -SetGuestDr1(UINT64 value); - -IMPORT_EXPORT_VMM VOID -SetGuestDr2(UINT64 value); - -IMPORT_EXPORT_VMM VOID -SetGuestDr3(UINT64 value); - -IMPORT_EXPORT_VMM VOID -SetGuestDr6(UINT64 value); - -IMPORT_EXPORT_VMM VOID -SetGuestDr7(UINT64 value); - -IMPORT_EXPORT_VMM BOOLEAN -SetDebugRegisters(UINT32 DebugRegNum, DEBUG_REGISTER_TYPE ActionType, BOOLEAN ApplyToVmcs, UINT64 TargetAddress); - -////////////////////////////////////////////////// -// Transparent Mode // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM NTSTATUS -TransparentHideDebugger(PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE Measurements); - -IMPORT_EXPORT_VMM NTSTATUS -TransparentUnhideDebugger(); - -////////////////////////////////////////////////// -// Non-internal Broadcasting Functions // -////////////////////////////////////////////////// - -IMPORT_EXPORT_VMM VOID -BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastEnableDbAndBpExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableDbAndBpExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastEnableRdtscExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableRdtscExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastChangeAllMsrBitmapReadAllCores(UINT64 BitmapMask); - -IMPORT_EXPORT_VMM VOID -BroadcastResetChangeAllMsrBitmapReadAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastChangeAllMsrBitmapWriteAllCores(UINT64 BitmapMask); - -IMPORT_EXPORT_VMM VOID -BroadcastResetAllMsrBitmapWriteAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableRdtscExitingForClearingEventsAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores(PDEBUGGER_EVENT_OPTIONS BroadcastingOption); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastEnableRdpmcExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableRdpmcExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastSetExceptionBitmapAllCores(UINT64 ExceptionIndex); - -IMPORT_EXPORT_VMM VOID -BroadcastUnsetExceptionBitmapAllCores(UINT64 ExceptionIndex); - -IMPORT_EXPORT_VMM VOID -BroadcastResetExceptionBitmapAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastEnableMovControlRegisterExitingAllCores(PDEBUGGER_EVENT_OPTIONS BroadcastingOption); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableMovToControlRegistersExitingAllCores(PDEBUGGER_EVENT_OPTIONS BroadcastingOption); - -IMPORT_EXPORT_VMM VOID -BroadcastEnableMovDebugRegistersExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableMovDebugRegistersExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastSetExternalInterruptExitingAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastIoBitmapChangeAllCores(UINT64 Port); - -IMPORT_EXPORT_VMM VOID -BroadcastIoBitmapResetAllCores(); - -IMPORT_EXPORT_VMM VOID -BroadcastEnableMovToCr3ExitingOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableMovToCr3ExitingOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -BroadcastEnableEferSyscallEventsOnAllProcessors(); - -IMPORT_EXPORT_VMM VOID -BroadcastDisableEferSyscallEventsOnAllProcessors(); - - diff --git a/gengo/bind/sdkMerge/tmp/vars.go b/gengo/bind/sdkMerge/tmp/vars.go deleted file mode 100644 index 0919fd1b0..000000000 --- a/gengo/bind/sdkMerge/tmp/vars.go +++ /dev/null @@ -1 +0,0 @@ -package sdk From 4e02a5c1a38fbad9bf664b6a9e297de08ef38cdd Mon Sep 17 00:00:00 2001 From: Admin <2762713521@qq.com> Date: Fri, 21 Jun 2024 23:59:38 +0800 Subject: [PATCH 3/4] TestMergeHeader --- ...9cd6ba37a3d23a1daf6af984d0f8df2da70838.zip | Bin 0 -> 23926 bytes gengo/bind/sdk/HPRDBGCTRL.go.bak | 1634 +++++ gengo/bind/sdk/New Text Document.txt | 18 + gengo/bind/sdk/bind_test.go | 333 + gengo/bind/sdk/bug/CMakeLists.txt | 9 + gengo/bind/sdk/bug/bug.h | 121 + gengo/bind/sdk/bug/bug_test.go | 20 + gengo/bind/sdk/bug/tmp/bug.go | 95 + gengo/bind/sdk/combined_headers.h | 4213 ++++++++++++ gengo/bind/sdk/merged_headers.h | 6008 +++++++++++++++++ gengo/bind/sdk/tmp/vars.go | 1 + 11 files changed, 12452 insertions(+) create mode 100644 gengo/bind/sdk/93081c5cac5595c980312ec52e6ca8ce-d89cd6ba37a3d23a1daf6af984d0f8df2da70838.zip create mode 100644 gengo/bind/sdk/HPRDBGCTRL.go.bak create mode 100644 gengo/bind/sdk/New Text Document.txt create mode 100644 gengo/bind/sdk/bind_test.go create mode 100644 gengo/bind/sdk/bug/CMakeLists.txt create mode 100644 gengo/bind/sdk/bug/bug.h create mode 100644 gengo/bind/sdk/bug/bug_test.go create mode 100644 gengo/bind/sdk/bug/tmp/bug.go create mode 100644 gengo/bind/sdk/combined_headers.h create mode 100644 gengo/bind/sdk/merged_headers.h create mode 100644 gengo/bind/sdk/tmp/vars.go diff --git a/gengo/bind/sdk/93081c5cac5595c980312ec52e6ca8ce-d89cd6ba37a3d23a1daf6af984d0f8df2da70838.zip b/gengo/bind/sdk/93081c5cac5595c980312ec52e6ca8ce-d89cd6ba37a3d23a1daf6af984d0f8df2da70838.zip new file mode 100644 index 0000000000000000000000000000000000000000..07ed70073cabf232546bc2428665322f723c5eaf GIT binary patch literal 23926 zcmb@tW0NjSuq-;ZZQHi3HMVWr&)Bxt*tYFiW81bpbKkw=-17@gf9UAwi0-WD57iZ! zS&FitU@$=cGv2BfH2-(;eQzLT@BXe#pHd7{ZE>m+BQzK3$E>uVhwE(Md=<-^EzW5QwbddgC@5< zcRMLd@NC2FPb09F_4z5B@aqwQD*R>Za7hOQ zo3guD0fn@xF{bvOXs@y=$9Dw)3hNu|lSOZM!fJE{VdLA31?D#LWnG=cKuAk)WM71@ zJK!NH*!%e^zG|*3*T=Ra<83ytXX6d>&(B@BU_EW1r;Sq++$jM;v&g_maxC_`KGXdwNs0E+75*|eK zCgEBeKxbC-nwRL!=~|~+_bph4vaD{`_x0to2yCiJscIV!;Cd14bodZ)Jt5%#bCd4p zQ({uHu-PrcUbFD(l`7vXGbX7>t5&mkiNH8U@A1{tTt-n^ss4j}>>x~VL@X_ekPSuNI zC3|LgSK_*CAP-&9-Bl^I@zR&7c5zn3>GARvXUO(j-~ZeGmPV&9+o129t?@Z~)&&El z_V)J?j(lJz4}2c*yBQ|`LhIT&`;*Ks=s)9cI2-@q!^?mnxuIaF*5OY87L=5V58Zh# zqWPt&=~F8_{%y7y%(NB`65!ZK4yO44GI+ki<%@=-?*I*q(GqZHZUbcpyx(Pa&eVy7 zv}6C@W?8`9cN&r*Iuw+ojz|DHDG{Cnbf7wB)l4#YzCn+nKUUBQRMn!+tnpml+T-uP z+Ew#!(%nx~CFc*=&#Cz4c3{-+$6nn>4x~==JDfI`Xb4tYH#qoG_phP(Y{Iy{y4v32 z`M#^zl$*hVU*D8@F0uc4`3CWQOE;ASd6ooEeEc~pjD$-z<$xVipnD#k{97nR$7E&v z-@&+eMH5kyHP5io6*usU|>mzSHtY+*;`)3ygHCgR*TW!Mog~& z2(_&5XdYI?amaOtu`~zvsW#M~>-T+^9>t22*7&g%3gf;R|D@$iCB2*YG>66kL<$*S z%zyrk8kjzMFQ}@g&%d+tj|RKz6+4=R)<~a&ct!Ky?>%Sav{B$VjEm??GP4y4Obf!) z#={6&)$Y^q%bEEHTYX!OH&bQZI2F2Ydn1>M20R9iC;!mze{X#qy~cz*+;M}|0bK5# zm^HN~QC)Vi#elOnrK9Z+TP$x>#Z|43wvy1N)OvRp9XFL6`Px-ZPXBR=sb`YWroqW< z--pA9?S5!;2Bb)Ck}zzahCBmN-WqW@-a#I%7zLD;T@kH369d}fzU~}* zb3THQAfRWzA|cW1cbt#Iw@d{GCiUfBA(XB{*{JUjZK+Q#1lO36y&CeS5ljSgW9Uw@p@oxbDnHEs^%Q|7r;f?<8o1 zi^EUZdEMIBEz0dH14~9Yatj0@OiKA71plQzNp3gST0N`j>0XW)Os&ruc{FB}B@rHJ znt$(L#WLV|E@fTY-Q_p8{)1*zPGc8;PL~16d@9&~Ct9DuKuEIE-3z`(gh4h5^)KUb zf(PzfoX=-Cx^9HUobz%7Y{2wX1H^_>uScM^1R0xT_45a99U4Qp(brK+?9Jgsd}3n{ zHi|KU$n=Mw2$kQWA)VM}u}^<@=c6E4Eo`SIdRp%+65mha-ZC+vqkY(;;PwwTB}jDo z->*>3NPSaT*EZeRQZdS!55VVs(l!3TxiNGR6d?$f36fwLu1tP9VXcTF zWf_+}i@#PlJ6XzGUqD43SHH}#e(m8hjzptwIBH+S5r5^Gau1vFx*qf~c5~d?_5<+I z#DUTi5;G#z3~^&*o1w=JKQyN8HLwkXy@kMO08Kk>!BmWGxNc^dYg>mReG@mWSQnE`! zT$kU^nRG!`_l}O>XUG!}gs&85bC3Cf7KgX87wOr{VzP!a76}`tjvtasEGcE8x%(ckFzbHTEwMQ87Ee85LEQ8o|y5uuI+Oo{Y1_RMikq)Ao>x-eU> z-tQeCTYP?LEA1|f)w5TQL!)hb874A1Y9kKuH?ou6SbuK6u`5rG=*eL+U(3;qP*cn zR)#dhZb|P_8(sJ@IA?k%ULfT3#p7Wfr|SrMkS$~@@GaD#;AnZTE7dO^PZ*~%_bL^M>AfXaJ1oi% zS9YuE(!W>8euN@7m;=vQ3U@t{wjy^%%)SWO1({3(cZsvySiD%Ab_-Y|j(zVKj`#Y- zdat!*zDwh$hs6rOKr<^Zj@3k)5_Nn4ozg!DJ(enP9s3E?f1t{_AWm5~F+EoIpcd zuHaek5F0xHtxbm1gcC}&G4O)c7aR;<-iH%=i}^FOm$$f-zfr$R*kiZXLN=~OFoIClTUJd7&*SBr+2ODqFf0p4@7W!B zZ|jafTy6!KU-tyZ`VZKET_7zm3=xLMz_Yy@h3i1o170SMu<(+cn#^~J!@ID|^gdeX8AzPM*HDO%nXkT&hc{~t3l*ZvZ zmQcEEwz&W?hSbM@aq(?ek@k*t+6<1&m<>ml?AB}noU@YGFJsJ&v5ROaytUWWgb7cs zNCZ!M&|jvqd+s}gT*LP_V>4QH^j%yvOQ9u*B%Mnl<)jCIWt~2R-?X0Y+Lb94jw;p! z|G(-}KnksZgD}j)O$N>?uaf}!Sdr$(Cb8VpEWS3tJbB>Yxc@i-*YoSQzU-+zm)_uv zfU_;-1|7-P*SpMCe}8LI{370xmBT*cs!}0K8Do;6L+JP2K(~<8E5^i)Zv!OlHs8a$ zNgUUc`jz>KlO4X{^c20wkSviz@=KMlWIc9u+J63yWYO57TlSALx9Fl}ikD5J$+m=h z3V}=Cs?DLj`_uc=_4&Eg^%HM5#OM11rr6=>e?95;Gpz52R8Z zCuj-Wg;Ug<(~ffscZM9YC=|A zeLpLv5Fs@ALSO;{G*zKXHK{8i3wb#y%Oah5H~;Q-o=;pq=bC7QySBaRY02oH!~vW1 zqRN#AhQiOmMnzE99f$TkhxHqmoV?iH2Kui>x&?NJuyJ^?Yx`NSjExguZs-?Nmwn-9@q4no`HEws?@)73(Gj-`gBD~Zda{nxQM0{|r{2eQGXML41 z%w-*D5LSUBqy{0W3J4gqBlqJzEX7=k{m-?(wOP>muv)TQFKTxe7S4IIJ_fXz^#f-@ z)t#INYY9#InInW|=vLc2`k$Gz-wy=RZtza0kiZruv-^{f2=F|eXltB23*&E#k4RL6 zkoIqWhkD&KBM9*^Q=z}68DePuSUFnKojyL3WSHuQ+*opAa0(0Q6?)C}r_s)*5 zU#sX`1CEycO{%U>mVai{eKIsYYiitS>t0@4H>SHc#?(<>oT~_R#<;5yCEprn{puglLf|0!rWHs zc)XTt7WEyD)Y@h~)!Yxn-7bd>T0UMb*e{2N%(GOsdG0|W4(>pAmXI)1U?>y6oze>L`;khkV_$w|7=UQfce%XnV4excI+BXo#hA95n;%}F3I zhnLz@j6tz1U$@TlOI5S`?BDl|O#ki)w{KpYy~H@nY<-NuGnZ1bh z5KK)djq?fo;YK3L9|G*CGKNpp_($k+whVV2St;_D$r3)787F@`FrN^mZXVRBBym>2 z#&oA0b2X4n!^2;CY_fA3B$Df5L0r2{^4l-+CWJ6%22%kmtMS}^!2mEfl$}K5_mIak zRUv3{Gx>MVIDorXTqEuZ+^bS0M<`33E9y>bWM|*zIL;vmsd!F0_WdvAk4&dC+VlC> zlH&)JzwX6VH@jo_Ve$snBt*>xX&eD*iZ^nft$&P&Jt^bG`uABpfWIRXxkRk(4%5cHeotb_7joB@z8@WTq^o*(lTJ`0>=%9%^ zr{h}&fi?2IxV1b`ERfkO{i~6+aHn@w0_LkMZH3sC5$3@ifzJiz|Gv=>VKc-R1y%1g z#H(g^*KURQ)0HZ z-C-%{8vI-`JB+~C~IJHe@azudqrnV^8pOTYSL)H z;-8gimBrR(=7dnc7!x7Ce(AMocR*-_eaO#oyQVZ0E`Q=5#YU2~OO08?qoy7+bPu?a zsN&@CSaW!krQ(z|%{`rq=kQAI{xPYzb5l65OV-PN4Pie49VFgAPgDQ;H|I?!eVjhG zURtt;2PY2QO&5AUt=$Ia-G9Kh!J7J?lg7AjPwM3L)+{9vsAkd&E796e(;-Sv{g)n` zWYx>718IWz!6z(BuR+q{An8N>>=hQ zWZxND4}R!6c6x&qN#RpNB| zdmsL-82W30`3)T~dqfflj^zDUI%)2?_s6fWw~xJ7;rP|0>8ItxekET0z=vMVz)xWr zarhOr=||O%^Rn;w;Nk4CLhIM(dAl0mOSad|aY;xxbzAYle*gWa@+a~uuM$Ah3rMg0 z)%FK`UQJD3)!{%EsLK94Gdy}`x!}<(32d~ZsA*rgtM9n_;~-o_zR<0uOqs3(*f#?> zrU7}`zuio~=NZ4QEdY@3H~#4Nie*3EIgN zkE0r4^M!@o7=9aYuLNBGEjaGSBl;k~!oN3zzOH9I^=eePs3*sire87oV-y)P)dFG% zD~Bl^q6OhQhni5da2KF zNpS@W*bm=LDN3k zA~tBkbX&O4U*4=aVh5tzEH3-k1h6AJ;4ZuSJ-pFK94;tUIfSQtU&z5+|E66J!Kp>2K~nm?PqG|a|F^MNe$nP5dEpVUpoqDjnJxG#ZK3?awG+!1vf(&9QCZy=)yPj#nOXHxH@}b7JZH zBY(#!jEBC~h3Ot6Qw{eF_B9I)$kdu32y%FQf;9?D^z6XO1QRQIL_nab>u8ACJ_Z65 z&GP_8)axj6UoMXa4^ce?fH}#FF*oX86!;vL{#HCLP;IroLY0@xmyR59gt9w?!tgun zF7o`=B|D|#1nT$5qHjENyAN)hSq|z!fsN4FW?p3KO{|+Wv1ezcLKc z-mAx@;hciX>?Y}96$39=qsq_;7n*PC2iNV~85ADq&d88=S$i8gOVQ5VeaT>u;O9w$_U zl#1+uje^^*SXs;wENl47kv(vlz#tXc%mg@Dw1MO(`SSYyP)5pw4+xn>l~+rK3oqSD z@1Ys7YmnN94h--6Hwdnuu&1l!zt-;-M=1zT6 zV9+fAeHq)WqtdQIM$$pOx$=NF=5u}nX=3xz@{s)BStbV60H1J}FKFHAKN&4E*ob;` zBz4^awfp+aTGlh6`q zP)x6Ja6;Jooo95I!rdXL;G;NbNx|~TJgn;d&8*glI(~-SFwl{ee+NRKy}fv3S>{)< zMD>|LjkOm5Ea7~7JTnC`@|mtVWj$p0ptd`8JfIKgiuO%^n7ADFeZ+dWB1rJ4k*0C)@f-Iv^R94NNEG*9CWR-o#_>pW!fe43r*xL?L!q7obozDzv+AdFldOv^N1LO4H}`e ziH{^Ca}d9Jm1*M|WDItuBzLx#gq}DTycWtE+&AqAoAAogYV*{oWi8~8Y)6;L8^jV! zpdq_C4}EaVJ=9IXQ33H}?UE=oFb?wPb#P^;=U&k6e?j(7`^af-b&jfRwam;oC`u?N zu#1Vd)yNSwB0Z_)*Xv(*q~UZay>N6`?oxfxYBQNbr`(SRR2)hDp0ZY3g~$|GMWxHI zpGP`EVZ|AOjh%|ROR%avmJ7lFu34GfJk*_*tjuUrQ(}&ywZbBq^95&OL=B?rc1Fd? zeEjwY^ho3>-Svrc*<|0zOku%V1dt z0YI)gZ-`0n;%DyHp6Pf*Aa3uf$8&iNwB%#GP73R6`-Ew*bIE+-wNP&Ox91D-7_%nl z_JN$xmUO-8MsJ)Wxv1IlF(@uZALC4tc}W(N2FNRgECl630XIw{@x)QWX6M`rQ>;F5 zp#n(2$?Cg!4FK<@U}XMTK=5s^*tK<`e!yuh$DuVu0o^SaW|srxm_b%V6coG(|GNSg1pJF9wA*4pTfD!HH%2S2^OAP&!=NJfy?=)pJDC65{A`c z%!V7zGXs7~Zo{SrPR%2RZ5APej*yJ^Xx~p{+)*6$ z0f>?4EmjgtcDtyBj=TX=3Y0T4h|vBrFTs4)Z_GMu#ON>8&)L5`2J}QI=YkATOHJ zlYjETQln2J89RA~V(?T7$N%H$or^yVw(`+W2ZW}#t!I+yiBW~}SxHVU_znV5<) z#GEaPGG@KSB)FGFa5fHat>g;n$P=WuwDXK_O`|_<1X$P;|6^-tWY8|pE zWMjxt59;hi1PTidcrqWKv%`HS{&}y0iVwvKR<6kXkajolY>4#LeSo_v+Eqd_6EP_Z zqeVj@APA$?4hwkK*VzV_-stPn~YLlU4X?(K8wjKs^siU89bkvUr(d~7{c@~j} z1nb78o;*pLrR7B2Z*O14Jk=JsF?IC1XyL)z<(I&6syw(Z=Rq~_ch!Mkqg{N>ud{i; zzY3Qvn-X}DfUB(cem%TP5;Q(y#JcC3@;;5}?}WUYKR2$D|Lz&m^<9Tz_mb5QpOC}4 z+wRd3n6p7oJP|bwKW5Z?L5}I3^(++>DbP@q7Aa*!=_Yz+I|(X~ zS%l-BG`yimm4@J@SZo3#H$Ycz8oow|og81SXK!Z;{q;`s#*B9D)gSd>Fq^ z3rRtbZr?R}Rs|XAR-x~N-cXV?K^~P&mS{0|ykezZ4bO|#1F=(|xyeiDFVs=qQLQ_v zdQ(!vco|I5Qpy-vX6yzAZJg7Vd@+~|gIrNT+ujZ6Kx;Wb9&Y(m z{G|Kt|eng2NkE{!6 zotH63AOR-jXr5|JlNlFqo**om|8up<2bGCAou!(T)xrgIIA*(d>buUCkhjd&-Bc>` zi0YuOUU3&$e@==0hO&xa2DIHaS6a>64Yi=lOV#x+{_4%p2WvX-DX{-6fKa@s3@9a* zi4`}+TvHC^9|%kv6H#>;J3hKIjU=iU6yj3a@=el+S25ciReNt>113DQ^2UBIK_PcQXJs|cGz zQp&xNnVSSDu#}6V$0`+eCo!7@apW3XFa2+Rlnesj4I3&DS_*jye1X|e2z@}?1Q9PW zPCi5y3P{PWI$3;ROUe=af!NgH;p14ZOOdy$HX3eOKULl}1^^aykc&HLlvVL;kqtE< z!U6$c^D0^3n2ECNMi`BapSE?2F8=#f^YN^x_NM*r%9U#ZkM2t@st6r>3t6tg+$ek5 zkuEctQdaNDIf%IE_Z**7-}D5GqHW<#Ygk&4_Gu3DK*}Lmho&N}{`(vs1wsldb_L26 z_YXOoh1QFh*e&B%r5QMdFeqLI>L-PDS9(K_hF9(WjqhrAA@!To=HnB6Ag65n4G;v6 zPyC=w*WEf6R2^FrjQXwx8niQ|zDP`GW5luQJe|Yxl7<$YS`Nt8mIpiH?a{1Aa0n}z zW?N|=Z=Rxp;=*s(znQ@Atdr7{0cNYpG8bH zfPOgM#ZoCAoFvfx(_#`eGQbUCvDQ8`n=;2H$CZ~||4B26n|nyCa10$s9U_c+4%A%6 zA9JJ$UcT-G%m%XIsK$50GEviwE>vJv<}aSAJDaWdWQBQe`(a@E?-o<*A&;wN*iQOb zH~{=Z!M@0$ICU)ic*aw{2k6qd%A-g2xFJWv$t#c6E<9Jqqv-rr4f(AyXBXBipiLV4 zPCgCw4{T;;XBT~REw&Zs0G0l|;60dwN*i>m*5?Ce=O$R9+`U2g=Rp^9560}5JBn;$ zMQdLs;C41*g;s&grp?y6e&SGHfkc>YP(aPW#3hEBmrRh(4L^s*4&p2YVTgv|nvvR; zV4!j3%9Hlv6OBuM?0mbH#a+q#Ij-$ab)i=9Yafx9*b5d~8j;pGpO=~I*acau=G7F& zmeI*bdRn+{b;ZEyP|a9lD?8COF@5t52}3VQk@-+HLDi#7vVKiwEe1qR}k(<(hQAlcJ8AHW_&lHU6nj))7g;z)RsC%D5HVDTX|J;Kt zmo1dD*c>mNeNL36Z^_o-ZS5pbT201CAjwfffrrycRFl~y? z_By^INZrBqt9FzBsN(|9(yUN4`9UGGLe&w8c^Q zsOsG!6sT1Gk^vKRsSt0t@ihmdSPCh4cU!{LQv$yQpVAg%K> z(){Z45M!wq$nuh0=e<&a4>-m>4fU2(@Trd}tjdvMg@#ie(<44fT?*fZQcRNENwSVK zfYYxYYFAy-Ay5%+KEP~&>^&tN92YokGNQPV{VS5fbkfcYUJ5&ZU%M@XRgW!%bySm7ey9_k*PWKN; zVX+tLP}NmWg5TAxk~M!G0W_+VZ``X#3A1t1+p~yWOjqJI`IuE>)E!*M0g?8%*!39$ z#AtPa|;PaZh;HJA-GJtse3top>KYyqtPU?nO|#xx5t)qJUIySfMzyC8JDBy?d~*((YUrc^7dE-2m<2>=T-bWNP0JvKCdot|sbd3Qfb+ z>K>_2x*El!s)&C#Q*0aWtT& zeAeySY)vO;X(k9OUYQIy2zT$SMFD%Ei0nF6W^VwrNAFXY-5|6#!jvQ^@ZQ3H8Mz>~ z8(T~t?fub)FScjs7B3MRXZk+gDk0^PO3?;}QLI5ntCrQfQm26y?#wA#5s%5n0y|SH z_>|95s4ZLb0bf_M9gkC!WT|vOq1?Db_14jGsL5@Ace$2o?kyA#I{SCs(}Q39ong>4V6448snUW0sr&%sjjd~o-k#z14$)1z^+N)6Mdo0`xLju~y+ z+&IW|Nd9>61yX%_mBU&U({WXA$v{`J!2 z)TZz2T)-pvPS)oj%s=c(fV1`unr94mBwg7MR!+b`+V<<Mny<8Q9yCJTR-(sH$KCWL{fP$GFa)FZbho`AoH~L_-eF4>ZDt3bcwK1JT8o= z)N6qlQbK_^AnG&cF%Iz$Q+Um2iTrq6W_dD1`juT1O?i}S&WU~kms)boYhkOJcza^t zFLd>npJQENVKzv|1lTLgQy=()33SO(z$9D))skO1fKogLQjF=@PI6oO}PFq~fxqtY; zWex6&auQx@J%XSb8O(Z0Aqn0|IM~HfnShO`J|L(9p(eX?CK=Dl+~*vrzxOtE8q=te z%OwsKEfOtE)Q5P6tfGkin06GZ4ts7Qds4Qf)3`wL#6BExJz!+q z_@N3a>y|!@at{5y1m6L5**U~t`1`9|CV~_C)nh357u;!B-k&4?XX&C_833D` zi=Zr6uj15{4w{+^BIQm6)gm&9^x-3UCFvCW6o)^wo57yvtTYJq3d<`m1dSFKtrW4A zO{o7nnDyNnIYt9_6P$@yhW+qay=Gz1O0p|^)}t;GaO-d6cc!`E25tlUqqC;-cU2mm zzJu;@$Oqu98~8TXVxajAGp5%Ei9yz;iu@I-CkXQq{9o!Vy7VQMhXER-FX84Dco#RC zeDNf)zUbV)=`)Q;lv*DkWV@?>@#zLB|7sdDCa`40Z1Xfx1V`QLKdEBP`ou+K#7uu^ zo`5GBjv8}-!flA*mW7!rcvBxu0sEwDuL(k_KLjUo1*VjXnZq8A5AAR9#`7k=po=XKKWp&D3r;Z@>usgQ&~)1z;ESNuGN0`p zS4ftO1AUd*e0{PBU2#U4b$?Y2w2&5Y>OKbrx5l=6#MT`kXWNg*=!67-v&U%f1{UP%=E${}{fS6HM__!o)K5OZI=BJ! zA6e}K&1m(1EP|?+vFU%>D!ldXIVjjP&Hj8@BqV)a{l|i+k1CXXC5K26+C0Su@9aYQ z&PlliOMW=G(t+=sqJ{T;DvcwdeybAmvgDg(J#gDSw4#-#B_N>+E6t}NPLAbS97Yz? z*F0BJmTKRlFh_|sAND&*Nf5bbQ504Tq7|-}e(Yt>s8#Kc$KYXrWT3CjpOWUSR;HCm z;H=oMFeN)rzHCku1f-n^8!Nw14aD#7()+bTr8Zz|NY&RIxWm#T1lT*o$001JxFwi3 z#>l4k(?e<4l3&$KR;{POgl2!5I8hem6|YG$*A7`6MzGi``3m>I^Z^WYH1<`Ma0F&RJuc{EP zuU|w(xqqg6G<3Yk9(uLBT6`E?iV|7VR2|{4XIpuE0DalqnL#sxo6rY|x1q^hl=%#UCAJY?&+-X>52r>Y$@SI<3~=g(J3YnEAy|x#RY2!Vh}A5z zCs5z~TH|h{Br%-2VV}`LDG_04NNXea@>B0~1%xFY$fjL+iuzcfvt(aM5))NT7yg-> z)$+gqK9#CPT(>3ul5oZMzgwe!q)3X_OCrB~3)_Ga10K=vzEcU@$Ko^qdrxYL53pku zQS0}pYgU}#@UU}RPhH<*_?0&Yx?en z$a>K6*ROy}ogoX23!+b-v^Rh)s+jqOg~u!;{G}{dk+-Q}4857iE#tVZctHpM*Qw7` zm^@&E8FVcyFw*`_IQBr;xReU}IBSzqm1JkK z$U7*EK|=ho-wa8igsz9_VJyM+nPh$_tZep>vi!7yZTuvMsZ*JLNng1leuPYul}H1B z8r9XE88XF;b4cSIwcms@PcYFVFTeItD<9MEi&-%#ur0z1>|UH{5B_=hkkay0%U9es z6n^e_xHje*)zt-k00PX1>HfWR(gk|~9|K2@U+yHeNOlrT0QA&)tHMN^-XeyD(6Kt^ z2Q|g{n$83Nfm5UnZK^?xv&ZO*8{$X%u`@8bry|}+SnD>y4x<8ACRxgciUGF!cQ_qF71Dbp?qbvKN zFUE}{@;go0Hcb0(<6|@(53W|Ma+48cM{`mAX{A4M-a`(UC;<=2hq|yEzk=|7 zd%VkJ4^Q7@K%}UO~mL9_X-the2r*_+B}%Mj(m#WV(mznat56c&2{rXpZz0>WyH z5}Aa`A-oTzu&oosR{6Pc*_KD|X74WyMJCx88jghjcF=<^6guyORmOL9z9yCM>}?dJ z!oIoJo#rZn@0O)$fQ#N6(xIsKUKgRBx7xUH{`(dflEJynJ!eyo zvK{G9dE=1jS1qzWp19(&9Jm9Ko0~qcZxDX7x_+7xt&T?!UYR{8pmcd zcFH_Dq%Lf^5!0C47v;(+geRiB8-}N7o03?KKV=)&@?TE{-PGq{+70V^+`+#s5ln9^ z&U1@=w`Vh*L^*|Rs^GamSSJfgI$AQ0 zrxH0en}l#B1UERuf1kI3oDPJ8TDpkita%Pef4Z2R!+YW!la}+&H}+3S{7&gh(Y(&H z&zMOvBM=zwJT$Y+G;B{rNSwJX{i1Daq!LRnc%&`RX6&XG z1Q#}8HZS-~HaAY`tZ1J`hfqr1E#KB~n|k z#2lN(8yYU{d0@1n8JY9@*Hc#q?JStN;n*JJZgS3D14y6sWV)m>G-XY-b_< zPy+>h6qN37Plf<7_kg53A>9$Y4p<;&010~)p6Bl*D+I`%I>1!+3o^l3;8IdP0v(1X zz;FNk6Fn~Z7bg2-)Nh8Ux2v=(sxK3VE!>9}p{KHNTso}AMM%Ei{ zC{X-|vIr?ua3d&EWXwi`vqYfyw%hN)Nx|-dLVsb}qOrb=>Sm9AR&%8=>28d+_WaMK zVXJ6J*2xe*hvGf5<_>p8%RYFc6keXg&au-fcr}~DGkKM$s{tAY=bw2BU+7pn@{_JU zbK{3`mZ=l&+q^Tryr)zMKDI<4U>txDJO$|)3>ED>(7kLe@hMBy)qLB2pgv+1$M~Ok zw2ccdbV~4g$sleyOv^A~J#ij27)C4l>V`Dild3Q7z<=}7i4KB6L7n~7T4e4#Hc%8< zocgVQ>sQE*ZI|rQJE?4f3tkWP02^8>hC4_spdylWfqkG*e*}OxU}F;$j1Qd-v3!Zi zs2?~-0Ga*kAxfK>J@ev4op*L?OPNZW+5>FwB>1&gBd(MG=QiN$GPM7mbi$Srr-(su zOgogk7nP||Etea&apTYG-1B{CD$*3)x}nHXjXbf_d}v;54IZHccuNWRMzVSj=YG6A zA-#)*F7xQplM+C#Jq%F|;e@_$uZ|3C5spWE#Sxt(r* zLdywsS#k~$kb-uR={JB2pKD^tsX!T97V@DOKVig4VSB$bEqGG;XL6s?KJxxr^KyXk z6;$|Jw?De5?LQC(#SDXrU_<6L=|*95K(+llq$9O_;tnC7&J;g_iLPHtQ;ENxASNCQ z2ttHMm|)MY)X9fS zsymSF z`1fWV%f!Y8NKb$6Gh}RCgB4~{TXRZ%qySCV^}@*rho!8VS-1=qIiZgi{Ano4`KPSG zTJq|REPJW=ByVAW8Uy!SA^t80^5>7~lh>49Y{ZoOJ+WP@iW6RnI*3x_m@HaXA?_jj z7dAhrce)567y-CpnMh2otvP?gb^mDQk~(n_L~`07IoJc~ghz*cNGR>(1uBg+jWtF_ zW0H}olPb|2K>+k~pr7O2?!OU9@8^OdcF~&PU6O*0K(~&Qfl3>KZm$tKD08s?q%1n8 z)ikglx+$-@tl4iXpzLHQ@9kHTC(gPwseHl@w|9_L=HAvBXl?NHG}Ta%#Ei8W zi5w_(hy(F;MT5x#8E{T1{#|-zajWxgp((OXXkW8PT(aw~p5jy~_L+#6h0OfWBt77sU}tIQvTlE*8$H znzn8uLymo6ioSP47rl4zZCbbp&%0KW)H^1YsWgXZUXJ%mQZ8kASj4q>%$rAlv`bNX z!~p`l&yQIZ&JL|FD%Yh<5ryum_BI+@lN+V&WwwG$x`!--n#<&1f6S2SYJN9MpeIfC z{%fAFnwhT38*5Y=0V3_d%ULzD#$?Di_%a-!T2zk|0rYFd?b*`9x%{_p!8_qofTFjr$@`*BiY`Q)@0}5%kZt0zHD+(cBMCm(~ zo_eOeF$G92s;SkFC1O zLXV6iKcGO>!X?TkrE;38B;$`DR~ebYw(p>)x;icXXirJ~n>T+2av|AM1u9#&(jFlH z8>hY$-OvBrmoQNn!`XBf9OiPbkTL`kL?gYtg8U54nVz}&977{WV&KE~aPdgt%aT!sv?xyf)f+^TG)TmIVZ+=`mvbT|+Yrw?$$BE6i_=XI( zYUZY`57*ARDtCMfWg+s~{A`}!_Y<}WxyMzkx&m6>arfM45(9DI%euOshp8oy3Ki4L z9DaE5C~@e(wS9$fKJdrIi^d$^q~!T0oDJWUhqxRr^zIFAtM79b8Sl0Z@12HBBH!ZG zuq9GHX@M~a*nPBOary4ZZI}mjFMea4VUZT8mhBAbckj;1(qii_@}_>(MCIByJRXx} zVeW`MU3rwY+`*S@;ghYv_I&yfo%xy8HZjxq^QTI$Mc<8ly&Au?Mf8a{yU6my{@Gsg zOaUAfg@Pcc>ROpjaX_~TH7Oku`Rbj2vTjn|ccmSEGKuQF*VRm0SiBfLd?}NBdxH7* z*Z~h&`9K^le&d;YUS~Sv$*~tR2_weZ;Q-ooEQNSba+at!3pRsn^lV_6Oi?F=jAU~+_kKr)J?X>_*ilR!_vt+jm)xrqF9#8R5KX$QhzS?rHR3Z_#BhDg5= zM?v5Ur@{|vYgfm++qzy9^2j{3v(d$lNc|WRl-0CSdi_CzPVUG=@GA$je!#~&fSha! zZ!OIdy>&p-ni))zAamSrPGEg6OmOaCF|LwleDSSWa1Re5#E)py1DXQ|c29^|p_;t@ z$m8Kq4)-~o%GJ!(7VTa{5mzH=tO@L?X+84LMv-kj|IIAyw00@m9kO`7DgR{}Ek^%2 zE}1UX-6m3Uw=gw;vHdtI=q-+al(w{oaEEUF_ag&q*~?3fy(5XE$S3smvInu5zk?(5 zN2Y0aE>_CPbE1+oMc0DgIOQ$2yK$xUcIX9&(w10ZPJ=hkev6x2hmD;MSoeqY;Z*&bB$~ji z@>|Cf`J&xM^mMW34~#y}z*VtTcNa_drw?dejjR;2JT37r?ei(wZk=Nab6v8dkelmkY+TSL<@ay5 zpsv3OhLc+S`tkGs0wo_<>tR|s{G)~zxzR( z;Q2AdL8`3L#eq8Io!T;CeNAL~6GKL6l7@FY0GXAeMLwV9vXS(@XJ%aW@g4p!qGBvSI?WK!KjpM+4kVOhp z?2-9utjxOWT8To5wNZh1|FIC5s?Y)|kI2XHCu__}=AVv;KN+PCyTh*}>xqH!dM)4y;wYPu&B$L=D(-2&g^GF18 zAOU9LZW^^K)rH6$liRG9i(`E~q?3opdk8A;t5e+tP3g-x7LV$!U6zjiox+0S zSpGS<78{#k;xLR|Fco+|4p+{C8Yw)?mQ5We>8)WfFkaf~tyLeLb!eUQ!ig1>+XY*O zE>GwuXlJz)NF^Qb_$3kOs(&_vM}iNE!ANA(yVbUuuwct9Z$sFbE{l>U_#)UdBfW@q zypHy3ydrW$CysJdy<9ZgPlb55lnhm+FDTlCW%r@sv#v;3Y!qtR8oUG{xd7jPZ=Sao z)H=nQ^f_Corh#7fY#-+EF9~|5vsas0e}$A3dkit(_psY=YlMr57Uinbe?2oZOUZHY zZG2m)XQb3jI5Bpu3Pc8yQ^h-$^dG8`JCyunotMi2EaKO|+Ei4lO2E1muUXC^(w3=2 z8Mxl@nicXTEUFPDci&>=FCuY6|W=+$^a@kS-uW90bY7OB)-i1#Pzl@vbg6P)_AmI*A8w5Pr zY86Pn%|r7zm8vfi=fHsUn%O>cTpZ#K{GXg#nE$ z_tp}y6fTpwv)Hmkpc{jX(Z!wgYmPy;Q*Q9-E7|lf&yV*Z7`Ht1#$?YLQX1axQAM=F zFw7~^l>r1?X{7UTQ55Qjd)f6-DKCv_{}NgAk5v~jbS&CP(z~P&GQj|2pu~6b3i0y% z72cclOD416dppluW0RId?DqJ#3oglFlgOo`DvsC_8A{cryG<_MwuOujLx)P??V zhr^+LW%%&;p>|t#0kY)k+c6Zy<8xZ8)mRk8od$`J7leJz;~My7{y0G-JHSH2%^ZQ} zjePiDG2q9vi)VqTG~Xuy?A}E-)IzYbv*oU9_|~)L60KK4lM0s(B6+qNxiB+K6w^bc zQ8@b33o=Zq1O2nACB_g@*LPx=r3Nbb2-MMj-Df4jL*I;E ziIfUj#^$ywQX9R^xRE1`c9>87#T?z;dVGMnH|)SKw01qKULGdBcJaHTY%lJ-!L~m@ z+)%9A-L~~9YFxd?UwQc?Yu!R6HgCpOeQi}2Iy zqkin}?XcM;>+(Qix6Y&PwyqrS^nG~5pk$-X2^d>Rj3_IF9qWt05Y~=>m*P=`D&;l< za_Y;KZwiZt>F4h{{0PUOw+zo2sf`Ww$E=fnp}M-A`I-F~%Sm0_7jA$EUiN!$Qxe(_ zf(IYLYrjPqC*V3~_^UKS`7V>GhOm!u?JjMzAyLv$-Nzna1sF;Kje1cpYCLDn79fO{ zD3Ylxqt5JBi?7Nd(S#{oIJa0{1D4%q5oxdb zahoAa&tu>47a{`GEvbrvN+MUp;a-w1cx?H#vY?B00f1x)AYHQPO7dAL|5u?MImbwo zwep~$L>H8m;Y0C3RA%L21}O#pR;&VC2UvthP}frG1bEIFaB_&>j7BSb#On&Uel?v3 zD_PF_687|tYulWIoxCRqM}I$V`q;FI3i|$)(dV6~yDu7N)^75jPGn8eO#B<)QxcL( z8p(Dw(-n5V&A{|ZiWH>ReI6}>IqtJ`btZ%2rGF^9>gt@jc5JAxS1w0eZqyi8lb~`c zJCcob!RE)aQPXnLD3O8F>kTJEKCjwVJpcZA81cZEPcvoG(lqV9h$efqLuFnP!R2@H z;&d+0J(Qbt(qw^Xn;3DX@$J?)Pw=y+<_+6c$x$ximMlyJoJ=Eh|9o$#d-ph*sz^B| z2Pd^vA{I}?2>K!UKIOS;A5lMH6*iIZ&!N?RXm$=g{v-1cgo4(+wsgb;{uP>t*6SZY zi0UA)`A!jPC2%0o7bHI&hxppRAGjmux^e9ECzGCHk0_&if>VFE<=_(#*leV3V+lm%N~!bWMPvOFt4BxNUDfL1Z|KXqm80p(+6;|x_YW@? zeZs7tBz_5EixdlPzHyOf#i20oITqlnRYjv^pSSs#3eeZwwWw#;<>gV4A;wbKCT)~q z+>UX!%`OFCX|Zgh>jY8T-fX;SAE36Eh^;nqcuW0SO7K(P{&oZHs$mN2`+Pk(n=*w{6wu#JH@oU*?nPmV3z!O_}tzeg#ed~CE%Ck7TK?8%FS>+F& z_7v+B)JFGrKQ#CGeeoG1cuQ)h+R^BJ0t-rMyozq2g@is6Pr@dPc6_JC?_G~oI_oJ& zcp1j>iZ+***c&b7HRSxM20yXf#dBN$+KEQVLzI*0&vdrD7)Zrwu~aGbqyurg=wAf1 zXkC82!Lwd4hQ`o5UWHoZu~U4C++$pS&!`L7mp})otYx)aB(c9uwgF@&4YEqH3ElZ;Ew6>C8cDhql5ncJ@~RE4yCdQDE1jui% zVB>aHmzK1)UEH`?Utwu~c=Q&C)Q!nI-o|yTT+j1sGh`6L;*OUI_}co>X58N%McBUK zc;9l`-s}_hTi8wSY}D(aXGi%F+4Nf4ngAl)yTSI|H4aP3t<>gZ+mCb4W_pPd3C2f= z5B|+ZtPb-Y9kR~}&diXbp(%GHL^Kp*O5kVb=ZrBbZKEPk=Np$5=e64E&~t4&)|MDj z;JxX${a_rtZ1*M_QLl3gPVdTcadlT-Q2dJ3u;KyC_FQ$H4+_UkRgxR0NefYSK1%e7 zk;wcdZbK!0tU4BHrsK{e{!yRzgDj!LW}|DtGoEdsH4b)sILfq#`b3In>cyH_{-Xo< zD^uC7*86AwzIw^+Om6-#|i@%>tf(OpcJS7Ezzktb?E#^EroyW3*e;?Vg>PuBC zU5a>U-+Xl-dy?ovPjQ~vd3R;P)qSK_eQ9-2v!oX`c;l|FjsoH9hLn#zx4iA8?Eh59 z-qHm17KIzPPZZM1?$v7xf{qBr#uWi+=+9sL&z9Vz!aISzKWVAXzED5~CBdi834ykx z8g}j5fLL9a?9u2U_Fh1DDF*i`A{TO{SITL6JSM(5&!TedrOO9SmmtsJ|9l9zi%R51 zgY84!a*Lx}-RaJjeVKygVfnmnrn)843_wYmR}kgPdY&Y4y%f{&S-Wg;!x+x)>MIjo zH#%~PEhV56%O81eFRUA78~D4+B}YX0oXksJV%oYQle@UO)0-#~n3_r3+~oA{g5zt| zabBBk4?tx-KVhWw$h&NGd9ULy9KZ18eyaOGaCw143NnINLgVj0$%5UwYou0i2p5xL zJXXAg2yzNV$WfCSZ~hF<6azHGuPSp#4u&Rx^bJSANIB2>ulME&V(<|Omr?r2F3 zurSDQ=O;I*%Pgs#tQN$@{TRHyS*>T<; z{}bmDiL*;mv+H(5_i%kuyu}3g<=e)vq`hSoQ`kOmS&Xj=hkvClD*;)prdn|bqBo3u zDqbs&dsUkS|Cbl~w%-;-Q4D%Dm2dpIolIKgZSw*}5+y_9=?smimMPU;Jsz|$8p(<_2ZxZ*NXibZLs4c^9cop@&V)~dT*;W4$ zB}9=lG68Q}a!C`{9PKsvrHf@Q{?oqU(?;G*V+SskpOt}n^%1{?KY?{$Zh%JL%e!w( zTbjCkd(9 zQnSUuk|(MI<7N|=A7ZQLJAWFu#5+6*#147$I9}Y1T;nJN2%1}&kSw;Gonhzut#*rS zxV(XBompNzH6CfwQ6=2nV!WFZYDxQeyV30H=yz=7q(h^?IAS%%Xm88-6gefgj~p|^ zXg1$ueKk45Tdv(vNj*(UknzXAnlwf{xQZFXPVIt>d{wBRJcmtykiycD%UpLVqO{}b zSxG;YWZd>4t$PavEw%CcxJ=QFCVQQs*_|Y{rUm{v!@7ALf`6y%M;jCOW4;pg5!rSU z+m+m!D@h)?5bq{FY!v0#c}sG%+raiW&I(9Apf39U;xv3O*Oy2$e&gX>Az`n__KB$@ zF@8@#&PrMH%i$JpW<$?mher01{}7pbpPlJSOIuEl=(SR}`hAd%=7;XyhCPZjwP}(O zx>FpJc`d6VdwgOw<+#?A1AOY{^f?k@RP?Vrwk>!&-H5LYI46NOcEcEosX&j*xniQ; z>j6S<398HI(2g@8|Dt<0euNv^HzT1g@l}$O;PIUE6*n+)rQav^bqoWwu*C9alVM0= zm930cDKYAA3?47_(ZRuenq@~Scx@)OLx8Oza{lu_H$}a4<5S#J3^iyKW~sh zz+cHNp;x^X0yh(G%p<8}VfvaIFcYn8IQQiOPQh+%nwe6|zq!%sjYaBi<}q9DsS-Hu zzq|d{jHXgi@nU7KVG#;Mo%!g>ULT>r?=Idt9b|`atFS}?kX4HOh#~W10A|Y5Esa&< z+|A{26r-2BZaJaA_e{=Bg6s=FDRKpUs8ZxlGx8K)N~IQ@~D({)+Omc;8bw zxrjv@uDlVP1Yo_+J|?u{ZJ8}jmO{TxRVr{`wS;hwZOP|SC3#&<;b!RfW*^rB^xo#^ z`8b>$>(zRVogdD{eW%y++^B526UVuR_@0PzzgisUjoRiPSJKYdnZ5X$?F0`{Gp-f= z`4lyUN7!=F8GO!uL03rgp&J=0dfF7?^qt>Z1Z+j~QCCmBKQ6cUK~u-H&m(4&9@v%f znQB5RgjkXZrAB~-TDoTI@J$RYBL)<7OJ6N`zfMSbv;3dnl2c6nw?Y%$CyBpQebIws zNroW7LaI>&J2|W0Tj5CG#;nzG11z(tVH7d4Q5yyC%QVP&FQQI7%_{s-l!tj|f~1uC z?Fmc=!S!{Yd2b~!uCDVdXO7oHqWs|s!k=WAKkez0XsXs?ex0PiwD`&*Hv@_kBd-@n zD-6DH=9phOa z@QE>tdn9TaecQQJ&yf2{BW}Ct#%uA94b+_>e}Vz<_bQgJ7KS)Rhx4v2waVFA9ra!J zYUzZ|{%RNg`^@iR`OTr<1Fy6NY2hKOSE*i4-+K02Q*0w-J~axBSFyF++5}u83fieAM1i%rd+xKZPg}R*Q#V1-PtK3PF@7fBPa5Yiy?ea(gOBh^b9 zVBd>6p6JULab(4er}tsg!?LLWi_%|gvs~rnMGOAtxp{leOkr-}+lX*>n@DB$tewkw zCC7uQ;lgtqBtHe^`lJfqv6Q+9ChP`CQv-;7-I*0IU`fdx=JKW^YgR2nSG=4wZhZMC zW@VaSGKJ)O9yjpA@{6%%PUFRto=K3uoewv3`qvvP8S9;^PP-R!4He{9NJ#&CO89>R zh7= '0') ? (__DATE__[4]) : '0') +#define BUILD_DAY_CH1 (__DATE__[5]) + +// +// Example of __TIME__ string: "21:06:19" +// 01234567 + +#define BUILD_HOUR_CH0 (__TIME__[0]) +#define BUILD_HOUR_CH1 (__TIME__[1]) + +#define BUILD_MIN_CH0 (__TIME__[3]) +#define BUILD_MIN_CH1 (__TIME__[4]) + +#define BUILD_SEC_CH0 (__TIME__[6]) +#define BUILD_SEC_CH1 (__TIME__[7]) + +#if VERSION_MAJOR > 100 + +# define VERSION_MAJOR_INIT \ + ((VERSION_MAJOR / 100) + '0'), \ + (((VERSION_MAJOR % 100) / 10) + '0'), \ + ((VERSION_MAJOR % 10) + '0') + +#elif VERSION_MAJOR > 10 + +# define VERSION_MAJOR_INIT \ + ((VERSION_MAJOR / 10) + '0'), \ + ((VERSION_MAJOR % 10) + '0') + +#else + +# define VERSION_MAJOR_INIT \ + (VERSION_MAJOR + '0') + +#endif + +#if VERSION_MINOR > 100 + +# define VERSION_MINOR_INIT \ + ((VERSION_MINOR / 100) + '0'), \ + (((VERSION_MINOR % 100) / 10) + '0'), \ + ((VERSION_MINOR % 10) + '0') + +#elif VERSION_MINOR > 10 + +# define VERSION_MINOR_INIT \ + ((VERSION_MINOR / 10) + '0'), \ + ((VERSION_MINOR % 10) + '0') + +#else + +# define VERSION_MINOR_INIT \ + (VERSION_MINOR + '0') + +#endif + +#if VERSION_PATCH > 100 + +# define VERSION_PATCH_INIT \ + ((VERSION_PATCH / 100) + '0'), \ + (((VERSION_PATCH % 100) / 10) + '0'), \ + ((VERSION_PATCH % 10) + '0') + +#elif VERSION_PATCH > 10 + +# define VERSION_PATCH_INIT \ + ((VERSION_PATCH / 10) + '0'), \ + ((VERSION_PATCH % 10) + '0') + +#else + +# define VERSION_PATCH_INIT \ + (VERSION_PATCH + '0') + +#endif + +#ifndef HYPERDBG_KERNEL_MODE + +const unsigned char BuildDateTime[] = { + BUILD_YEAR_CH0, + BUILD_YEAR_CH1, + BUILD_YEAR_CH2, + BUILD_YEAR_CH3, + '-', + BUILD_MONTH_CH0, + BUILD_MONTH_CH1, + '-', + BUILD_DAY_CH0, + BUILD_DAY_CH1, + ' ', + BUILD_HOUR_CH0, + BUILD_HOUR_CH1, + ':', + BUILD_MIN_CH0, + BUILD_MIN_CH1, + ':', + BUILD_SEC_CH0, + BUILD_SEC_CH1, + + '\0'}; + +const unsigned char CompleteVersion[] = { + 'v', + VERSION_MAJOR_INIT, + '.', + VERSION_MINOR_INIT, + '.', + VERSION_PATCH_INIT, + '\0'}; + +const unsigned char BuildVersion[] = { + BUILD_YEAR_CH0, + BUILD_YEAR_CH1, + BUILD_YEAR_CH2, + BUILD_YEAR_CH3, + BUILD_MONTH_CH0, + BUILD_MONTH_CH1, + BUILD_DAY_CH0, + BUILD_DAY_CH1, + '.', + BUILD_HOUR_CH0, + BUILD_HOUR_CH1, + BUILD_MIN_CH0, + BUILD_MIN_CH1, + + '\0'}; + +const unsigned char BuildSignature[] = { + VERSION_MAJOR_INIT, + '.', + VERSION_MINOR_INIT, + '.', + VERSION_PATCH_INIT, + '-', + BUILD_YEAR_CH0, + BUILD_YEAR_CH1, + BUILD_YEAR_CH2, + BUILD_YEAR_CH3, + BUILD_MONTH_CH0, + BUILD_MONTH_CH1, + BUILD_DAY_CH0, + BUILD_DAY_CH1, + '.', + BUILD_HOUR_CH0, + BUILD_HOUR_CH1, + BUILD_MIN_CH0, + BUILD_MIN_CH1, + + '\0'}; + +#endif // SCRIPT_ENGINE_KERNEL_MODE + +////////////////////////////////////////////////// +// Message Tracing // +////////////////////////////////////////////////// + +/** + * @brief Default buffer count of packets for message tracing + * @details number of packets storage for regular buffers + */ +#define MaximumPacketsCapacity 1000 + +/** + * @brief Default buffer count of packets for message tracing + * @details number of packets storage for priority buffers + */ +#define MaximumPacketsCapacityPriority 50 + +/** + * @brief Size of normal OS (processor) pages + */ +#define NORMAL_PAGE_SIZE 4096 // PAGE_SIZE + +/** + * @brief Size of each packet + */ +#define PacketChunkSize NORMAL_PAGE_SIZE + +/** + * @brief size of user-mode buffer + * @details Because of operation code at the start of the + * buffer + 1 for null-termminating + * + */ +#define UsermodeBufferSize sizeof(UINT32) + PacketChunkSize + 1 + +/** + * @brief size of buffer for serial + * @details the maximum packet size for sending over serial + * + */ +#define MaxSerialPacketSize 10 * NORMAL_PAGE_SIZE + +/** + * @brief Final storage size of message tracing + * + */ +#define LogBufferSize \ + MaximumPacketsCapacity *(PacketChunkSize + sizeof(BUFFER_HEADER)) + +/** + * @brief Final storage size of message tracing + * + */ +#define LogBufferSizePriority \ + MaximumPacketsCapacityPriority *(PacketChunkSize + sizeof(BUFFER_HEADER)) + +/** + * @brief limitation of Windows DbgPrint message size + * @details currently is not functional + * + */ +#define DbgPrintLimitation 512 + +/** + * @brief The seeds that user-mode codes use as the starter + * of their events' tag + * + */ +#define DebuggerEventTagStartSeed 0x1000000 + +/** + * @brief The seeds that user-mode thread detail token start with it + * @details This seed should not start with zero (0), otherwise it's + * interpreted as error + */ +#define DebuggerThreadDebuggingTagStartSeed 0x1000000 + +/** + * @brief The seeds that user-mode codes use as the starter + * of their output source tag + * + */ +#define DebuggerOutputSourceTagStartSeed 0x1 + +/** + * @brief Determines how many sources a debugger can have for + * a single event + * + */ +#define DebuggerOutputSourceMaximumRemoteSourceForSingleEvent 0x5 + +/** + * @brief The size of each chunk of memory used in the 'memcpy' function + * of the script engine for transferring buffers in the VMX-root mode + * + */ +#define DebuggerScriptEngineMemcpyMovingBufferSize 64 + +////////////////////////////////////////////////// +// EPT Hook // +////////////////////////////////////////////////// + +/** + * @brief Maximum number of initial pre-allocated EPT hooks + * + */ +#define MAXIMUM_NUMBER_OF_INITIAL_PREALLOCATED_EPT_HOOKS 5 + +////////////////////////////////////////////////// +// Instant Event Configs // +////////////////////////////////////////////////// + +/** + * @brief Maximum number of (regular) instant events that are pre-allocated + * + */ +#define MAXIMUM_REGULAR_INSTANT_EVENTS 20 + +/** + * @brief Maximum number of (big) instant events that are pre-allocated + * + */ +#define MAXIMUM_BIG_INSTANT_EVENTS 0 + +/** + * @brief Pre-allocated size for a regular event + conditions buffer + * + */ +#define REGULAR_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + 100 + +/** + * @brief Pre-allocated size for a big event + conditions buffer + * + */ +#define BIG_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + PAGE_SIZE + +/** + * @brief Pre-allocated size for a regular action + custom code or script buffer + * + */ +#define REGULAR_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + (PAGE_SIZE * 2) + +/** + * @brief Pre-allocated size for a big action + custom code or script buffer + * + */ +#define BIG_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + MaxSerialPacketSize + +/** + * @brief Pre-allocated size for a regular requested safe buffer + * + */ +#define REGULAR_INSTANT_EVENT_REQUESTED_SAFE_BUFFER PAGE_SIZE + +/** + * @brief Pre-allocated size for a big requested safe buffer + * + */ +#define BIG_INSTANT_EVENT_REQUESTED_SAFE_BUFFER MaxSerialPacketSize + +////////////////////////////////////////////////// +// Remote Connection // +////////////////////////////////////////////////// + +/** + * @brief default port of HyperDbg for listening by + * debuggee (server, guest) + * + */ +#define DEFAULT_PORT "50000" + +/** + * @brief Packet size for TCP connections + * @details Note that we might add something to the kernel buffers + * that's why we add 0x100 to it + */ +#define COMMUNICATION_BUFFER_SIZE PacketChunkSize + 0x100 + +////////////////////////////////////////////////// +// VMCALL Numbers // +////////////////////////////////////////////////// + +/** + * @brief The start number of VMCALL number allowed to be + * used by top-level drivers + * + */ +#define TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER 0x00000200 + +/** + * @brief The start number of VMCALL number allowed to be + * used by top-level drivers + * + */ +#define TOP_LEVEL_DRIVERS_VMCALL_ENDING_NUMBER TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER + 0x100 + +////////////////////////////////////////////////// +// Operation Codes // +////////////////////////////////////////////////// + +/** + * @brief If a operation use this bit in its Operation code, + * then it means that the operation should be performed + * mandatorily in debuggee and should not be sent to the debugger + */ +#define OPERATION_MANDATORY_DEBUGGEE_BIT (1 << 31) + +/** + * @brief Message logs id that comes from kernel-mode to + * user-mode + * @details Message area >= 0x5 + */ +#define OPERATION_LOG_INFO_MESSAGE 1U +#define OPERATION_LOG_WARNING_MESSAGE 2U +#define OPERATION_LOG_ERROR_MESSAGE 3U +#define OPERATION_LOG_NON_IMMEDIATE_MESSAGE 4U +#define OPERATION_LOG_WITH_TAG 5U + +#define OPERATION_COMMAND_FROM_DEBUGGER_CLOSE_AND_UNLOAD_VMM \ + 6U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_USER_INPUT 7U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_REGISTER_EVENT 8U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_ADD_ACTION_TO_EVENT \ + 9 | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_CLEAR_EVENTS 10U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_CLEAR_EVENTS_WITHOUT_NOTIFYING_DEBUGGER 11U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED \ + 12U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS \ + 13U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_COMMAND_FROM_DEBUGGER_RELOAD_SYMBOL \ + 14U | OPERATION_MANDATORY_DEBUGGEE_BIT + +#define OPERATION_NOTIFICATION_FROM_USER_DEBUGGER_PAUSE \ + 15U | OPERATION_MANDATORY_DEBUGGEE_BIT + +////////////////////////////////////////////////// +// Breakpoints & Debug Breakpoints // +////////////////////////////////////////////////// + +/** + * @brief maximum number of buffers to be allocated for a single + * breakpoint + */ +#define MAXIMUM_BREAKPOINTS_WITHOUT_CONTINUE 100 + +/** + * @brief maximum number of thread/process ids to be allocated for a simultaneous + * debugging + * @details it shows the maximum number of threads/processes that HyperDbg sets + * trap flag for them + * + */ +#define MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_TRAPS 200 + +////////////////////////////////////////////////// +// Pool tags used in HyperDbg // +////////////////////////////////////////////////// + +/** + * @brief Pool tag + * + */ +#define POOLTAG 0x48444247 // [H]yper[DBG] (HDBG) + +////////////////////////////////////////////////// +// End of Buffer Detection // +////////////////////////////////////////////////// + +/** + * @brief count of characters for serial end of buffer + */ +#define SERIAL_END_OF_BUFFER_CHARS_COUNT 0x4 + +/** + * @brief characters of the buffer that we set at the end of + * buffers for serial + */ +#define SERIAL_END_OF_BUFFER_CHAR_1 0x00 +#define SERIAL_END_OF_BUFFER_CHAR_2 0x80 +#define SERIAL_END_OF_BUFFER_CHAR_3 0xEE +#define SERIAL_END_OF_BUFFER_CHAR_4 0xFF + +/** + * @brief count of characters for tcp end of buffer + */ +#define TCP_END_OF_BUFFER_CHARS_COUNT 0x4 + +/** + * @brief characters of the buffer that we set at the end of + * buffers for tcp + */ +#define TCP_END_OF_BUFFER_CHAR_1 0x10 +#define TCP_END_OF_BUFFER_CHAR_2 0x20 +#define TCP_END_OF_BUFFER_CHAR_3 0x33 +#define TCP_END_OF_BUFFER_CHAR_4 0x44 + +////////////////////////////////////////////////// +// Name of OS // +////////////////////////////////////////////////// + +/** + * @brief maximum name for OS name buffer + * + */ +#define MAXIMUM_CHARACTER_FOR_OS_NAME 256 + +////////////////////////////////////////////////// +// Processor Details // +////////////////////////////////////////////////// + +/** + * @brief maximum instruction size in Intel + */ +#define MAXIMUM_INSTR_SIZE 16 + +/** + * @brief maximum size for call instruction in Intel + */ +#define MAXIMUM_CALL_INSTR_SIZE 7 + +////////////////////////////////////////////////// +// Symbols Details // +////////////////////////////////////////////////// + +/** + * @brief maximum supported modules to load + * their symbol information + */ +#define MAXIMUM_SUPPORTED_SYMBOLS 1000 + +/** + * @brief maximum size for GUID and Age of PE + * @detail It seems that 33 bytes is enough but let's + * have more space because there might be sth that we + * missed :) + */ +#define MAXIMUM_GUID_AND_AGE_SIZE 60 + +////////////////////////////////////////////////// +// Debuggee Communication // +////////////////////////////////////////////////// + +/** + * @brief constant indicator of a HyperDbg packet + * @warning used in hwdbg + * + */ +#define INDICATOR_OF_HYPERDBG_PACKET \ + 0x4859504552444247 // HYPERDBG = 0x4859504552444247 + +////////////////////////////////////////////////// +// Command Details // +////////////////////////////////////////////////// + +/** + * @brief maximum results that will be returned by !s* s* + * command + * + */ +#define MaximumSearchResults 0x1000 + +////////////////////////////////////////////////// +// Script Engine // +////////////////////////////////////////////////// + +/** + * @brief EFLAGS/RFLAGS + * + */ +#define X86_FLAGS_CF (1 << 0) +#define X86_FLAGS_PF (1 << 2) +#define X86_FLAGS_AF (1 << 4) +#define X86_FLAGS_ZF (1 << 6) +#define X86_FLAGS_SF (1 << 7) +#define X86_FLAGS_TF (1 << 8) +#define X86_FLAGS_IF (1 << 9) +#define X86_FLAGS_DF (1 << 10) +#define X86_FLAGS_OF (1 << 11) +#define X86_FLAGS_STATUS_MASK (0xfff) +#define X86_FLAGS_IOPL_MASK (3 << 12) +#define X86_FLAGS_IOPL_SHIFT (12) +#define X86_FLAGS_IOPL_SHIFT_2ND_BIT (13) +#define X86_FLAGS_NT (1 << 14) +#define X86_FLAGS_RF (1 << 16) +#define X86_FLAGS_VM (1 << 17) +#define X86_FLAGS_AC (1 << 18) +#define X86_FLAGS_VIF (1 << 19) +#define X86_FLAGS_VIP (1 << 20) +#define X86_FLAGS_ID (1 << 21) +#define X86_FLAGS_RESERVED_ONES 0x2 +#define X86_FLAGS_RESERVED 0xffc0802a + +#define X86_FLAGS_RESERVED_BITS 0xffc38028 +#define X86_FLAGS_FIXED 0x00000002 + +#ifndef LOWORD +# define LOWORD(l) ((WORD)(l)) +#endif // !LOWORD + +#ifndef HIWORD +# define HIWORD(l) ((WORD)(((DWORD)(l) >> 16) & 0xFFFF)) +#endif // !HIWORD + +#ifndef LOBYTE +# define LOBYTE(w) ((BYTE)(w)) +#endif // !LOBYTE + +#ifndef HIBYTE +# define HIBYTE(w) ((BYTE)(((WORD)(w) >> 8) & 0xFF)) +#endif // !HIBYTE + +#define MAX_TEMP_COUNT 128 + +#define MAX_STACK_BUFFER_COUNT 128 + +// TODO: Extract number of variables from input of ScriptEngine +// and allocate variableList Dynamically. +#define MAX_VAR_COUNT 512 + +#define MAX_FUNCTION_NAME_LENGTH 32 + +////////////////////////////////////////////////// +// Debugger // +////////////////////////////////////////////////// + +/** + * @brief Apply event modifications to all tags + * + */ +#define DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG 0xffffffffffffffff + +/** + * @brief Maximum length for a function (to be used in showing distance + * from symbol functions in the 'u' command) + * + */ +#define DISASSEMBLY_MAXIMUM_DISTANCE_FROM_OBJECT_NAME 0xffff + +/** + * @brief Read and write MSRs to all cores + * + */ +#define DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES 0xffffffff + +/** + * @brief Apply the event to all the cores + * + */ +#define DEBUGGER_DEBUGGEE_IS_RUNNING_NO_CORE 0xffffffff + +/** + * @brief Apply the event to all the cores + * + */ +#define DEBUGGER_EVENT_APPLY_TO_ALL_CORES 0xffffffff + +/** + * @brief Apply the event to all the processes + * + */ +#define DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES 0xffffffff + +/** + * @brief Apply to all Model Specific Registers + * + */ +#define DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS 0xffffffff + +/** + * @brief Apply to all first 32 exceptions + * + */ +#define DEBUGGER_EVENT_EXCEPTIONS_ALL_FIRST_32_ENTRIES 0xffffffff + +/** + * @brief Apply to all syscalls and sysrets + * + */ +#define DEBUGGER_EVENT_SYSCALL_ALL_SYSRET_OR_SYSCALLS 0xffffffff + +/** + * @brief Apply to all I/O ports + * + */ +#define DEBUGGER_EVENT_ALL_IO_PORTS 0xffffffff + +/** + * @brief The constant to apply to all cores for bp command + * + */ +#define DEBUGGEE_BP_APPLY_TO_ALL_CORES 0xffffffff + +/** + * @brief The constant to apply to all processes for bp command + * + */ +#define DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES 0xffffffff + +/** + * @brief The constant to apply to all threads for bp command + * + */ +#define DEBUGGEE_BP_APPLY_TO_ALL_THREADS 0xffffffff + +/** + * @brief for reading all registers in r command. + * + */ +#define DEBUGGEE_SHOW_ALL_REGISTERS 0xffffffff + + +/** + * @file BasicTypes.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers For Basic Datatypes + * @details This file contains definitions of basic datatypes + * @version 0.2 + * @date 2022-06-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#pragma warning(disable : 4201) // Suppress nameless struct/union warning + +////////////////////////////////////////////////// +// Basic Datatypes // +////////////////////////////////////////////////// + +typedef unsigned long long QWORD; +typedef unsigned __int64 UINT64, *PUINT64; +typedef unsigned long DWORD; +typedef int BOOL; +typedef unsigned char BYTE; +typedef unsigned short WORD; +typedef int INT; +typedef unsigned int UINT; +typedef unsigned int * PUINT; +typedef unsigned __int64 ULONG64, *PULONG64; +typedef unsigned __int64 DWORD64, *PDWORD64; +typedef char CHAR; +//typedef wchar_t WCHAR; +typedef short wchar_t ; +typedef short WCHAR; +#define VOID void +#define PVOID void * +#define LPVOID void * +#define HANDLE void * +#define SIZE_T int +#define time_t UINT64 +#define MAX_PATH 260 +typedef struct _LIST_ENTRY { + struct _LIST_ENTRY *Flink; + struct _LIST_ENTRY *Blink; +} LIST_ENTRY, *PLIST_ENTRY, PRLIST_ENTRY; + +//#define static_assert(cond, msg) typedef char static_assertion_##msg[(!!(cond))*2-1]//todo bug,mock error + +typedef unsigned char UCHAR; +typedef unsigned short USHORT; +typedef unsigned long ULONG; + +typedef UCHAR BOOLEAN; // winnt +typedef BOOLEAN * PBOOLEAN; // winnt + +typedef signed char INT8, *PINT8; +typedef signed short INT16, *PINT16; +typedef signed int INT32, *PINT32; +typedef signed __int64 INT64, *PINT64; +typedef unsigned char UINT8, *PUINT8; +typedef unsigned short UINT16, *PUINT16; +typedef unsigned int UINT32, *PUINT32; +typedef unsigned __int64 UINT64, *PUINT64; + +#define NULL_ZERO 0 +#define NULL64_ZERO 0ull + +#define FALSE 0 +#define TRUE 1 + +#define UPPER_56_BITS 0xffffffffffffff00 +#define UPPER_48_BITS 0xffffffffffff0000 +#define UPPER_32_BITS 0xffffffff00000000 +#define LOWER_32_BITS 0x00000000ffffffff +#define LOWER_16_BITS 0x000000000000ffff +#define LOWER_8_BITS 0x00000000000000ff +#define SECOND_LOWER_8_BITS 0x000000000000ff00 +#define UPPER_48_BITS_AND_LOWER_8_BITS 0xffffffffffff00ff + +// +// DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA +// +typedef struct GUEST_REGS +{ + // + // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA + // + + UINT64 rax; // 0x00 + UINT64 rcx; // 0x08 + UINT64 rdx; // 0x10 + UINT64 rbx; // 0x18 + UINT64 rsp; // 0x20 + UINT64 rbp; // 0x28 + UINT64 rsi; // 0x30 + UINT64 rdi; // 0x38 + UINT64 r8; // 0x40 + UINT64 r9; // 0x48 + UINT64 r10; // 0x50 + UINT64 r11; // 0x58 + UINT64 r12; // 0x60 + UINT64 r13; // 0x68 + UINT64 r14; // 0x70 + UINT64 r15; // 0x78 + + // + // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA + // + +} GUEST_REGS, *PGUEST_REGS; + +/** + * @brief struct for extra registers + * + */ +typedef struct GUEST_EXTRA_REGISTERS +{ + UINT16 CS; + UINT16 DS; + UINT16 FS; + UINT16 GS; + UINT16 ES; + UINT16 SS; + UINT64 RFLAGS; + UINT64 RIP; +} GUEST_EXTRA_REGISTERS, *PGUEST_EXTRA_REGISTERS; + +/** + * @brief List of different variables + */ +typedef struct _SCRIPT_ENGINE_VARIABLES_LIST +{ + UINT64 * TempList; + UINT64 * GlobalVariablesList; + UINT64 * LocalVariablesList; + +} SCRIPT_ENGINE_VARIABLES_LIST, *PSCRIPT_ENGINE_VARIABLES_LIST; + +/** + * @brief CR3 Structure + * + */ +typedef struct _CR3_TYPE +{ + union + { + UINT64 Flags; + + struct + { + UINT64 Pcid : 12; + UINT64 PageFrameNumber : 36; + UINT64 Reserved1 : 12; + UINT64 Reserved_2 : 3; + UINT64 PcidInvalidate : 1; + } Fields; + }; +} CR3_TYPE, *PCR3_TYPE; + + +/** + * @file ErrorCodes.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Error codes + * @details This file contains definitions of error codes used in HyperDbg + * @version 0.2 + * @date 2022-06-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Success Codes // +////////////////////////////////////////////////// + +/** + * @brief General value to indicate that the operation or + * request was successful + * + */ +#define DEBUGGER_OPERATION_WAS_SUCCESSFUL 0xFFFFFFFF + +////////////////////////////////////////////////// +// Error Codes // +////////////////////////////////////////////////// + +/** + * @brief error, the tag not exist + * + */ +#define DEBUGGER_ERROR_TAG_NOT_EXISTS 0xc0000000 + +/** + * @brief error, invalid type of action + * + */ +#define DEBUGGER_ERROR_INVALID_ACTION_TYPE 0xc0000001 + +/** + * @brief error, the action buffer size is invalid + * + */ +#define DEBUGGER_ERROR_ACTION_BUFFER_SIZE_IS_ZERO 0xc0000002 + +/** + * @brief error, the event type is unknown + * + */ +#define DEBUGGER_ERROR_EVENT_TYPE_IS_INVALID 0xc0000003 + +/** + * @brief error, enable to create event + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_CREATE_EVENT 0xc0000004 + +/** + * @brief error, invalid address specified for debugger + * + */ +#define DEBUGGER_ERROR_INVALID_ADDRESS 0xc0000005 + +/** + * @brief error, the core id is invalid + * + */ +#define DEBUGGER_ERROR_INVALID_CORE_ID 0xc0000006 + +/** + * @brief error, the index is greater than 32 in !exception command + * + */ +#define DEBUGGER_ERROR_EXCEPTION_INDEX_EXCEED_FIRST_32_ENTRIES 0xc0000007 + +/** + * @brief error, the index for !interrupt command is not between 32 to 256 + * + */ +#define DEBUGGER_ERROR_INTERRUPT_INDEX_IS_NOT_VALID 0xc0000008 + +/** + * @brief error, unable to hide the debugger and enter to transparent-mode + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER 0xc0000009 + +/** + * @brief error, the debugger is already in transparent-mode + * + */ +#define DEBUGGER_ERROR_DEBUGGER_ALREADY_UHIDE 0xc000000a + +/** + * @brief error, invalid parameters in !e* e* commands + * + */ +#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_PARAMETER 0xc000000b + +/** + * @brief error, an invalid address is specified based on current cr3 + * in !e* or e* commands + * + */ +#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_CURRENT_PROCESS \ + 0xc000000c + +/** + * @brief error, an invalid address is specified based on anotehr process's cr3 + * in !e* or e* commands + * + */ +#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_OTHER_PROCESS \ + 0xc000000d + +/** + * @brief error, invalid tag for 'events' command (tag id is unknown for kernel) + * + */ +#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TAG 0xc000000e + +/** + * @brief error, type of action (enable/disable/clear) is wrong + * + */ +#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TYPE_OF_ACTION 0xc000000f + +/** + * @brief error, invalid parameters steppings actions + * + */ +#define DEBUGGER_ERROR_STEPPING_INVALID_PARAMETER 0xc0000010 + +/** + * @brief error, thread is invalid (not found) or disabled in + * stepping (step-in & step-out) requests + * + */ +#define DEBUGGER_ERROR_STEPPINGS_EITHER_THREAD_NOT_FOUND_OR_DISABLED 0xc0000011 + +/** + * @brief error, baud rate is invalid + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_BAUDRATE 0xc0000012 + +/** + * @brief error, serial port address is invalid + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_SERIAL_PORT 0xc0000013 + +/** + * @brief error, invalid core selected in changing core in remote debuggee + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_CORE_IN_REMOTE_DEBUGGE \ + 0xc0000014 + +/** + * @brief error, invalid process selected in changing process in remote debuggee + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_UNABLE_TO_SWITCH_TO_NEW_PROCESS \ + 0xc0000015 + +/** + * @brief error, unable to run script in remote debuggee + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT 0xc0000016 + +/** + * @brief error, invalid register number + * + */ +#define DEBUGGER_ERROR_INVALID_REGISTER_NUMBER 0xc0000017 + +/** + * @brief error, maximum pools were used without continuing debuggee + * + */ +#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_WITHOUT_CONTINUE 0xc0000018 + +/** + * @brief error, breakpoint already exists on the target address + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_EXISTS_ON_THE_ADDRESS 0xc0000019 + +/** + * @brief error, breakpoint id not found + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND 0xc000001a + +/** + * @brief error, breakpoint already disabled + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_DISABLED 0xc000001b + +/** + * @brief error, breakpoint already enabled + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_ENABLED 0xc000001c + +/** + * @brief error, memory type is invalid + * + */ +#define DEBUGGER_ERROR_MEMORY_TYPE_INVALID 0xc000001d + +/** + * @brief error, the process id is invalid + * + */ +#define DEBUGGER_ERROR_INVALID_PROCESS_ID 0xc000001e + +/** + * @brief error, for event specific reasons the event is not + * applied + * + */ +#define DEBUGGER_ERROR_EVENT_IS_NOT_APPLIED 0xc000001f + +/** + * @brief error, for process switch or process details, invalid parameter + * + */ +#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_PROCESS_INVALID_PARAMETER 0xc0000020 + +/** + * @brief error, for thread switch or thread details, invalid parameter + * + */ +#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER 0xc0000021 + +/** + * @brief error, maximum breakpoint for a single page is hit + * + */ +#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_FOR_A_SINGLE_PAGE_IS_HIT 0xc0000022 + +/** + * @brief error, there is no pre-allocated buffer + * + */ +#define DEBUGGER_ERROR_PRE_ALLOCATED_BUFFER_IS_EMPTY 0xc0000023 + +/** + * @brief error, in the EPT handler, it could not split the 2MB pages to + * 512 entries of 4 KB pages + * + */ +#define DEBUGGER_ERROR_EPT_COULD_NOT_SPLIT_THE_LARGE_PAGE_TO_4KB_PAGES 0xc0000024 + +/** + * @brief error, failed to get PML1 entry of the target address + * + */ +#define DEBUGGER_ERROR_EPT_FAILED_TO_GET_PML1_ENTRY_OF_TARGET_ADDRESS 0xc0000025 + +/** + * @brief error, multiple EPT Hooks or Monitors are applied on a single page + * + */ +#define DEBUGGER_ERROR_EPT_MULTIPLE_HOOKS_IN_A_SINGLE_PAGE 0xc0000026 + +/** + * @brief error, could not build the EPT Hook + * + */ +#define DEBUGGER_ERROR_COULD_NOT_BUILD_THE_EPT_HOOK 0xc0000027 + +/** + * @brief error, could not find the type of allocation + * + */ +#define DEBUGGER_ERROR_COULD_NOT_FIND_ALLOCATION_TYPE 0xc0000028 + +/** + * @brief error, could not find the index of test query + * + */ +#define DEBUGGER_ERROR_INVALID_TEST_QUERY_INDEX 0xc0000029 + +/** + * @brief error, failed to attach to the target user-mode process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS 0xc000002a + +/** + * @brief error, failed to remove hooks as entrypoint is not reached yet + * @details The caller of this functionality should keep sending the previous + * IOCTL until the hook is remove successfully + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED 0xc000002b + +/** + * @brief error, could not remove the previous hook + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS 0xc000002c + +/** + * @brief error, the needed routines for debugging is not initialized + * + */ +#define DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED 0xc000002d + +/** + * @brief error, unable to get 32-bit or 64-bit of the target process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS 0xc000002e + +/** + * @brief error, unable to kill the target process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS 0xc000002f + +/** + * @brief error, invalid thread debugging token + * + */ +#define DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN 0xc0000030 + +/** + * @brief error, unable to pause the process's threads + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS 0xc0000031 + +/** + * @brief error, user debugger already attached to this process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS 0xc0000032 + +/** + * @brief error, the user debugger is not attached to the target process + * + */ +#define DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS 0xc0000033 + +/** + * @brief error, cannot detach from the process as there are paused threads + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS 0xc0000034 + +/** + * @brief error, cannot switch to new thread as the process id or thread id is not found + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID 0xc0000035 + +/** + * @brief error, cannot switch to new thread the process doesn't contain an active thread + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS 0xc0000036 + +/** + * @brief error, unable to get modules + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS 0xc0000037 + +/** + * @brief error, unable to get the callstack + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_GET_CALLSTACK 0xc0000038 + +/** + * @brief error, unable to query count of processes or threads + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_QUERY_COUNT_OF_PROCESSES_OR_THREADS 0xc0000039 + +/** + * @brief error, using short-circuiting event with post-event mode is + * not supported in HyperDbg + * + */ +#define DEBUGGER_ERROR_USING_SHORT_CIRCUITING_EVENT_WITH_POST_EVENT_MODE_IS_FORBIDDEDN 0xc000003a + +/** + * @brief error, unknown test query is received + * + */ +#define DEBUGGER_ERROR_UNKNOWN_TEST_QUERY_RECEIVED 0xc000003b + +/** + * @brief error, for reading from memory in case of invalid parameters + * + */ +#define DEBUGGER_ERROR_READING_MEMORY_INVALID_PARAMETER 0xc000003c + +/** + * @brief error, the list of threads/process trap flag is full + * + */ +#define DEBUGGER_ERROR_THE_TRAP_FLAG_LIST_IS_FULL 0xc000003d + +/** + * @brief error, unable to kill the target process. process does not exists + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS 0xc000003e + +/** + * @brief error, the execution mode is incorrect + * + */ +#define DEBUGGER_ERROR_MODE_EXECUTION_IS_INVALID 0xc000003f + +/** + * @brief error, the process id cannot be specified while the debugger is in VMX-root mode + * + */ +#define DEBUGGER_ERROR_PROCESS_ID_CANNOT_BE_SPECIFIED_WHILE_APPLYING_EVENT_FROM_VMX_ROOT_MODE 0xc0000040 + +/** + * @brief error, the preallocated buffer is not enough for storing event+conditional buffer + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_EVENT_AND_CONDITIONALS 0xc0000041 + +/** + * @brief error, the regular preallocated buffer not found + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000042 + +/** + * @brief error, the big preallocated buffer not found + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000043 + +/** + * @brief error, enable to create action (cannot allocate buffer) + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_CREATE_ACTION_CANNOT_ALLOCATE_BUFFER 0xc0000044 + +/** + * @brief error, the regular preallocated buffer not found (for action) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000045 + +/** + * @brief error, the big preallocated buffer not found (for action) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000046 + +/** + * @brief error, the preallocated buffer is not enough for storing action buffer + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_ACTION_BUFFER 0xc0000047 + +/** + * @brief error, the requested optional buffer is bigger than send/receive stack of the debugger + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_REQUESTED_OPTIONAL_BUFFER_IS_BIGGER_THAN_DEBUGGERS_SEND_RECEIVE_STACK 0xc0000048 + +/** + * @brief error, the requested safe buffer does not exist (regular) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc0000049 + +/** + * @brief error, the requested safe buffer does not exists (big) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc000004a + +/** + * @brief error, the preallocated buffer is not enough for storing safe requested buffer + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_REQUESTED_SAFE_BUFFER 0xc000004b + +/** + * @brief error, enable to create requested safe buffer (cannot allocate buffer) + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_ALLOCATE_REQUESTED_SAFE_BUFFER 0xc000004c + +/** + * @brief error, could not find the type of preactivation + * + */ +#define DEBUGGER_ERROR_COULD_NOT_FIND_PREACTIVATION_TYPE 0xc000004d + +/** + * @brief error, the mode exec trap is not already initialized + * + */ +#define DEBUGGER_ERROR_THE_MODE_EXEC_TRAP_IS_NOT_INITIALIZED 0xc000004e + +/** + * @brief error, the target event(s) is/are disabled but cannot clear them because the buffer of the user-mode + * priority is full + * + */ +#define DEBUGGER_ERROR_THE_TARGET_EVENT_IS_DISABLED_BUT_CANNOT_BE_CLEARED_PRIRITY_BUFFER_IS_FULL 0xc000004f + +/** + * @brief error, not all cores are locked (probably due to a race condition in HyperDbg) in + * instant-event mechanism + * + */ +#define DEBUGGER_ERROR_NOT_ALL_CORES_ARE_LOCKED_FOR_APPLYING_INSTANT_EVENT 0xc0000050 + +/** + * @brief error, switching to the target core is not possible because core is not locked + * (probably due to a race condition in HyperDbg) + * + */ +#define DEBUGGER_ERROR_TARGET_SWITCHING_CORE_IS_NOT_LOCKED 0xc0000051 + +/** + * @brief error, invalid physical address + * + */ +#define DEBUGGER_ERROR_INVALID_PHYSICAL_ADDRESS 0xc0000052 + +// +// WHEN YOU ADD ANYTHING TO THIS LIST OF ERRORS, THEN +// MAKE SURE TO ADD AN ERROR MESSAGE TO ShowErrorMessage(UINT32 Error) +// FUNCTION +// + +/** + * @file Connection.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers For Native Structures, Enums and Constants + * @details These datatypes are used in all devices like HDL (FPGAs) + * @version 0.2 + * @date 2022-07-14 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +/** + * @brief enum for reasons why debuggee is paused + * + */ +typedef enum _DEBUGGEE_PAUSING_REASON +{ + + // + // For both kernel & user debugger + // + DEBUGGEE_PAUSING_REASON_NOT_PAUSED = 0, + DEBUGGEE_PAUSING_REASON_PAUSE, + DEBUGGEE_PAUSING_REASON_REQUEST_FROM_DEBUGGER, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_STEPPED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_TRACKING_STEPPED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_HARDWARE_DEBUG_REGISTER_HIT, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_CORE_SWITCHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_PROCESS_SWITCHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_THREAD_SWITCHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_COMMAND_EXECUTION_FINISHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_EVENT_TRIGGERED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED, + + // + // Only for user-debugger + // + DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_DEBUG_BREAK, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED, + + // + // Only used for hardware debugging + // + DEBUGGEE_PAUSING_REASON_HARDWARE_BASED_DEBUGGEE_GENERAL_BREAK, + +} DEBUGGEE_PAUSING_REASON; + +/** + * @brief enum for requested action for HyperDbg packet + * + */ +typedef enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION +{ + + // + // Debugger to debuggee (user-mode execution) + // + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_PAUSE = 1, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DO_NOT_READ_ANY_PACKET, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DEBUGGER_VERSION, + + // + // Debuggee to debugger (user-mode execution) + // + DEBUGGER_REMOTE_PACKET_PING_AND_SEND_SUPPORTED_VERSION, + + // + // Debugger to debuggee (vmx-root mode execution) + // + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_STEP, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CONTINUE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CLOSE_AND_UNLOAD_DEBUGGEE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_CORE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_FLUSH_BUFFERS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CALLSTACK, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_TEST_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_PROCESS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_THREAD, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_USER_INPUT_BUFFER, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SEARCH_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_REGISTER_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_ADD_ACTION_TO_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_AND_MODIFY_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_REGISTERS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_EDIT_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_BP, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_LIST_OR_MODIFY_BREAKPOINTS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_RELOAD, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_PA2VA_AND_VA2PA, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_QUERY_PTE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SET_SHORT_CIRCUITING_STATE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_INJECT_PAGE_FAULT, + + // + // Debuggee to debugger + // + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_NO_ACTION, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_STARTED, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_LOGGING_MECHANISM, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_PAUSED_AND_CURRENT_INSTRUCTION, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_CORE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_PROCESS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_THREAD, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_RUNNING_SCRIPT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FORMATS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FLUSH, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CALLSTACK, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_TEST_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_REGISTERING_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_ADDING_ACTION_TO_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_QUERY_AND_MODIFY_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_REGISTERS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_EDITING_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BP, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_STATE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_LIST_OR_MODIFY_BREAKPOINTS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_UPDATE_SYMBOL_INFO, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SYMBOL_FINISHED, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SEARCH_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_PTE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_VA2PA_AND_PA2VA, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BRINGING_PAGES_IN, + + // + // hardware debuggee to debugger + // + + // + // hardware debugger to debuggee + // + +} DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION; + +/** + * @brief enum for different packet types in HyperDbg packets + * @warning used in hwdbg + * + */ +typedef enum _DEBUGGER_REMOTE_PACKET_TYPE +{ + + // + // Debugger to debuggee (vmx-root) + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT = 1, + + // + // Debugger to debuggee (user-mode) + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_USER_MODE = 2, + + // + // Debuggee to debugger (user-mode and kernel-mode, vmx-root mode) + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER = 3, + + // + // Debugger to debuggee (hardware), used in hwdbg + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_HARDWARE_LEVEL = 4, + + // + // Debuggee to debugger (hardware), used in hwdbg + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER_HARDWARE_LEVEL = 5, + +} DEBUGGER_REMOTE_PACKET_TYPE; + +/** + * @brief The structure of remote packets in HyperDbg + * + */ +typedef struct _DEBUGGER_REMOTE_PACKET +{ + BYTE Checksum; + UINT64 Indicator; /* Shows the type of the packet */ + DEBUGGER_REMOTE_PACKET_TYPE TypeOfThePacket; + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedActionOfThePacket; + +} DEBUGGER_REMOTE_PACKET, *PDEBUGGER_REMOTE_PACKET; + +/** + * @file DataTypes.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK data type definitions + * @details This file contains definitions of structures, enums, etc. + * used in HyperDbg + * @version 0.2 + * @date 2022-06-22 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Memory Stages // +////////////////////////////////////////////////// + +/** + * @brief Different levels of paging + * + */ +typedef enum _PAGING_LEVEL +{ + PagingLevelPageTable = 0, + PagingLevelPageDirectory, + PagingLevelPageDirectoryPointerTable, + PagingLevelPageMapLevel4 +} PAGING_LEVEL; + +////////////////////////////////////////////////// +// Pool Manager // +////////////////////////////////////////////////// + +/** + * @brief Inum of intentions for buffers (buffer tag) + * + */ +typedef enum _POOL_ALLOCATION_INTENTION +{ + TRACKING_HOOKED_PAGES, + EXEC_TRAMPOLINE, + SPLIT_2MB_PAGING_TO_4KB_PAGE, + DETOUR_HOOK_DETAILS, + BREAKPOINT_DEFINITION_STRUCTURE, + PROCESS_THREAD_HOLDER, + + // + // Instant event buffers + // + INSTANT_REGULAR_EVENT_BUFFER, + INSTANT_BIG_EVENT_BUFFER, + INSTANT_REGULAR_EVENT_ACTION_BUFFER, + INSTANT_BIG_EVENT_ACTION_BUFFER, + + // + // Use for request safe buffers of the event + // + INSTANT_REGULAR_SAFE_BUFFER_FOR_EVENTS, + INSTANT_BIG_SAFE_BUFFER_FOR_EVENTS, + +} POOL_ALLOCATION_INTENTION; + +////////////////////////////////////////////////// +// Debug Registers Modifications // +////////////////////////////////////////////////// + +typedef enum _DEBUG_REGISTER_TYPE +{ + BREAK_ON_INSTRUCTION_FETCH, + BREAK_ON_WRITE_ONLY, + BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED, + BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH +} DEBUG_REGISTER_TYPE; + +////////////////////////////////////////////////// +// Execution Stages // +////////////////////////////////////////////////// + +typedef enum _VMX_EXECUTION_MODE +{ + VmxExecutionModeNonRoot = FALSE, + VmxExecutionModeRoot = TRUE +} VMX_EXECUTION_MODE; + +/** + * @brief Type of calling the event + * + */ +typedef enum _VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE +{ + VMM_CALLBACK_CALLING_STAGE_INVALID_EVENT_EMULATION = 0, + VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION = 1, + VMM_CALLBACK_CALLING_STAGE_POST_EVENT_EMULATION = 2, + VMM_CALLBACK_CALLING_STAGE_ALL_EVENT_EMULATION = 3 + +} VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE; + +/** + * @brief enum to query different process and thread interception mechanisms + * + */ +typedef enum _DEBUGGER_THREAD_PROCESS_TRACING +{ + + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_THREAD_CHANGE, + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_PROCESS_CHANGE, + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_DEBUG_REGISTER_INTERCEPTION, + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_WAITING_FOR_MOV_CR3_VM_EXITS, + +} DEBUGGER_THREAD_PROCESS_TRACING; + +////////////////////////////////////////////////// +// Callback Definitions // +////////////////////////////////////////////////// + +/** + * @brief Callback type that can be used to be used + * as a custom ShowMessages function + * + */ +typedef int (*Callback)(const char * Text); + +////////////////////////////////////////////////// +// Communications // +////////////////////////////////////////////////// + +/** + * @brief The structure of user-input packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_USER_INPUT_PACKET +{ + UINT32 CommandLen; + BOOLEAN IgnoreFinishedSignal; + UINT32 Result; + + // + // The user's input is here + // + +} DEBUGGEE_USER_INPUT_PACKET, *PDEBUGGEE_USER_INPUT_PACKET; + +/** + * @brief The structure of user-input packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET +{ + UINT32 Length; + + // + // The buffer for event and action is here + // + +} DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET, + *PDEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET; + +////////////////////////////////////////////////// +// Pausing // +////////////////////////////////////////////////// + +#define SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED \ + sizeof(DEBUGGER_PAUSE_PACKET_RECEIVED) + +/** + * @brief request to pause and halt the system + * + */ +typedef struct _DEBUGGER_PAUSE_PACKET_RECEIVED +{ + UINT32 Result; // Result from kernel + +} DEBUGGER_PAUSE_PACKET_RECEIVED, *PDEBUGGER_PAUSE_PACKET_RECEIVED; + +/* ============================================================================================== + */ + +/** + * @brief The structure of detail of a triggered event in HyperDbg + * @details This structure is also used for transferring breakpoint ids, RIP as the context, etc. + * + */ +typedef struct _DEBUGGER_TRIGGERED_EVENT_DETAILS +{ + UINT64 Tag; /* in breakpoints Tag is breakpoint id, not event tag */ + PVOID Context; + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE Stage; + +} DEBUGGER_TRIGGERED_EVENT_DETAILS, *PDEBUGGER_TRIGGERED_EVENT_DETAILS; + +/* ============================================================================================== + */ + +/** + * @brief The structure of pausing packet in kHyperDbg + * + */ +typedef struct _DEBUGGEE_KD_PAUSED_PACKET +{ + UINT64 Rip; + BOOLEAN IsProcessorOn32BitMode; // if true shows that the address should be interpreted in 32-bit mode + BOOLEAN IgnoreDisassembling; // if check if diassembling should be ignored or not + DEBUGGEE_PAUSING_REASON PausingReason; + ULONG CurrentCore; + UINT64 EventTag; + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; + UINT64 Rflags; + BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; + UINT16 ReadInstructionLen; + +} DEBUGGEE_KD_PAUSED_PACKET, *PDEBUGGEE_KD_PAUSED_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of pausing packet in uHyperDbg + * + */ +typedef struct _DEBUGGEE_UD_PAUSED_PACKET +{ + UINT64 Rip; + UINT64 ProcessDebuggingToken; + BOOLEAN Is32Bit; // if true shows that the address should be interpreted in 32-bit mode + DEBUGGEE_PAUSING_REASON PausingReason; + UINT32 ProcessId; + UINT32 ThreadId; + UINT64 Rflags; + UINT64 EventTag; + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; + BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; + UINT16 ReadInstructionLen; + GUEST_REGS GuestRegs; + +} DEBUGGEE_UD_PAUSED_PACKET, *PDEBUGGEE_UD_PAUSED_PACKET; + +/** + * @brief check so the DEBUGGEE_UD_PAUSED_PACKET should be smaller than packet size + * + */ +//static_assert(sizeof(DEBUGGEE_UD_PAUSED_PACKET) < PacketChunkSize, +// "err (static_assert), size of PacketChunkSize should be bigger than DEBUGGEE_UD_PAUSED_PACKET"); + +////////////////////////////////////////////////// +// Message Tracing Enums // +////////////////////////////////////////////////// + +/** + * @brief Type of transferring buffer between user-to-kernel + * + */ +typedef enum _NOTIFY_TYPE +{ + IRP_BASED, + EVENT_BASED +} NOTIFY_TYPE; + +////////////////////////////////////////////////// +// Structures // +////////////////////////////////////////////////// + +/** + * @brief The structure of message packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_MESSAGE_PACKET +{ + UINT32 OperationCode; + CHAR Message[PacketChunkSize]; + +} DEBUGGEE_MESSAGE_PACKET, *PDEBUGGEE_MESSAGE_PACKET; + +/** + * @brief Used to register event for transferring buffer between user-to-kernel + * + */ +typedef struct _REGISTER_NOTIFY_BUFFER +{ + NOTIFY_TYPE Type; + HANDLE hEvent; + +} REGISTER_NOTIFY_BUFFER, *PREGISTER_NOTIFY_BUFFER; + +////////////////////////////////////////////////// +// Direct VMCALL // +////////////////////////////////////////////////// + +/** + * @brief Used for sending direct VMCALLs on the VMX root-mode + * + */ +typedef struct _DIRECT_VMCALL_PARAMETERS +{ + UINT64 OptionalParam1; + UINT64 OptionalParam2; + UINT64 OptionalParam3; + +} DIRECT_VMCALL_PARAMETERS, *PDIRECT_VMCALL_PARAMETERS; + +////////////////////////////////////////////////// +// EPT Hook // +////////////////////////////////////////////////// + +/** + * @brief different type of memory addresses + * + */ +typedef enum _DEBUGGER_HOOK_MEMORY_TYPE +{ + DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS, + DEBUGGER_MEMORY_HOOK_PHYSICAL_ADDRESS +} DEBUGGER_HOOK_MEMORY_TYPE; + +/** + * @brief Temporary $context used in some EPT hook commands + * + */ +typedef struct _EPT_HOOKS_CONTEXT +{ + UINT64 HookingTag; // This is same as the event tag + UINT64 PhysicalAddress; + UINT64 VirtualAddress; +} EPT_HOOKS_CONTEXT, *PEPT_HOOKS_CONTEXT; + +/** + * @brief Setting details for EPT Hooks (!monitor) + * + */ +typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR +{ + UINT64 StartAddress; + UINT64 EndAddress; + BOOLEAN SetHookForRead; + BOOLEAN SetHookForWrite; + BOOLEAN SetHookForExec; + DEBUGGER_HOOK_MEMORY_TYPE MemoryType; + UINT64 Tag; + +} EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR; + +/** + * @brief Setting details for EPT Hooks (!epthook2) + * + */ +typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2 +{ + PVOID TargetAddress; + PVOID HookFunction; + +} EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2; + +/** + * @brief Details of unhooking single EPT hooks + * + */ +typedef struct _EPT_SINGLE_HOOK_UNHOOKING_DETAILS +{ + BOOLEAN CallerNeedsToRestoreEntryAndInvalidateEpt; + BOOLEAN RemoveBreakpointInterception; + SIZE_T PhysicalAddress; + UINT64 /* EPT_PML1_ENTRY */ OriginalEntry; + +} EPT_SINGLE_HOOK_UNHOOKING_DETAILS, *PEPT_SINGLE_HOOK_UNHOOKING_DETAILS; + +////////////////////////////////////////////////// +// Segment Types // +////////////////////////////////////////////////// + +/** + * @brief Describe segment selector in VMX + * @details This structure is copied from ia32.h to the SDK to + * be used as a data type for functions + * + */ +typedef union +{ + struct + { + /** + * [Bits 3:0] Segment type. + */ + UINT32 Type : 4; + + /** + * [Bit 4] S - Descriptor type (0 = system; 1 = code or data). + */ + UINT32 DescriptorType : 1; + + /** + * [Bits 6:5] DPL - Descriptor privilege level. + */ + UINT32 DescriptorPrivilegeLevel : 2; + + /** + * [Bit 7] P - Segment present. + */ + UINT32 Present : 1; + + UINT32 Reserved1 : 4; + + /** + * [Bit 12] AVL - Available for use by system software. + */ + UINT32 AvailableBit : 1; + + /** + * [Bit 13] Reserved (except for CS). L - 64-bit mode active (for CS only). + */ + UINT32 LongMode : 1; + + /** + * [Bit 14] D/B - Default operation size (0 = 16-bit segment; 1 = 32-bit segment). + */ + UINT32 DefaultBig : 1; + + /** + * [Bit 15] G - Granularity. + */ + UINT32 Granularity : 1; + /** + * [Bit 16] Segment unusable (0 = usable; 1 = unusable). + */ + UINT32 Unusable : 1; + UINT32 Reserved2 : 15; + }; + + UINT32 AsUInt; +} VMX_SEGMENT_ACCESS_RIGHTS_TYPE; + +/** + * @brief Segment selector + * + */ +typedef struct _VMX_SEGMENT_SELECTOR +{ + UINT16 Selector; + VMX_SEGMENT_ACCESS_RIGHTS_TYPE Attributes; + UINT32 Limit; + UINT64 Base; +} VMX_SEGMENT_SELECTOR, *PVMX_SEGMENT_SELECTOR; + +/** + * @file Ioctls.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK IOCTL codes + * @details This file contains definitions of IOCTLs used in HyperDbg + * @version 0.2 + * @date 2022-06-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Definitions // +////////////////////////////////////////////////// + +// +// The following controls are mainly defined in +// + +// +// Macro definition for defining IOCTL and FSCTL function control codes. Note +// that function codes 0-2047 are reserved for Microsoft Corporation, and +// 2048-4095 are reserved for customers. +// +#ifndef CTL_CODE + +# define CTL_CODE(DeviceType, Function, Method, Access) ( \ + ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method)) + +#endif // ! CTL_CODE + +#ifndef FILE_ANY_ACCESS + +# define FILE_ANY_ACCESS 0 + +#endif // !FILE_ANY_ACCESS + +// +// Define the method codes for how buffers are passed for I/O and FS controls +// + +#ifndef METHOD_BUFFERED + +# define METHOD_BUFFERED 0 + +#endif // !METHOD_BUFFERED + +#ifndef FILE_DEVICE_UNKNOWN + +# define FILE_DEVICE_UNKNOWN 0x00000022 + +#endif // !FILE_DEVICE_UNKNOWN + +////////////////////////////////////////////////// +// IOCTLs // +////////////////////////////////////////////////// + +/** + * @brief ioctl, register a new event + * + */ +#define IOCTL_REGISTER_EVENT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, irp pending mechanism for reading from message tracing buffers + * + */ +#define IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to terminate vmx and exit form debugger + * + */ +#define IOCTL_TERMINATE_VMX \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to read memory + * + */ +#define IOCTL_DEBUGGER_READ_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to read or write on a special MSR + * + */ +#define IOCTL_DEBUGGER_READ_OR_WRITE_MSR \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to read page table entries + * + */ +#define IOCTL_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, register an event + * + */ +#define IOCTL_DEBUGGER_REGISTER_EVENT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, add action to event + * + */ +#define IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to enable or disable transparent-mode + * + */ +#define IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, for !va2pa and !pa2va commands + * + */ +#define IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to edit virtual and physical memory + * + */ +#define IOCTL_DEBUGGER_EDIT_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to search virtual and physical memory + * + */ +#define IOCTL_DEBUGGER_SEARCH_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to modify an event (enable/disable/clear) + * + */ +#define IOCTL_DEBUGGER_MODIFY_EVENTS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80c, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, flush the kernel buffers + * + */ +#define IOCTL_DEBUGGER_FLUSH_LOGGING_BUFFERS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80d, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, attach or detach user-mode processes + * + */ +#define IOCTL_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80e, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, print states (Deprecated) + * + * + */ +#define IOCTL_DEBUGGER_PRINT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80f, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, prepare debuggee + * + */ +#define IOCTL_PREPARE_DEBUGGEE \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, pause and halt the system + * + */ +#define IOCTL_PAUSE_PACKET_RECEIVED \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x811, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, send a signal that execution of command finished + * + */ +#define IOCTL_SEND_SIGNAL_EXECUTION_IN_DEBUGGEE_FINISHED \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x812, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, send user-mode messages to the debugger + * + */ +#define IOCTL_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x813, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, send general buffer from debuggee to debugger + * + */ +#define IOCTL_SEND_GENERAL_BUFFER_FROM_DEBUGGEE_TO_DEBUGGER \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x814, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to perform kernel-side tests + * + */ +#define IOCTL_PERFROM_KERNEL_SIDE_TESTS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to reserve pre-allocated pools + * + */ +#define IOCTL_RESERVE_PRE_ALLOCATED_POOLS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x816, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to send user debugger commands + * + */ +#define IOCTL_SEND_USER_DEBUGGER_COMMANDS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x817, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to get active threads/processes that are debugging + * + */ +#define IOCTL_GET_DETAIL_OF_ACTIVE_THREADS_AND_PROCESSES \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x818, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to get user mode modules details + * + */ +#define IOCTL_GET_USER_MODE_MODULE_DETAILS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x819, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, query count of active threads or processes + * + */ +#define IOCTL_QUERY_COUNT_OF_ACTIVE_PROCESSES_OR_THREADS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81a, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to get list threads/processes + * + */ +#define IOCTL_GET_LIST_OF_THREADS_AND_PROCESSES \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81b, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, query the current process details + * + */ +#define IOCTL_QUERY_CURRENT_PROCESS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81c, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, query the current thread details + * + */ +#define IOCTL_QUERY_CURRENT_THREAD \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81d, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request service from the reversing machine + * + */ +#define IOCTL_REQUEST_REV_MACHINE_SERVICE \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81e, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to bring pages in + * + */ +#define IOCTL_DEBUGGER_BRING_PAGES_IN \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81f, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to preactivate a functionality + * + */ +#define IOCTL_PREACTIVATE_FUNCTIONALITY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x820, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @file Events.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers for Events + * @details This file contains definitions of event datatypes + * @version 0.2 + * @date 2022-06-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// System Events // +////////////////////////////////////////////////// + +/** + * @brief Exceptions enum + * + */ +typedef enum _EXCEPTION_VECTORS +{ + EXCEPTION_VECTOR_DIVIDE_ERROR, + EXCEPTION_VECTOR_DEBUG_BREAKPOINT, + EXCEPTION_VECTOR_NMI, + EXCEPTION_VECTOR_BREAKPOINT, + EXCEPTION_VECTOR_OVERFLOW, + EXCEPTION_VECTOR_BOUND_RANGE_EXCEEDED, + EXCEPTION_VECTOR_UNDEFINED_OPCODE, + EXCEPTION_VECTOR_NO_MATH_COPROCESSOR, + EXCEPTION_VECTOR_DOUBLE_FAULT, + EXCEPTION_VECTOR_RESERVED0, + EXCEPTION_VECTOR_INVALID_TASK_SEGMENT_SELECTOR, + EXCEPTION_VECTOR_SEGMENT_NOT_PRESENT, + EXCEPTION_VECTOR_STACK_SEGMENT_FAULT, + EXCEPTION_VECTOR_GENERAL_PROTECTION_FAULT, + EXCEPTION_VECTOR_PAGE_FAULT, + EXCEPTION_VECTOR_RESERVED1, + EXCEPTION_VECTOR_MATH_FAULT, + EXCEPTION_VECTOR_ALIGNMENT_CHECK, + EXCEPTION_VECTOR_MACHINE_CHECK, + EXCEPTION_VECTOR_SIMD_FLOATING_POINT_NUMERIC_ERROR, + EXCEPTION_VECTOR_VIRTUAL_EXCEPTION, + EXCEPTION_VECTOR_RESERVED2, + EXCEPTION_VECTOR_RESERVED3, + EXCEPTION_VECTOR_RESERVED4, + EXCEPTION_VECTOR_RESERVED5, + EXCEPTION_VECTOR_RESERVED6, + EXCEPTION_VECTOR_RESERVED7, + EXCEPTION_VECTOR_RESERVED8, + EXCEPTION_VECTOR_RESERVED9, + EXCEPTION_VECTOR_RESERVED10, + EXCEPTION_VECTOR_RESERVED11, + EXCEPTION_VECTOR_RESERVED12, + + // + // NT (Windows) specific exception vectors. + // + APC_INTERRUPT = 31, + DPC_INTERRUPT = 47, + CLOCK_INTERRUPT = 209, + IPI_INTERRUPT = 225, + PMI_INTERRUPT = 254, + +} EXCEPTION_VECTORS; + +////////////////////////////////////////////////// +// Callback Enums // +////////////////////////////////////////////////// + +/** + * @brief The status of triggering events + * + */ +typedef enum _VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE +{ + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED = 0, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL = 0, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT = 1, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_DEBUGGER_NOT_ENABLED = 2, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_INVALID_EVENT_TYPE = 3, + +} VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE; + +////////////////////////////////////////////////// +// Event Details // +////////////////////////////////////////////////// + +/** + * @brief enum to show type of all HyperDbg events + * + */ +typedef enum _VMM_EVENT_TYPE_ENUM +{ + + // + // EPT Memory Monitoring Events + // + HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE, + HIDDEN_HOOK_READ_AND_WRITE, + HIDDEN_HOOK_READ_AND_EXECUTE, + HIDDEN_HOOK_WRITE_AND_EXECUTE, + HIDDEN_HOOK_READ, + HIDDEN_HOOK_WRITE, + HIDDEN_HOOK_EXECUTE, + + // + // EPT Hook Events + // + HIDDEN_HOOK_EXEC_DETOURS, + HIDDEN_HOOK_EXEC_CC, + + // + // System-call Events + // + SYSCALL_HOOK_EFER_SYSCALL, + SYSCALL_HOOK_EFER_SYSRET, + + // + // CPUID Instruction Execution Events + // + CPUID_INSTRUCTION_EXECUTION, + + // + // Model-Specific Registers (MSRs) Reads/Modifications Events + // + RDMSR_INSTRUCTION_EXECUTION, + WRMSR_INSTRUCTION_EXECUTION, + + // + // PMIO Events + // + IN_INSTRUCTION_EXECUTION, + OUT_INSTRUCTION_EXECUTION, + + // + // Interrupts/Exceptions/Faults Events + // + EXCEPTION_OCCURRED, + EXTERNAL_INTERRUPT_OCCURRED, + + // + // Debug Registers Events + // + DEBUG_REGISTERS_ACCESSED, + + // + // Timing & Performance Events + // + TSC_INSTRUCTION_EXECUTION, + PMC_INSTRUCTION_EXECUTION, + + // + // VMCALL Instruction Execution Events + // + VMCALL_INSTRUCTION_EXECUTION, + + // + // Control Registers Events + // + CONTROL_REGISTER_MODIFIED, + CONTROL_REGISTER_READ, + CONTROL_REGISTER_3_MODIFIED, + + // + // Execution Trap Events + // + TRAP_EXECUTION_MODE_CHANGED, + TRAP_EXECUTION_INSTRUCTION_TRACE, + +} VMM_EVENT_TYPE_ENUM; + +/** + * @brief Type of Actions + * + */ +typedef enum _DEBUGGER_EVENT_ACTION_TYPE_ENUM +{ + BREAK_TO_DEBUGGER, + RUN_SCRIPT, + RUN_CUSTOM_CODE + +} DEBUGGER_EVENT_ACTION_TYPE_ENUM; + +/** + * @brief Type of handling !syscall or !sysret + * + */ +typedef enum _DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE +{ + DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY = 0, + DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD = 1, + +} DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE; + +#define SIZEOF_DEBUGGER_MODIFY_EVENTS sizeof(DEBUGGER_MODIFY_EVENTS) + +/** + * @brief Type of mode change traps + * + */ +typedef enum _DEBUGGER_EVENT_MODE_TYPE +{ + DEBUGGER_EVENT_MODE_TYPE_USER_MODE_AND_KERNEL_MODE = 1, + DEBUGGER_EVENT_MODE_TYPE_USER_MODE = 3, + DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE = 0, + DEBUGGER_EVENT_MODE_TYPE_INVALID = 0xffffffff, + +} DEBUGGER_EVENT_MODE_TYPE; + +/** + * @brief Type of tracing events + * + */ +typedef enum _DEBUGGER_EVENT_TRACE_TYPE +{ + DEBUGGER_EVENT_TRACE_TYPE_INVALID = 0, + DEBUGGER_EVENT_TRACE_TYPE_STEP_IN = 1, + DEBUGGER_EVENT_TRACE_TYPE_STEP_OUT = 2, + DEBUGGER_EVENT_TRACE_TYPE_INSTRUMENTATION_STEP_IN = 3, + +} DEBUGGER_EVENT_TRACE_TYPE; + +/** + * @brief different types of modifying events request (enable/disable/clear) + * + */ +typedef enum _DEBUGGER_MODIFY_EVENTS_TYPE +{ + DEBUGGER_MODIFY_EVENTS_QUERY_STATE, + DEBUGGER_MODIFY_EVENTS_ENABLE, + DEBUGGER_MODIFY_EVENTS_DISABLE, + DEBUGGER_MODIFY_EVENTS_CLEAR, +} DEBUGGER_MODIFY_EVENTS_TYPE; + +/** + * @brief request for modifying events (enable/disable/clear) + * + */ +typedef struct _DEBUGGER_MODIFY_EVENTS +{ + UINT64 Tag; // Tag of the target event that we want to modify + UINT64 KernelStatus; // Kernel put the status in this field + DEBUGGER_MODIFY_EVENTS_TYPE + TypeOfAction; // Determines what's the action (enable | disable | clear) + BOOLEAN IsEnabled; // Determines what's the action (enable | disable | clear) + +} DEBUGGER_MODIFY_EVENTS, *PDEBUGGER_MODIFY_EVENTS; + +/** + * @brief request for performing a short-circuiting event + * + */ +typedef struct _DEBUGGER_SHORT_CIRCUITING_EVENT +{ + UINT64 KernelStatus; // Kernel put the status in this field + BOOLEAN IsShortCircuiting; // Determines whether to perform short circuting (on | off) + +} DEBUGGER_SHORT_CIRCUITING_EVENT, *PDEBUGGER_SHORT_CIRCUITING_EVENT; + +////////////////////////////////////////////////// +// Event Options // +////////////////////////////////////////////////// + +/** + * @brief request for performing a short-circuiting event + * + */ +typedef struct _DEBUGGER_EVENT_OPTIONS +{ + UINT64 OptionalParam1; // Optional parameter + UINT64 OptionalParam2; // Optional parameter + UINT64 OptionalParam3; // Optional parameter + UINT64 OptionalParam4; // Optional parameter + UINT64 OptionalParam5; // Optional parameter + UINT64 OptionalParam6; // Optional parameter + +} DEBUGGER_EVENT_OPTIONS, *PDEBUGGER_EVENT_OPTIONS; + +////////////////////////////////////////////////// +// Enums For Event And Debugger Resources // +////////////////////////////////////////////////// + +/** + * @brief Things to consider when applying resources + * + */ +typedef enum _PROTECTED_HV_RESOURCES_PASSING_OVERS +{ + // + // for exception bitmap + // + PASSING_OVER_NONE = 0, + PASSING_OVER_UD_EXCEPTIONS_FOR_SYSCALL_SYSRET_HOOK = 1, + PASSING_OVER_EXCEPTION_EVENTS, + + // + // for external interupts-exitings + // + PASSING_OVER_INTERRUPT_EVENTS, + + // + // for external rdtsc/p exitings + // + PASSING_OVER_TSC_EVENTS, + + // + // for external mov to hardware debug registers exitings + // + PASSING_OVER_MOV_TO_HW_DEBUG_REGS_EVENTS, + + // + // for external mov to control registers exitings + // + PASSING_OVER_MOV_TO_CONTROL_REGS_EVENTS, + +} PROTECTED_HV_RESOURCES_PASSING_OVERS; + +/** + * @brief Type of protected (multi-used) resources + * + */ +typedef enum _PROTECTED_HV_RESOURCES_TYPE +{ + PROTECTED_HV_RESOURCES_EXCEPTION_BITMAP, + + PROTECTED_HV_RESOURCES_EXTERNAL_INTERRUPT_EXITING, + + PROTECTED_HV_RESOURCES_RDTSC_RDTSCP_EXITING, + + PROTECTED_HV_RESOURCES_MOV_TO_DEBUG_REGISTER_EXITING, + + PROTECTED_HV_RESOURCES_MOV_CONTROL_REGISTER_EXITING, + + PROTECTED_HV_RESOURCES_MOV_TO_CR3_EXITING, + +} PROTECTED_HV_RESOURCES_TYPE; + +////////////////////////////////////////////////// +// Event Details // +////////////////////////////////////////////////// + +/** + * @brief Each command is like the following struct, it also used for + * tracing works in user mode and sending it to the kernl mode + * @details THIS IS NOT WHAT HYPERDBG SAVES FOR EVENTS IN KERNEL-MODE + */ +typedef struct _DEBUGGER_GENERAL_EVENT_DETAIL +{ + LIST_ENTRY + CommandsEventList; // Linked-list of commands list (used for tracing purpose + // in user mode) + + time_t CreationTime; // Date of creating this event + + UINT32 CoreId; // determines the core index to apply this event to, if it's + // 0xffffffff means that we have to apply it to all cores + + UINT32 ProcessId; // determines the process id to apply this to + // only that 0xffffffff means that we have to + // apply it to all processes + + BOOLEAN IsEnabled; + + BOOLEAN EnableShortCircuiting; // indicates whether the short-circuiting event + // is enabled or not for this event + + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventStage; // reveals the calling stage of the event + // (whether it's a all- pre- or post- event) + + BOOLEAN HasCustomOutput; // Shows whether this event has a custom output + // source or not + + UINT64 + OutputSourceTags + [DebuggerOutputSourceMaximumRemoteSourceForSingleEvent]; // tags of + // multiple + // sources which + // can be used to + // send the event + // results of + // scripts to + // remote sources + + UINT32 CountOfActions; + + UINT64 Tag; // is same as operation code + VMM_EVENT_TYPE_ENUM EventType; + + DEBUGGER_EVENT_OPTIONS Options; + + PVOID CommandStringBuffer; + + UINT32 ConditionBufferSize; + +} DEBUGGER_GENERAL_EVENT_DETAIL, *PDEBUGGER_GENERAL_EVENT_DETAIL; + +/** + * @brief Each event can have multiple actions + * @details THIS STRUCTURE IS ONLY USED IN USER MODE + * WE USE SEPARATE STRUCTURE FOR ACTIONS IN + * KERNEL MODE + */ +typedef struct _DEBUGGER_GENERAL_ACTION +{ + UINT64 EventTag; + DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType; + BOOLEAN ImmediateMessagePassing; + UINT32 PreAllocatedBuffer; + + UINT32 CustomCodeBufferSize; + UINT32 ScriptBufferSize; + UINT32 ScriptBufferPointer; + +} DEBUGGER_GENERAL_ACTION, *PDEBUGGER_GENERAL_ACTION; + +/** + * @brief Status of register buffers + * + */ +typedef struct _DEBUGGER_EVENT_AND_ACTION_RESULT +{ + BOOLEAN IsSuccessful; + UINT32 Error; // If IsSuccessful was, FALSE + +} DEBUGGER_EVENT_AND_ACTION_RESULT, *PDEBUGGER_EVENT_AND_ACTION_RESULT; + +#define SIZEOF_REGISTER_EVENT sizeof(REGISTER_NOTIFY_BUFFER) + +/** + * @file RequestStructures.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers Request Packets + * @details This file contains definitions of request packets (enums, structs) + * @version 0.2 + * @date 2022-06-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#define SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ + sizeof(DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS) + +/** + * @brief request for !pte command + * + */ +typedef struct _DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS +{ + UINT64 VirtualAddress; + UINT32 ProcessId; + + UINT64 Pml4eVirtualAddress; + UINT64 Pml4eValue; + + UINT64 PdpteVirtualAddress; + UINT64 PdpteValue; + + UINT64 PdeVirtualAddress; + UINT64 PdeValue; + + UINT64 PteVirtualAddress; + UINT64 PteValue; + + UINT32 KernelStatus; + +} DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, + *PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ + sizeof(DEBUGGER_VA2PA_AND_PA2VA_COMMANDS) + +/** + * @brief requests for !va2pa and !pa2va commands + * + */ +typedef struct _DEBUGGER_VA2PA_AND_PA2VA_COMMANDS +{ + UINT64 VirtualAddress; + UINT64 PhysicalAddress; + UINT32 ProcessId; + BOOLEAN IsVirtual2Physical; + UINT32 KernelStatus; + +} DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, *PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS; + +/* ============================================================================================== + */ +#define SIZEOF_DEBUGGER_PAGE_IN_REQUEST \ + sizeof(DEBUGGER_PAGE_IN_REQUEST) + +/** + * @brief requests for the '.pagein' command + * + */ +typedef struct _DEBUGGER_PAGE_IN_REQUEST +{ + UINT64 VirtualAddressFrom; + UINT64 VirtualAddressTo; + UINT32 ProcessId; + UINT32 PageFaultErrorCode; + UINT32 KernelStatus; + +} DEBUGGER_PAGE_IN_REQUEST, *PDEBUGGER_PAGE_IN_REQUEST; + +/* ============================================================================================== + */ + +/** + * @brief different modes of reconstruct requests + * + */ +typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE +{ + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN = 0, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_USER_MODE, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_KERNEL_MODE, +} REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE; + +/** + * @brief different types of reconstruct requests + * + */ +typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE +{ + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN = 0, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN, +} REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE; + +#define SIZEOF_REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST \ + sizeof(REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST) + +/** + * @brief requests for !rev command + * + */ +typedef struct _REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST +{ + UINT32 ProcessId; + UINT32 Size; + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE Mode; + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE Type; + UINT32 KernelStatus; + +} REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST, *PREVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_DT_COMMAND_OPTIONS \ + sizeof(DEBUGGER_DT_COMMAND_OPTIONS) + +/** + * @brief requests options for dt and struct command + * + */ +typedef struct _DEBUGGER_DT_COMMAND_OPTIONS +{ + const char * TypeName; + UINT64 SizeOfTypeName; + UINT64 Address; + BOOLEAN IsStruct; + PVOID BufferAddress; + UINT32 TargetPid; + const char * AdditionalParameters; + +} DEBUGGER_DT_COMMAND_OPTIONS, *PDEBUGGER_DT_COMMAND_OPTIONS; + +/* ============================================================================================== + */ + +/** + * @brief different types of prealloc requests + * + */ +typedef enum _DEBUGGER_PREALLOC_COMMAND_TYPE +{ + DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION, + DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR, + DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK, + DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK2, + DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_EVENT, + DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_EVENT, + DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_SAFE_BUFFER, + DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_SAFE_BUFFER, + +} DEBUGGER_PREALLOC_COMMAND_TYPE; + +#define SIZEOF_DEBUGGER_PREALLOC_COMMAND \ + sizeof(DEBUGGER_PREALLOC_COMMAND) + +/** + * @brief requests for the 'prealloc' command + * + */ +typedef struct _DEBUGGER_PREALLOC_COMMAND +{ + DEBUGGER_PREALLOC_COMMAND_TYPE Type; + UINT32 Count; + UINT32 KernelStatus; + +} DEBUGGER_PREALLOC_COMMAND, *PDEBUGGER_PREALLOC_COMMAND; + +/* ============================================================================================== + */ + +/** + * @brief different types of preactivate requests + * + */ +typedef enum _DEBUGGER_PREACTIVATE_COMMAND_TYPE +{ + DEBUGGER_PREACTIVATE_COMMAND_TYPE_MODE, + +} DEBUGGER_PREACTIVATE_COMMAND_TYPE; + +#define SIZEOF_DEBUGGER_PREACTIVATE_COMMAND \ + sizeof(DEBUGGER_PREACTIVATE_COMMAND) + +/** + * @brief requests for the 'preactivate' command + * + */ +typedef struct _DEBUGGER_PREACTIVATE_COMMAND +{ + DEBUGGER_PREACTIVATE_COMMAND_TYPE Type; + UINT32 KernelStatus; + +} DEBUGGER_PREACTIVATE_COMMAND, *PDEBUGGER_PREACTIVATE_COMMAND; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_READ_MEMORY sizeof(DEBUGGER_READ_MEMORY) + +/** + * @brief different types of reading memory + * + */ +typedef enum _DEBUGGER_READ_READING_TYPE +{ + READ_FROM_KERNEL, + READ_FROM_VMX_ROOT +} DEBUGGER_READ_READING_TYPE; + +/** + * @brief different type of addresses + * + */ +typedef enum _DEBUGGER_READ_MEMORY_TYPE +{ + DEBUGGER_READ_PHYSICAL_ADDRESS, + DEBUGGER_READ_VIRTUAL_ADDRESS +} DEBUGGER_READ_MEMORY_TYPE; + +/** + * @brief the way that debugger should show + * the details of memory or disassemble them + * + */ +typedef enum _DEBUGGER_SHOW_MEMORY_STYLE +{ + DEBUGGER_SHOW_COMMAND_DT = 1, + DEBUGGER_SHOW_COMMAND_DISASSEMBLE64, + DEBUGGER_SHOW_COMMAND_DISASSEMBLE32, + DEBUGGER_SHOW_COMMAND_DB, + DEBUGGER_SHOW_COMMAND_DC, + DEBUGGER_SHOW_COMMAND_DQ, + DEBUGGER_SHOW_COMMAND_DD, + DEBUGGER_SHOW_COMMAND_DUMP +} DEBUGGER_SHOW_MEMORY_STYLE; + +/** + * @brief request for reading virtual and physical memory + * + */ +typedef struct _DEBUGGER_READ_MEMORY +{ + UINT32 Pid; // Read from cr3 of what process + UINT64 Address; + UINT32 Size; + BOOLEAN IsForDisasm; // Debugger sets whether the read memory is for diassembler or not + BOOLEAN Is32BitAddress; // Debuggee sets the status of address + DEBUGGER_READ_MEMORY_TYPE MemoryType; + DEBUGGER_READ_READING_TYPE ReadingType; + PDEBUGGER_DT_COMMAND_OPTIONS DtDetails; + DEBUGGER_SHOW_MEMORY_STYLE Style; // not used in local debugging + UINT32 ReturnLength; // not used in local debugging + UINT32 KernelStatus; // not used in local debugging + + // + // Here is the target buffer (actual memory) + // + +} DEBUGGER_READ_MEMORY, *PDEBUGGER_READ_MEMORY; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_FLUSH_LOGGING_BUFFERS \ + sizeof(DEBUGGER_FLUSH_LOGGING_BUFFERS) + +/** + * @brief request for flushing buffers + * + */ +typedef struct _DEBUGGER_FLUSH_LOGGING_BUFFERS +{ + UINT32 KernelStatus; + UINT32 CountOfMessagesThatSetAsReadFromVmxRoot; + UINT32 CountOfMessagesThatSetAsReadFromVmxNonRoot; + +} DEBUGGER_FLUSH_LOGGING_BUFFERS, *PDEBUGGER_FLUSH_LOGGING_BUFFERS; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_TEST_QUERY_BUFFER \ + sizeof(DEBUGGER_TEST_QUERY_BUFFER) + +/** + * @brief test query used for test purposed + * + */ +typedef enum _DEBUGGER_TEST_QUERY_STATE +{ + TEST_QUERY_HALTING_CORE_STATUS = 1, // Query constant to show detail of halting of core + TEST_QUERY_PREALLOCATED_POOL_STATE = 2, // Query pre-allocated pool state + TEST_QUERY_TRAP_STATE = 3, // Query trap state + TEST_BREAKPOINT_TURN_OFF_BPS = 4, // Turn off the breakpoints (#BP) + TEST_BREAKPOINT_TURN_ON_BPS = 5, // Turn on the breakpoints (#BP) + TEST_BREAKPOINT_TURN_OFF_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 6, // Turn off the breakpoints and events for executing the commands in the remote computer + TEST_BREAKPOINT_TURN_ON_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 7, // Turn on the breakpoints and events for executing the commands in the remote computer + TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_SYNCHRONOUS = 8, // For testing synchronized event + TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_ASYNCHRONOUS = 9, // For testing unsynchronized event + TEST_SETTING_TARGET_TASKS_ON_TARGET_HALTED_CORES = 10, // Send the task to the halted core + TEST_BREAKPOINT_TURN_OFF_DBS = 11, // Turn off the debug breaks (#DB) + TEST_BREAKPOINT_TURN_ON_DBS = 12, // Turn on the debug breaks (#DB) + +} DEBUGGER_TEST_QUERY_STATE; + +/** + * @brief request for test query buffers + * + */ +typedef struct _DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER +{ + DEBUGGER_TEST_QUERY_STATE RequestType; + UINT64 Context; + UINT32 KernelStatus; + +} DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER, *PDEBUGGER_DEBUGGER_TEST_QUERY_BUFFER; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_PERFORM_KERNEL_TESTS \ + sizeof(DEBUGGER_PERFORM_KERNEL_TESTS) + +/** + * @brief request performing kernel tests + * + */ +typedef struct _DEBUGGER_PERFORM_KERNEL_TESTS +{ + UINT32 KernelStatus; + +} DEBUGGER_PERFORM_KERNEL_TESTS, *PDEBUGGER_PERFORM_KERNEL_TESTS; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL \ + sizeof(DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL) + +/** + * @brief request for send a signal that command execution finished + * + */ +typedef struct _DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL +{ + UINT32 KernelStatus; + +} DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL, + *PDEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER \ + sizeof(DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER) + +/** + * @brief request for send general packets from debuggee to debugger + * + */ +typedef struct _DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER +{ + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction; + UINT32 LengthOfBuffer; + BOOLEAN PauseDebuggeeWhenSent; + UINT32 KernelResult; + + // + // The buffer for the general packet is here + // + +} DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER, + *PDEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ + sizeof(DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER) + +/** + * @brief request for send a user-mode message to debugger + * + */ +typedef struct _DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER +{ + UINT32 KernelStatus; + UINT32 Length; + + // + // Here is the messages + // + +} DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER, + *PDEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR \ + sizeof(DEBUGGER_READ_AND_WRITE_ON_MSR) + +/** + * @brief different types of actions on MSRs + * + */ +typedef enum _DEBUGGER_MSR_ACTION_TYPE +{ + DEBUGGER_MSR_READ, + DEBUGGER_MSR_WRITE +} DEBUGGER_MSR_ACTION_TYPE; + +/** + * @brief request to read or write on MSRs + * + */ +typedef struct _DEBUGGER_READ_AND_WRITE_ON_MSR +{ + UINT64 Msr; // It's actually a 32-Bit value but let's not mess with a register + UINT32 CoreNumber; // specifies the core to execute wrmsr or read the msr + // (DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES mean all + // the cores) + DEBUGGER_MSR_ACTION_TYPE + ActionType; // Detects whether user needs wrmsr or rdmsr + UINT64 Value; + +} DEBUGGER_READ_AND_WRITE_ON_MSR, *PDEBUGGER_READ_AND_WRITE_ON_MSR; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_EDIT_MEMORY sizeof(DEBUGGER_EDIT_MEMORY) + +/** + * @brief different type of addresses for editing memory + * + */ +typedef enum _DEBUGGER_EDIT_MEMORY_TYPE +{ + EDIT_PHYSICAL_MEMORY, + EDIT_VIRTUAL_MEMORY +} DEBUGGER_EDIT_MEMORY_TYPE; + +/** + * @brief size of editing memory + * + */ +typedef enum _DEBUGGER_EDIT_MEMORY_BYTE_SIZE +{ + EDIT_BYTE, + EDIT_DWORD, + EDIT_QWORD +} DEBUGGER_EDIT_MEMORY_BYTE_SIZE; + +/** + * @brief request for edit virtual and physical memory + * + */ +typedef struct _DEBUGGER_EDIT_MEMORY +{ + UINT32 Result; // Result from kernel + UINT64 Address; // Target address to modify + UINT32 ProcessId; // specifies the process id + DEBUGGER_EDIT_MEMORY_TYPE MemoryType; // Type of memory + DEBUGGER_EDIT_MEMORY_BYTE_SIZE ByteSize; // Modification size + UINT32 CountOf64Chunks; + UINT32 FinalStructureSize; + UINT32 KernelStatus; // not used in local debugging + +} DEBUGGER_EDIT_MEMORY, *PDEBUGGER_EDIT_MEMORY; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_SEARCH_MEMORY sizeof(DEBUGGER_SEARCH_MEMORY) + +/** + * @brief different types of address for searching on memory + * + */ +typedef enum _DEBUGGER_SEARCH_MEMORY_TYPE +{ + SEARCH_PHYSICAL_MEMORY, + SEARCH_VIRTUAL_MEMORY, + SEARCH_PHYSICAL_FROM_VIRTUAL_MEMORY, + +} DEBUGGER_SEARCH_MEMORY_TYPE; + +/** + * @brief different sizes on searching memory + * + */ +typedef enum _DEBUGGER_SEARCH_MEMORY_BYTE_SIZE +{ + SEARCH_BYTE, + SEARCH_DWORD, + SEARCH_QWORD + +} DEBUGGER_SEARCH_MEMORY_BYTE_SIZE; + +/** + * @brief request for searching memory + * + */ +typedef struct _DEBUGGER_SEARCH_MEMORY +{ + UINT64 Address; // Target address to start searching + UINT64 Length; // Length of bytes to search + UINT32 ProcessId; // specifies the process id + DEBUGGER_SEARCH_MEMORY_TYPE MemoryType; // Type of memory + DEBUGGER_SEARCH_MEMORY_BYTE_SIZE ByteSize; // Modification size + UINT32 CountOf64Chunks; + UINT32 FinalStructureSize; + +} DEBUGGER_SEARCH_MEMORY, *PDEBUGGER_SEARCH_MEMORY; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE \ + sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) + +/** + * @brief request for enable or disable transparent-mode + * + */ +typedef struct _DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE +{ + BOOLEAN IsHide; + + UINT64 CpuidAverage; + UINT64 CpuidStandardDeviation; + UINT64 CpuidMedian; + + UINT64 RdtscAverage; + UINT64 RdtscStandardDeviation; + UINT64 RdtscMedian; + + BOOLEAN TrueIfProcessIdAndFalseIfProcessName; + UINT32 ProcId; + UINT32 LengthOfProcessName; // in the case of !hide name xxx, this parameter + // shows the length of xxx + + UINT64 KernelStatus; /* DEBUGGER_OPERATION_WAS_SUCCESSFUL , + DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER + */ + +} DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, + *PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_PREPARE_DEBUGGEE sizeof(DEBUGGER_PREPARE_DEBUGGEE) + +/** + * @brief request to make this computer to a debuggee + * + */ +typedef struct _DEBUGGER_PREPARE_DEBUGGEE +{ + UINT32 PortAddress; + UINT32 Baudrate; + UINT64 NtoskrnlBaseAddress; + UINT32 Result; // Result from the kernel + CHAR OsName[MAXIMUM_CHARACTER_FOR_OS_NAME]; + +} DEBUGGER_PREPARE_DEBUGGEE, *PDEBUGGER_PREPARE_DEBUGGEE; + +/* ============================================================================================== + */ + +/** + * @brief The structure of changing core packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_CHANGE_CORE_PACKET +{ + UINT32 NewCore; + UINT32 Result; + +} DEBUGGEE_CHANGE_CORE_PACKET, *PDEBUGGEE_CHANGE_CORE_PACKET; + +/* ============================================================================================== + */ +#define SIZEOF_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ + sizeof(DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS) + +/** + * @brief different actions of switchings + * + */ +typedef enum _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE +{ + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS, + +} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE; + +/** + * @brief request for attaching user-mode process + * + */ +typedef struct _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS +{ + BOOLEAN IsStartingNewProcess; + UINT32 ProcessId; + UINT32 ThreadId; + BOOLEAN CheckCallbackAtFirstInstruction; + BOOLEAN Is32Bit; + BOOLEAN IsPaused; // used in switching to threads + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE Action; + UINT32 CountOfActiveDebuggingThreadsAndProcesses; // used in showing the list of active threads/processes + UINT64 Token; + UINT64 Result; + +} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS, + *PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS; + +/* ============================================================================================== + */ +#define SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS \ + sizeof(DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS) + +/** + * @brief different type of process or thread queries + * + */ +typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES +{ + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT = 1, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT = 2, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST = 3, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST = 4, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_PROCESS = 5, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_THREAD = 6, + +} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES; + +/** + * @brief different actions on showing or querying list of process or threads + * + */ +typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS +{ + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_SHOW_INSTANTLY = 1, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT = 2, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_SAVE_DETAILS = 3, + +} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS; + +/** + * @brief The structure of needed information to get the details + * of the process from nt!_EPROCESS and location of needed variables + * + */ +typedef struct _DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS +{ + UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead + ULONG ImageFileNameOffset; // nt!_EPROCESS.ImageFileName + ULONG UniquePidOffset; // nt!_EPROCESS.UniqueProcessId + ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks + +} DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS, *PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS; + +/** + * @brief The structure of needed information to get the details + * of the thread from nt!_ETHREAD and location of needed variables + * + */ +typedef struct _DEBUGGEE_THREAD_LIST_NEEDED_DETAILS +{ + UINT32 ThreadListHeadOffset; // nt!_EPROCESS.ThreadListHead + UINT32 ThreadListEntryOffset; // nt!_ETHREAD.ThreadListEntry + UINT32 CidOffset; // nt!_ETHREAD.Cid + UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead + ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks + UINT64 Process; + +} DEBUGGEE_THREAD_LIST_NEEDED_DETAILS, *PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS; + +/** + * @brief The structure showing list of processes (details of each + * entry) + * + */ +typedef struct _DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY +{ + UINT64 Eprocess; + UINT32 ProcessId; + UINT64 Cr3; + UCHAR ImageFileName[15 + 1]; + +} DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY, *PDEBUGGEE_PROCESS_LIST_DETAILS_ENTRY; + +/** + * @brief The structure showing list of threads (details of each + * entry) + * + */ +typedef struct _DEBUGGEE_THREAD_LIST_DETAILS_ENTRY +{ + UINT64 Eprocess; + UINT64 Ethread; + UINT32 ProcessId; + UINT32 ThreadId; + UCHAR ImageFileName[15 + 1]; + +} DEBUGGEE_THREAD_LIST_DETAILS_ENTRY, *PDEBUGGEE_THREAD_LIST_DETAILS_ENTRY; + +/** + * @brief request for query count of active processes and threads + * + */ +typedef struct _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS +{ + DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededDetails; + DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListNeededDetails; + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES QueryType; + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS QueryAction; + UINT32 Count; + UINT64 Result; + +} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS, + *PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS; + +/* ============================================================================================== + */ + +/** + * @brief The structure for saving the callstack frame of one parameter + * + */ +typedef struct _DEBUGGER_SINGLE_CALLSTACK_FRAME +{ + BOOLEAN IsStackAddressValid; + BOOLEAN IsValidAddress; + BOOLEAN IsExecutable; + UINT64 Value; + BYTE InstructionBytesOnRip[MAXIMUM_CALL_INSTR_SIZE]; + +} DEBUGGER_SINGLE_CALLSTACK_FRAME, *PDEBUGGER_SINGLE_CALLSTACK_FRAME; + +#define SIZEOF_DEBUGGER_CALLSTACK_REQUEST \ + sizeof(DEBUGGER_CALLSTACK_REQUEST) + +/** + * @brief callstack showing method + * + */ +typedef enum _DEBUGGER_CALLSTACK_DISPLAY_METHOD +{ + DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITHOUT_PARAMS, + DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS, + +} DEBUGGER_CALLSTACK_DISPLAY_METHOD; + +/** + * @brief request for callstack frames + * + */ +typedef struct _DEBUGGER_CALLSTACK_REQUEST +{ + BOOLEAN Is32Bit; + UINT32 KernelStatus; + DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod; + UINT32 Size; + UINT32 FrameCount; + UINT64 BaseAddress; + UINT64 BufferSize; + + // + // Here is the size of stack frames + // + +} DEBUGGER_CALLSTACK_REQUEST, *PDEBUGGER_CALLSTACK_REQUEST; + +/* ============================================================================================== + */ +#define SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS \ + sizeof(USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS) + +typedef struct _USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS +{ + UINT32 ProcessId; + UINT32 ThreadId; + BOOLEAN IsProcess; + +} USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS, *PUSERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS; + +/* ============================================================================================== + */ + +/** + * @brief Used for run the script + * + */ +typedef struct _DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION +{ + UINT64 ScriptBuffer; + UINT32 ScriptLength; + UINT32 ScriptPointer; + UINT32 OptionalRequestedBufferSize; + +} DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION, + *PDEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION; + +/** + * @brief used in the case of requesting a "request buffer" + * + */ +typedef struct _DEBUGGER_EVENT_REQUEST_BUFFER +{ + BOOLEAN EnabledRequestBuffer; + UINT32 RequestBufferSize; + UINT64 RequstBufferAddress; + +} DEBUGGER_EVENT_REQUEST_BUFFER, *PDEBUGGER_EVENT_REQUEST_BUFFER; + +/** + * @brief used in the case of custom code requests to the debugger + * + */ +typedef struct _DEBUGGER_EVENT_REQUEST_CUSTOM_CODE +{ + UINT32 CustomCodeBufferSize; + PVOID CustomCodeBufferAddress; + UINT32 OptionalRequestedBufferSize; + +} DEBUGGER_EVENT_REQUEST_CUSTOM_CODE, *PDEBUGGER_EVENT_REQUEST_CUSTOM_CODE; + +/* ============================================================================================== + */ + +/** + * @brief User-mode debugging actions + * + */ +typedef enum _DEBUGGER_UD_COMMAND_ACTION_TYPE +{ + DEBUGGER_UD_COMMAND_ACTION_TYPE_NONE = 0, + DEBUGGER_UD_COMMAND_ACTION_TYPE_PAUSE, + DEBUGGER_UD_COMMAND_ACTION_TYPE_CONTINUE, + DEBUGGER_UD_COMMAND_ACTION_TYPE_REGULAR_STEP, + +} DEBUGGER_UD_COMMAND_ACTION_TYPE; + +/** + * @brief Description of user-mode debugging actions + * + */ +typedef struct _DEBUGGER_UD_COMMAND_ACTION +{ + DEBUGGER_UD_COMMAND_ACTION_TYPE ActionType; + UINT64 OptionalParam1; + UINT64 OptionalParam2; + UINT64 OptionalParam3; + UINT64 OptionalParam4; + +} DEBUGGER_UD_COMMAND_ACTION, *PDEBUGGER_UD_COMMAND_ACTION; + +/** + * @brief The structure of command packet in uHyperDbg + * + */ +typedef struct _DEBUGGER_UD_COMMAND_PACKET +{ + DEBUGGER_UD_COMMAND_ACTION UdAction; + UINT64 ProcessDebuggingDetailToken; + UINT32 TargetThreadId; + BOOLEAN ApplyToAllPausedThreads; + UINT32 Result; + +} DEBUGGER_UD_COMMAND_PACKET, *PDEBUGGER_UD_COMMAND_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Debugger process switch and process details + * + */ +typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE +{ + + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS, + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST, + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH, + +} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE; + +/** + * @brief The structure of changing process and show process + * packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET +{ + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType; + UINT32 ProcessId; + UINT64 Process; + BOOLEAN IsSwitchByClkIntr; + UCHAR ProcessName[16]; + DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListSymDetails; + UINT32 Result; + +} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET + * + */ +#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET \ + sizeof(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET) + +/** + * @brief Debugger thread switch and thread details + * + */ +typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE +{ + + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH, + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS, + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LIST, + +} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE; + +/** + * @brief The structure of changing thead and show thread + * packet in HyperDbg + */ +typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET +{ + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType; + UINT32 ThreadId; + UINT32 ProcessId; + UINT64 Thread; + UINT64 Process; + BOOLEAN CheckByClockInterrupt; + UCHAR ProcessName[16]; + DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListSymDetails; + UINT32 Result; + +} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET; + +/** + * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET + * + */ +#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET \ + sizeof(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET) + +/* ============================================================================================== + */ + +/** + * @brief stepping and tracking types + * + */ +typedef enum _DEBUGGER_REMOTE_STEPPING_REQUEST +{ + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_IN, + DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN, + DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN_FOR_TRACKING, + + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER, + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU, + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU_LAST_INSTRUCTION, + +} DEBUGGER_REMOTE_STEPPING_REQUEST; + +/** + * @brief The structure of stepping packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_STEP_PACKET +{ + DEBUGGER_REMOTE_STEPPING_REQUEST StepType; + + // + // Only in the case of call instructions + // the 'p' command + // + BOOLEAN IsCurrentInstructionACall; + UINT32 CallLength; + +} DEBUGGEE_STEP_PACKET, *PDEBUGGEE_STEP_PACKET; + +/** + * @brief default number of instructions used in tracking and stepping + * + */ +#define DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING 0xffffffff + +/* ============================================================================================== + */ + +/** + * @brief The structure of .formats result packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_FORMATS_PACKET +{ + UINT64 Value; + UINT32 Result; + +} DEBUGGEE_FORMATS_PACKET, *PDEBUGGEE_FORMATS_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of .sym reload packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_SYMBOL_REQUEST_PACKET +{ + UINT32 ProcessId; + +} DEBUGGEE_SYMBOL_REQUEST_PACKET, *PDEBUGGEE_SYMBOL_REQUEST_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of bp command packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_BP_PACKET +{ + UINT64 Address; + UINT32 Pid; + UINT32 Tid; + UINT32 Core; + BOOLEAN RemoveAfterHit; + BOOLEAN CheckForCallbacks; + UINT32 Result; + +} DEBUGGEE_BP_PACKET, *PDEBUGGEE_BP_PACKET; + +/** + * @brief breakpoint modification types + * + */ +typedef enum _DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST +{ + + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS, + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE, + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE, + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR, + +} DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST; + +/** + * @brief The structure of breakpoint modification requests packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_BP_LIST_OR_MODIFY_PACKET +{ + UINT64 BreakpointId; + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST Request; + UINT32 Result; + +} DEBUGGEE_BP_LIST_OR_MODIFY_PACKET, *PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Whether a jump is taken or not taken + * + */ +typedef enum _DEBUGGER_CONDITIONAL_JUMP_STATUS +{ + + DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR = 0, + DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP, + DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN, + DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN, + +} DEBUGGER_CONDITIONAL_JUMP_STATUS; + +/* ============================================================================================== + */ + +/** + * @brief The structure of script packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_SCRIPT_PACKET +{ + UINT32 ScriptBufferSize; + UINT32 ScriptBufferPointer; + BOOLEAN IsFormat; + UINT32 Result; + + // + // The script buffer is here + // + +} DEBUGGEE_SCRIPT_PACKET, *PDEBUGGEE_SCRIPT_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of result of search packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_RESULT_OF_SEARCH_PACKET +{ + UINT32 CountOfResults; + UINT32 Result; + +} DEBUGGEE_RESULT_OF_SEARCH_PACKET, *PDEBUGGEE_RESULT_OF_SEARCH_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Register Descriptor Structure to use in r command. + * + */ +typedef struct _DEBUGGEE_REGISTER_READ_DESCRIPTION +{ + UINT32 RegisterID; // the number is from REGS_ENUM + UINT64 Value; + UINT32 KernelStatus; + +} DEBUGGEE_REGISTER_READ_DESCRIPTION, *PDEBUGGEE_REGISTER_READ_DESCRIPTION; + +/* ============================================================================================== + */ + +/** + * @file Symbols.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Header Files For Symbol Parsing + * @details This file contains definitions of symbol parsers + * @version 0.2 + * @date 2022-06-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Symbols Details // +////////////////////////////////////////////////// + +/** + * @brief structures for sending and saving details + * about each module and symbols details + * + */ +typedef struct _MODULE_SYMBOL_DETAIL +{ + BOOLEAN IsSymbolDetailsFound; // TRUE if the details of symbols found, FALSE if not found + BOOLEAN IsLocalSymbolPath; // TRUE if the ModuleSymbolPath is a real path + // and FALSE if ModuleSymbolPath is just a module name + BOOLEAN IsSymbolPDBAvaliable; // TRUE if the module's pdb is available(if exists in the sympath) + BOOLEAN IsUserMode; // TRUE if the module is a user-mode module + BOOLEAN Is32Bit; // TRUE if the module is a 32-bit + UINT64 BaseAddress; + char FilePath[MAX_PATH]; + char ModuleSymbolPath[MAX_PATH]; + char ModuleSymbolGuidAndAge[MAXIMUM_GUID_AND_AGE_SIZE]; + +} MODULE_SYMBOL_DETAIL, *PMODULE_SYMBOL_DETAIL; + +typedef struct _USERMODE_LOADED_MODULE_SYMBOLS +{ + UINT64 BaseAddress; + UINT64 Entrypoint; + wchar_t FilePath[MAX_PATH]; + +} USERMODE_LOADED_MODULE_SYMBOLS, *PUSERMODE_LOADED_MODULE_SYMBOLS; + +typedef struct _USERMODE_LOADED_MODULE_DETAILS +{ + UINT32 ProcessId; + BOOLEAN OnlyCountModules; + BOOLEAN Is32Bit; + UINT32 ModulesCount; + UINT32 Result; + + // + // Here is a list of USERMODE_LOADED_MODULE_SYMBOLS (appended) + // + +} USERMODE_LOADED_MODULE_DETAILS, *PUSERMODE_LOADED_MODULE_DETAILS; + +/** + * @brief Callback type that should be used to add + * list of Addresses to ObjectNames + * + */ +typedef VOID (*SymbolMapCallback)(UINT64 Address, char * ModuleName, char * ObjectName, unsigned int ObjectSize); + +/** + * @brief request to add new symbol detail or update a previous + * symbol table entry + * + */ +typedef struct _DEBUGGER_UPDATE_SYMBOL_TABLE +{ + UINT32 TotalSymbols; + UINT32 CurrentSymbolIndex; + MODULE_SYMBOL_DETAIL SymbolDetailPacket; + +} DEBUGGER_UPDATE_SYMBOL_TABLE, *PDEBUGGER_UPDATE_SYMBOL_TABLE; + +/** + * @brief check so the DEBUGGER_UPDATE_SYMBOL_TABLE should be smaller than packet size + * + */ +//static_assert(sizeof(DEBUGGER_UPDATE_SYMBOL_TABLE) < PacketChunkSize, +// "err (static_assert), size of PacketChunkSize should be bigger than DEBUGGER_UPDATE_SYMBOL_TABLE (MODULE_SYMBOL_DETAIL)"); + +/* +============================================================================================== + */ + +/** + * @brief request that shows, symbol reload process is finished + * + */ +typedef struct _DEBUGGEE_SYMBOL_UPDATE_RESULT +{ + UINT64 KernelStatus; // Kernel put the status in this field + +} DEBUGGEE_SYMBOL_UPDATE_RESULT, *PDEBUGGEE_SYMBOL_UPDATE_RESULT; + +/* +============================================================================================== + */ + +/** + * @file HardwareDebugger.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's Hardware Debugger (hwdbg) types and constants + * @details This file contains definitions of hwdbg elements + * used in HyperDbg + * @version 0.9 + * @date 2024-04-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Definitions // +////////////////////////////////////////////////// + +/** + * @brief Initial debuggee to debugger offset + * + */ +#define DEFAULT_INITIAL_DEBUGGEE_TO_DEBUGGER_OFFSET 0x200 + +/** + * @brief Initial debugger to debuggee offset + * + */ +#define DEFAULT_INITIAL_DEBUGGER_TO_DEBUGGEE_OFFSET 0x0 + +////////////////////////////////////////////////// +// Enums // +////////////////////////////////////////////////// + +/** + * @brief Different action of hwdbg + * @warning This file should be changed along with hwdbg files + * + */ +typedef enum _HWDBG_ACTION_ENUMS +{ + hwdbgActionSendInstanceInfo = 1, + hwdbgActionConfigureScriptBuffer = 2, + +} HWDBG_ACTION_ENUMS; + +/** + * @brief Different responses come from hwdbg + * @warning This file should be changed along with hwdbg files + * + */ +typedef enum _HWDBG_RESPONSE_ENUMS +{ + hwdbgResponseSuccessOrErrorMessage = 1, + hwdbgResponseInstanceInfo = 2, + +} HWDBG_RESPONSE_ENUMS; + +/** + * @brief Different success or error codes in hwdbg + * @warning This file should be changed along with hwdbg files + * + */ +typedef enum _HWDBG_SUCCESS_OR_ERROR_ENUMS +{ + hwdbgOperationWasSuccessful = 0x7FFFFFFF, + hwdbgErrorInvalidPacket = 1, + +} HWDBG_SUCCESS_OR_ERROR_ENUMS; + +////////////////////////////////////////////////// +// Structures // +////////////////////////////////////////////////// + +/** + * @brief The structure of port information (each item) in hwdbg + * + */ +typedef struct _HWDBG_PORT_INFORMATION_ITEMS +{ + UINT32 PortSize; + +} HWDBG_PORT_INFORMATION_ITEMS, *PHWDBG_PORT_INFORMATION_ITEMS; + +/** + * @brief The structure of script capabilities information in hwdbg + * + */ +typedef struct _HWDBG_INSTANCE_INFORMATION +{ + // + // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE + // + UINT32 version; // Target version of HyperDbg (same as hwdbg) + UINT32 maximumNumberOfStages; // Number of stages that this instance of hwdbg supports (NumberOfSupportedStages == 0 means script engine is disabled) + UINT32 scriptVariableLength; // maximum length of variables (and other script elements) + UINT32 maximumNumberOfSupportedGetScriptOperators; // Maximum supported GET operators in a single func + UINT32 maximumNumberOfSupportedSetScriptOperators; // Maximum supported SET operators in a single func + UINT32 sharedMemorySize; // Size of shared memory + UINT32 debuggerAreaOffset; // The memory offset of debugger + UINT32 debuggeeAreaOffset; // The memory offset of debuggee + UINT32 numberOfPins; // Number of pins + UINT32 numberOfPorts; // Number of ports + + // + // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE + // + + struct _HWDBG_SCRIPT_CAPABILITIES + { + // + // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities + // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file + // + UINT64 func_or : 1; + UINT64 func_xor : 1; + UINT64 func_and : 1; + UINT64 func_asr : 1; + UINT64 func_asl : 1; + UINT64 func_add : 1; + UINT64 func_sub : 1; + UINT64 func_mul : 1; + UINT64 func_div : 1; + UINT64 func_mod : 1; + UINT64 func_gt : 1; + UINT64 func_lt : 1; + UINT64 func_egt : 1; + UINT64 func_elt : 1; + UINT64 func_equal : 1; + UINT64 func_neq : 1; + UINT64 func_jmp : 1; + UINT64 func_jz : 1; + UINT64 func_jnz : 1; + UINT64 func_mov : 1; + UINT64 func_printf : 1; + + // + // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities + // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file + // + + } scriptCapabilities; + + UINT32 bramAddrWidth; // BRAM address width + UINT32 bramDataWidth; // BRAM data width + + // + // Here the details of port arrangements are located (HWDBG_PORT_INFORMATION_ITEMS) + // As the following type: + // HWDBG_PORT_INFORMATION_ITEMS portsConfiguration[numberOfPorts] ; Port arrangement + // + +} HWDBG_INSTANCE_INFORMATION, *PHWDBG_INSTANCE_INFORMATION; + +/** + * @brief The structure of script buffer in hwdbg + * + */ +typedef struct _HWDBG_SCRIPT_BUFFER +{ + UINT32 scriptNumberOfSymbols; // Number of symbols in the script + + // + // Here the script buffer is located + // + // UINT8 scriptBuffer[scriptNumberOfSymbols]; // The script buffer + // + +} HWDBG_SCRIPT_BUFFER, *PHWDBG_SCRIPT_BUFFER; diff --git a/gengo/bind/sdk/merged_headers.h b/gengo/bind/sdk/merged_headers.h new file mode 100644 index 000000000..7d34cb392 --- /dev/null +++ b/gengo/bind/sdk/merged_headers.h @@ -0,0 +1,6008 @@ +//bugfix.h +typedef unsigned short wchar_t; +typedef int bool ; +#define PVOID void* +#define HANDLE void* +#define PIRP void*//todo +#define PDEVICE_OBJECT void*//todo +#define PSYMBOL_BUFFER void*//todo +#define PSYMBOL void*//todo +#define MAX_PATH 260 +typedef unsigned __int64 SIZE_T,*PSIZE_T; +typedef unsigned __int64 time_t; +typedef unsigned __int64 NTSTATUS; +typedef char * va_list; + +typedef struct _LIST_ENTRY { + struct _LIST_ENTRY *Flink; + struct _LIST_ENTRY *Blink; +} LIST_ENTRY, *PLIST_ENTRY, PRLIST_ENTRY; + +#ifndef _In_ +#define _In_ +#endif + +#ifndef _Out_ +#define _Out_ +#endif + +#ifndef _Inout_ +#define _Inout_ +#endif + +#ifndef _Out_writes_bytes_ +#define _Out_writes_bytes_(x) +#endif + +#ifndef _In_reads_ +#define _In_reads_(x) +#endif + +#ifndef _In_reads_bytes_ +#define _In_reads_bytes_(x) +#endif + +/* +typedef struct _IRP { + CSHORT Type; + USHORT Size; + PMDL MdlAddress; + ULONG Flags; + union { + struct _IRP *MasterIrp; + __volatile LONG IrpCount; + PVOID SystemBuffer; + } AssociatedIrp; + LIST_ENTRY ThreadListEntry; + IO_STATUS_BLOCK IoStatus; + KPROCESSOR_MODE RequestorMode; + BOOLEAN PendingReturned; + CHAR StackCount; + CHAR CurrentLocation; + BOOLEAN Cancel; + KIRQL CancelIrql; + CCHAR ApcEnvironment; + UCHAR AllocationFlags; + union { + PIO_STATUS_BLOCK UserIosb; + PVOID IoRingContext; + }; + PKEVENT UserEvent; + union { + struct { + union { + PIO_APC_ROUTINE UserApcRoutine; + PVOID IssuingProcess; + }; + union { + PVOID UserApcContext; +#if ... + _IORING_OBJECT *IoRing; +#else + struct _IORING_OBJECT *IoRing; +#endif + }; + } AsynchronousParameters; + LARGE_INTEGER AllocationSize; + } Overlay; + __volatile PDRIVER_CANCEL CancelRoutine; + PVOID UserBuffer; + union { + struct { + union { + KDEVICE_QUEUE_ENTRY DeviceQueueEntry; + struct { + PVOID DriverContext[4]; + }; + }; + PETHREAD Thread; + PCHAR AuxiliaryBuffer; + struct { + LIST_ENTRY ListEntry; + union { + struct _IO_STACK_LOCATION *CurrentStackLocation; + ULONG PacketType; + }; + }; + PFILE_OBJECT OriginalFileObject; + } Overlay; + KAPC Apc; + PVOID CompletionKey; + } Tail; +} IRP; +*/ + + + + +//..\..\..\bin\debug\SDK\Headers\BasicTypes.h +/** + * @file BasicTypes.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers For Basic Datatypes + * @details This file contains definitions of basic datatypes + * @version 0.2 + * @date 2022-06-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#pragma warning(disable : 4201) // Suppress nameless struct/union warning + +////////////////////////////////////////////////// +// Basic Datatypes // +////////////////////////////////////////////////// + +typedef unsigned long long QWORD; +typedef unsigned __int64 UINT64, *PUINT64; +typedef unsigned long DWORD; +typedef int BOOL; +typedef unsigned char BYTE; +typedef unsigned short WORD; +typedef int INT; +typedef unsigned int UINT; +typedef unsigned int * PUINT; +typedef unsigned __int64 ULONG64, *PULONG64; +typedef unsigned __int64 DWORD64, *PDWORD64; +typedef char CHAR; +typedef wchar_t WCHAR; +#define VOID void + +typedef unsigned char UCHAR; +typedef unsigned short USHORT; +typedef unsigned long ULONG; + +typedef UCHAR BOOLEAN; // winnt +typedef BOOLEAN * PBOOLEAN; // winnt + +typedef signed char INT8, *PINT8; +typedef signed short INT16, *PINT16; +typedef signed int INT32, *PINT32; +typedef signed __int64 INT64, *PINT64; +typedef unsigned char UINT8, *PUINT8; +typedef unsigned short UINT16, *PUINT16; +typedef unsigned int UINT32, *PUINT32; +typedef unsigned __int64 UINT64, *PUINT64; + +#define NULL_ZERO 0 +#define NULL64_ZERO 0ull + +#define FALSE 0 +#define TRUE 1 + +#define UPPER_56_BITS 0xffffffffffffff00 +#define UPPER_48_BITS 0xffffffffffff0000 +#define UPPER_32_BITS 0xffffffff00000000 +#define LOWER_32_BITS 0x00000000ffffffff +#define LOWER_16_BITS 0x000000000000ffff +#define LOWER_8_BITS 0x00000000000000ff +#define SECOND_LOWER_8_BITS 0x000000000000ff00 +#define UPPER_48_BITS_AND_LOWER_8_BITS 0xffffffffffff00ff + +// +// DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA +// +typedef struct GUEST_REGS +{ + // + // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA + // + + UINT64 rax; // 0x00 + UINT64 rcx; // 0x08 + UINT64 rdx; // 0x10 + UINT64 rbx; // 0x18 + UINT64 rsp; // 0x20 + UINT64 rbp; // 0x28 + UINT64 rsi; // 0x30 + UINT64 rdi; // 0x38 + UINT64 r8; // 0x40 + UINT64 r9; // 0x48 + UINT64 r10; // 0x50 + UINT64 r11; // 0x58 + UINT64 r12; // 0x60 + UINT64 r13; // 0x68 + UINT64 r14; // 0x70 + UINT64 r15; // 0x78 + + // + // DO NOT FUCKING TOUCH THIS STRUCTURE WITHOUT COORDINATION WITH SINA + // + +} GUEST_REGS, *PGUEST_REGS; + +/** + * @brief struct for extra registers + * + */ +typedef struct GUEST_EXTRA_REGISTERS +{ + UINT16 CS; + UINT16 DS; + UINT16 FS; + UINT16 GS; + UINT16 ES; + UINT16 SS; + UINT64 RFLAGS; + UINT64 RIP; +} GUEST_EXTRA_REGISTERS, *PGUEST_EXTRA_REGISTERS; + +/** + * @brief List of different variables + */ +typedef struct _SCRIPT_ENGINE_VARIABLES_LIST +{ + UINT64 * TempList; + UINT64 * GlobalVariablesList; + UINT64 * LocalVariablesList; + +} SCRIPT_ENGINE_VARIABLES_LIST, *PSCRIPT_ENGINE_VARIABLES_LIST; + +/** + * @brief CR3 Structure + * + */ +typedef struct _CR3_TYPE +{ + union + { + UINT64 Flags; + + struct + { + UINT64 Pcid : 12; + UINT64 PageFrameNumber : 36; + UINT64 Reserved1 : 12; + UINT64 Reserved_2 : 3; + UINT64 PcidInvalidate : 1; + } Fields; + }; +} CR3_TYPE, *PCR3_TYPE; + + +//..\..\..\bin\debug\SDK\Headers\Connection.h +/** + * @file Connection.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers For Native Structures, Enums and Constants + * @details These datatypes are used in all devices like HDL (FPGAs) + * @version 0.2 + * @date 2022-07-14 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +/** + * @brief enum for reasons why debuggee is paused + * + */ +typedef enum _DEBUGGEE_PAUSING_REASON +{ + + // + // For both kernel & user debugger + // + DEBUGGEE_PAUSING_REASON_NOT_PAUSED = 0, + DEBUGGEE_PAUSING_REASON_PAUSE, + DEBUGGEE_PAUSING_REASON_REQUEST_FROM_DEBUGGER, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_STEPPED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_TRACKING_STEPPED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_HARDWARE_DEBUG_REGISTER_HIT, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_CORE_SWITCHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_PROCESS_SWITCHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_THREAD_SWITCHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_COMMAND_EXECUTION_FINISHED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_EVENT_TRIGGERED, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED, + + // + // Only for user-debugger + // + DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_DEBUG_BREAK, + DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED, + + // + // Only used for hardware debugging + // + DEBUGGEE_PAUSING_REASON_HARDWARE_BASED_DEBUGGEE_GENERAL_BREAK, + +} DEBUGGEE_PAUSING_REASON; + +/** + * @brief enum for requested action for HyperDbg packet + * + */ +typedef enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION +{ + + // + // Debugger to debuggee (user-mode execution) + // + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_PAUSE = 1, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DO_NOT_READ_ANY_PACKET, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_USER_MODE_DEBUGGER_VERSION, + + // + // Debuggee to debugger (user-mode execution) + // + DEBUGGER_REMOTE_PACKET_PING_AND_SEND_SUPPORTED_VERSION, + + // + // Debugger to debuggee (vmx-root mode execution) + // + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_STEP, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CONTINUE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CLOSE_AND_UNLOAD_DEBUGGEE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_CORE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_FLUSH_BUFFERS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CALLSTACK, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_TEST_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_PROCESS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_THREAD, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_USER_INPUT_BUFFER, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SEARCH_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_REGISTER_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_ADD_ACTION_TO_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_AND_MODIFY_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_REGISTERS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_EDIT_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_BP, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_LIST_OR_MODIFY_BREAKPOINTS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_RELOAD, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_PA2VA_AND_VA2PA, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SYMBOL_QUERY_PTE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_SET_SHORT_CIRCUITING_STATE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_INJECT_PAGE_FAULT, + + // + // Debuggee to debugger + // + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_NO_ACTION, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_STARTED, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_LOGGING_MECHANISM, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_PAUSED_AND_CURRENT_INSTRUCTION, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_CORE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_PROCESS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_THREAD, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_RUNNING_SCRIPT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FORMATS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FLUSH, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CALLSTACK, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_TEST_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_REGISTERING_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_ADDING_ACTION_TO_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_QUERY_AND_MODIFY_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_EVENT, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_REGISTERS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_EDITING_MEMORY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BP, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_SHORT_CIRCUITING_STATE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_LIST_OR_MODIFY_BREAKPOINTS, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_UPDATE_SYMBOL_INFO, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SYMBOL_FINISHED, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RELOAD_SEARCH_QUERY, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_PTE, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_VA2PA_AND_PA2VA, + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_BRINGING_PAGES_IN, + + // + // hardware debuggee to debugger + // + + // + // hardware debugger to debuggee + // + +} DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION; + +/** + * @brief enum for different packet types in HyperDbg packets + * @warning used in hwdbg + * + */ +typedef enum _DEBUGGER_REMOTE_PACKET_TYPE +{ + + // + // Debugger to debuggee (vmx-root) + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT = 1, + + // + // Debugger to debuggee (user-mode) + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_USER_MODE = 2, + + // + // Debuggee to debugger (user-mode and kernel-mode, vmx-root mode) + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER = 3, + + // + // Debugger to debuggee (hardware), used in hwdbg + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_HARDWARE_LEVEL = 4, + + // + // Debuggee to debugger (hardware), used in hwdbg + // + DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER_HARDWARE_LEVEL = 5, + +} DEBUGGER_REMOTE_PACKET_TYPE; + +/** + * @brief The structure of remote packets in HyperDbg + * + */ +typedef struct _DEBUGGER_REMOTE_PACKET +{ + BYTE Checksum; + UINT64 Indicator; /* Shows the type of the packet */ + DEBUGGER_REMOTE_PACKET_TYPE TypeOfThePacket; + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedActionOfThePacket; + +} DEBUGGER_REMOTE_PACKET, *PDEBUGGER_REMOTE_PACKET; + + +//..\..\..\bin\debug\SDK\Headers\Constants.h +/** + * @file Constants.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK constants + * @details This file contains definitions of constants + * used in HyperDbg + * @version 0.2 + * @date 2022-06-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Version Information // +////////////////////////////////////////////////// + +#define VERSION_MAJOR 1 +#define VERSION_MINOR 0 +#define VERSION_PATCH 0 + +// +// Example of __DATE__ string: "Jul 27 2012" +// 01234567890 + +#define BUILD_YEAR_CH0 (__DATE__[7]) +#define BUILD_YEAR_CH1 (__DATE__[8]) +#define BUILD_YEAR_CH2 (__DATE__[9]) +#define BUILD_YEAR_CH3 (__DATE__[10]) + +#define BUILD_MONTH_IS_JAN (__DATE__[0] == 'J' && __DATE__[1] == 'a' && __DATE__[2] == 'n') +#define BUILD_MONTH_IS_FEB (__DATE__[0] == 'F') +#define BUILD_MONTH_IS_MAR (__DATE__[0] == 'M' && __DATE__[1] == 'a' && __DATE__[2] == 'r') +#define BUILD_MONTH_IS_APR (__DATE__[0] == 'A' && __DATE__[1] == 'p') +#define BUILD_MONTH_IS_MAY (__DATE__[0] == 'M' && __DATE__[1] == 'a' && __DATE__[2] == 'y') +#define BUILD_MONTH_IS_JUN (__DATE__[0] == 'J' && __DATE__[1] == 'u' && __DATE__[2] == 'n') +#define BUILD_MONTH_IS_JUL (__DATE__[0] == 'J' && __DATE__[1] == 'u' && __DATE__[2] == 'l') +#define BUILD_MONTH_IS_AUG (__DATE__[0] == 'A' && __DATE__[1] == 'u') +#define BUILD_MONTH_IS_SEP (__DATE__[0] == 'S') +#define BUILD_MONTH_IS_OCT (__DATE__[0] == 'O') +#define BUILD_MONTH_IS_NOV (__DATE__[0] == 'N') +#define BUILD_MONTH_IS_DEC (__DATE__[0] == 'D') + +#define BUILD_MONTH_CH0 \ + ((BUILD_MONTH_IS_OCT || BUILD_MONTH_IS_NOV || BUILD_MONTH_IS_DEC) ? '1' : '0') + +#define BUILD_MONTH_CH1 \ + ( \ + (BUILD_MONTH_IS_JAN) ? '1' : (BUILD_MONTH_IS_FEB) ? '2' \ + : (BUILD_MONTH_IS_MAR) ? '3' \ + : (BUILD_MONTH_IS_APR) ? '4' \ + : (BUILD_MONTH_IS_MAY) ? '5' \ + : (BUILD_MONTH_IS_JUN) ? '6' \ + : (BUILD_MONTH_IS_JUL) ? '7' \ + : (BUILD_MONTH_IS_AUG) ? '8' \ + : (BUILD_MONTH_IS_SEP) ? '9' \ + : (BUILD_MONTH_IS_OCT) ? '0' \ + : (BUILD_MONTH_IS_NOV) ? '1' \ + : (BUILD_MONTH_IS_DEC) ? '2' \ + : /* error default */ '?') + +#define BUILD_DAY_CH0 ((__DATE__[4] >= '0') ? (__DATE__[4]) : '0') +#define BUILD_DAY_CH1 (__DATE__[5]) + +// +// Example of __TIME__ string: "21:06:19" +// 01234567 + +#define BUILD_HOUR_CH0 (__TIME__[0]) +#define BUILD_HOUR_CH1 (__TIME__[1]) + +#define BUILD_MIN_CH0 (__TIME__[3]) +#define BUILD_MIN_CH1 (__TIME__[4]) + +#define BUILD_SEC_CH0 (__TIME__[6]) +#define BUILD_SEC_CH1 (__TIME__[7]) + +#if VERSION_MAJOR > 100 + +# define VERSION_MAJOR_INIT \ + ((VERSION_MAJOR / 100) + '0'), \ + (((VERSION_MAJOR % 100) / 10) + '0'), \ + ((VERSION_MAJOR % 10) + '0') + +#elif VERSION_MAJOR > 10 + +# define VERSION_MAJOR_INIT \ + ((VERSION_MAJOR / 10) + '0'), \ + ((VERSION_MAJOR % 10) + '0') + +#else + +# define VERSION_MAJOR_INIT \ + (VERSION_MAJOR + '0') + +#endif + +#if VERSION_MINOR > 100 + +# define VERSION_MINOR_INIT \ + ((VERSION_MINOR / 100) + '0'), \ + (((VERSION_MINOR % 100) / 10) + '0'), \ + ((VERSION_MINOR % 10) + '0') + +#elif VERSION_MINOR > 10 + +# define VERSION_MINOR_INIT \ + ((VERSION_MINOR / 10) + '0'), \ + ((VERSION_MINOR % 10) + '0') + +#else + +# define VERSION_MINOR_INIT \ + (VERSION_MINOR + '0') + +#endif + +#if VERSION_PATCH > 100 + +# define VERSION_PATCH_INIT \ + ((VERSION_PATCH / 100) + '0'), \ + (((VERSION_PATCH % 100) / 10) + '0'), \ + ((VERSION_PATCH % 10) + '0') + +#elif VERSION_PATCH > 10 + +# define VERSION_PATCH_INIT \ + ((VERSION_PATCH / 10) + '0'), \ + ((VERSION_PATCH % 10) + '0') + +#else + +# define VERSION_PATCH_INIT \ + (VERSION_PATCH + '0') + +#endif + +#ifndef HYPERDBG_KERNEL_MODE + +const unsigned char BuildDateTime[] = { + BUILD_YEAR_CH0, + BUILD_YEAR_CH1, + BUILD_YEAR_CH2, + BUILD_YEAR_CH3, + '-', + BUILD_MONTH_CH0, + BUILD_MONTH_CH1, + '-', + BUILD_DAY_CH0, + BUILD_DAY_CH1, + ' ', + BUILD_HOUR_CH0, + BUILD_HOUR_CH1, + ':', + BUILD_MIN_CH0, + BUILD_MIN_CH1, + ':', + BUILD_SEC_CH0, + BUILD_SEC_CH1, + + '\0'}; + +const unsigned char CompleteVersion[] = { + 'v', + VERSION_MAJOR_INIT, + '.', + VERSION_MINOR_INIT, + '.', + VERSION_PATCH_INIT, + '\0'}; + +const unsigned char BuildVersion[] = { + BUILD_YEAR_CH0, + BUILD_YEAR_CH1, + BUILD_YEAR_CH2, + BUILD_YEAR_CH3, + BUILD_MONTH_CH0, + BUILD_MONTH_CH1, + BUILD_DAY_CH0, + BUILD_DAY_CH1, + '.', + BUILD_HOUR_CH0, + BUILD_HOUR_CH1, + BUILD_MIN_CH0, + BUILD_MIN_CH1, + + '\0'}; + +const unsigned char BuildSignature[] = { + VERSION_MAJOR_INIT, + '.', + VERSION_MINOR_INIT, + '.', + VERSION_PATCH_INIT, + '-', + BUILD_YEAR_CH0, + BUILD_YEAR_CH1, + BUILD_YEAR_CH2, + BUILD_YEAR_CH3, + BUILD_MONTH_CH0, + BUILD_MONTH_CH1, + BUILD_DAY_CH0, + BUILD_DAY_CH1, + '.', + BUILD_HOUR_CH0, + BUILD_HOUR_CH1, + BUILD_MIN_CH0, + BUILD_MIN_CH1, + + '\0'}; + +#endif // SCRIPT_ENGINE_KERNEL_MODE + +////////////////////////////////////////////////// +// Message Tracing // +////////////////////////////////////////////////// + +/** + * @brief Default buffer count of packets for message tracing + * @details number of packets storage for regular buffers + */ +#define MaximumPacketsCapacity 1000 + +/** + * @brief Default buffer count of packets for message tracing + * @details number of packets storage for priority buffers + */ +#define MaximumPacketsCapacityPriority 50 + +/** + * @brief Size of normal OS (processor) pages + */ +#define NORMAL_PAGE_SIZE 4096 // PAGE_SIZE + +/** + * @brief Size of each packet + */ +#define PacketChunkSize NORMAL_PAGE_SIZE + +/** + * @brief size of user-mode buffer + * @details Because of operation code at the start of the + * buffer + 1 for null-termminating + * + */ +#define UsermodeBufferSize sizeof(UINT32) + PacketChunkSize + 1 + +/** + * @brief size of buffer for serial + * @details the maximum packet size for sending over serial + * + */ +#define MaxSerialPacketSize 10 * NORMAL_PAGE_SIZE + +/** + * @brief Final storage size of message tracing + * + */ +#define LogBufferSize \ + MaximumPacketsCapacity *(PacketChunkSize + sizeof(BUFFER_HEADER)) + +/** + * @brief Final storage size of message tracing + * + */ +#define LogBufferSizePriority \ + MaximumPacketsCapacityPriority *(PacketChunkSize + sizeof(BUFFER_HEADER)) + +/** + * @brief limitation of Windows DbgPrint message size + * @details currently is not functional + * + */ +#define DbgPrintLimitation 512 + +/** + * @brief The seeds that user-mode codes use as the starter + * of their events' tag + * + */ +#define DebuggerEventTagStartSeed 0x1000000 + +/** + * @brief The seeds that user-mode thread detail token start with it + * @details This seed should not start with zero (0), otherwise it's + * interpreted as error + */ +#define DebuggerThreadDebuggingTagStartSeed 0x1000000 + +/** + * @brief The seeds that user-mode codes use as the starter + * of their output source tag + * + */ +#define DebuggerOutputSourceTagStartSeed 0x1 + +/** + * @brief Determines how many sources a debugger can have for + * a single event + * + */ +#define DebuggerOutputSourceMaximumRemoteSourceForSingleEvent 0x5 + +/** + * @brief The size of each chunk of memory used in the 'memcpy' function + * of the script engine for transferring buffers in the VMX-root mode + * + */ +#define DebuggerScriptEngineMemcpyMovingBufferSize 64 + +////////////////////////////////////////////////// +// EPT Hook // +////////////////////////////////////////////////// + +/** + * @brief Maximum number of initial pre-allocated EPT hooks + * + */ +#define MAXIMUM_NUMBER_OF_INITIAL_PREALLOCATED_EPT_HOOKS 5 + +////////////////////////////////////////////////// +// Instant Event Configs // +////////////////////////////////////////////////// + +/** + * @brief Maximum number of (regular) instant events that are pre-allocated + * + */ +#define MAXIMUM_REGULAR_INSTANT_EVENTS 20 + +/** + * @brief Maximum number of (big) instant events that are pre-allocated + * + */ +#define MAXIMUM_BIG_INSTANT_EVENTS 0 + +/** + * @brief Pre-allocated size for a regular event + conditions buffer + * + */ +#define REGULAR_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + 100 + +/** + * @brief Pre-allocated size for a big event + conditions buffer + * + */ +#define BIG_INSTANT_EVENT_CONDITIONAL_BUFFER sizeof(DEBUGGER_EVENT) + PAGE_SIZE + +/** + * @brief Pre-allocated size for a regular action + custom code or script buffer + * + */ +#define REGULAR_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + (PAGE_SIZE * 2) + +/** + * @brief Pre-allocated size for a big action + custom code or script buffer + * + */ +#define BIG_INSTANT_EVENT_ACTION_BUFFER sizeof(DEBUGGER_EVENT_ACTION) + MaxSerialPacketSize + +/** + * @brief Pre-allocated size for a regular requested safe buffer + * + */ +#define REGULAR_INSTANT_EVENT_REQUESTED_SAFE_BUFFER PAGE_SIZE + +/** + * @brief Pre-allocated size for a big requested safe buffer + * + */ +#define BIG_INSTANT_EVENT_REQUESTED_SAFE_BUFFER MaxSerialPacketSize + +////////////////////////////////////////////////// +// Remote Connection // +////////////////////////////////////////////////// + +/** + * @brief default port of HyperDbg for listening by + * debuggee (server, guest) + * + */ +#define DEFAULT_PORT "50000" + +/** + * @brief Packet size for TCP connections + * @details Note that we might add something to the kernel buffers + * that's why we add 0x100 to it + */ +#define COMMUNICATION_BUFFER_SIZE PacketChunkSize + 0x100 + +////////////////////////////////////////////////// +// VMCALL Numbers // +////////////////////////////////////////////////// + +/** + * @brief The start number of VMCALL number allowed to be + * used by top-level drivers + * + */ +#define TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER 0x00000200 + +/** + * @brief The start number of VMCALL number allowed to be + * used by top-level drivers + * + */ +#define TOP_LEVEL_DRIVERS_VMCALL_ENDING_NUMBER TOP_LEVEL_DRIVERS_VMCALL_STARTING_NUMBER + 0x100 + +////////////////////////////////////////////////// +// Operation Codes // +////////////////////////////////////////////////// + +/** + * @brief If a operation use this bit in its Operation code, + * then it means that the operation should be performed + * mandatorily in debuggee and should not be sent to the debugger + */ +#define OPERATION_MANDATORY_DEBUGGEE_BIT (1 << 31) + +/** + * @brief Message logs id that comes from kernel-mode to + * user-mode + * @details Message area >= 0x5 + */ +#define OPERATION_LOG_INFO_MESSAGE 1U +#define OPERATION_LOG_WARNING_MESSAGE 2U +#define OPERATION_LOG_ERROR_MESSAGE 3U +#define OPERATION_LOG_NON_IMMEDIATE_MESSAGE 4U +#define OPERATION_LOG_WITH_TAG 5U + +#define OPERATION_COMMAND_FROM_DEBUGGER_CLOSE_AND_UNLOAD_VMM \ + 6U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_USER_INPUT 7U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_REGISTER_EVENT 8U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_ADD_ACTION_TO_EVENT \ + 9 | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_CLEAR_EVENTS 10U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_DEBUGGEE_CLEAR_EVENTS_WITHOUT_NOTIFYING_DEBUGGER 11U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED \ + 12U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS \ + 13U | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_COMMAND_FROM_DEBUGGER_RELOAD_SYMBOL \ + 14U | OPERATION_MANDATORY_DEBUGGEE_BIT + +#define OPERATION_NOTIFICATION_FROM_USER_DEBUGGER_PAUSE \ + 15U | OPERATION_MANDATORY_DEBUGGEE_BIT + +////////////////////////////////////////////////// +// Breakpoints & Debug Breakpoints // +////////////////////////////////////////////////// + +/** + * @brief maximum number of buffers to be allocated for a single + * breakpoint + */ +#define MAXIMUM_BREAKPOINTS_WITHOUT_CONTINUE 100 + +/** + * @brief maximum number of thread/process ids to be allocated for a simultaneous + * debugging + * @details it shows the maximum number of threads/processes that HyperDbg sets + * trap flag for them + * + */ +#define MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_TRAPS 200 + +////////////////////////////////////////////////// +// Pool tags used in HyperDbg // +////////////////////////////////////////////////// + +/** + * @brief Pool tag + * + */ +#define POOLTAG 0x48444247 // [H]yper[DBG] (HDBG) + +////////////////////////////////////////////////// +// End of Buffer Detection // +////////////////////////////////////////////////// + +/** + * @brief count of characters for serial end of buffer + */ +#define SERIAL_END_OF_BUFFER_CHARS_COUNT 0x4 + +/** + * @brief characters of the buffer that we set at the end of + * buffers for serial + */ +#define SERIAL_END_OF_BUFFER_CHAR_1 0x00 +#define SERIAL_END_OF_BUFFER_CHAR_2 0x80 +#define SERIAL_END_OF_BUFFER_CHAR_3 0xEE +#define SERIAL_END_OF_BUFFER_CHAR_4 0xFF + +/** + * @brief count of characters for tcp end of buffer + */ +#define TCP_END_OF_BUFFER_CHARS_COUNT 0x4 + +/** + * @brief characters of the buffer that we set at the end of + * buffers for tcp + */ +#define TCP_END_OF_BUFFER_CHAR_1 0x10 +#define TCP_END_OF_BUFFER_CHAR_2 0x20 +#define TCP_END_OF_BUFFER_CHAR_3 0x33 +#define TCP_END_OF_BUFFER_CHAR_4 0x44 + +////////////////////////////////////////////////// +// Name of OS // +////////////////////////////////////////////////// + +/** + * @brief maximum name for OS name buffer + * + */ +#define MAXIMUM_CHARACTER_FOR_OS_NAME 256 + +////////////////////////////////////////////////// +// Processor Details // +////////////////////////////////////////////////// + +/** + * @brief maximum instruction size in Intel + */ +#define MAXIMUM_INSTR_SIZE 16 + +/** + * @brief maximum size for call instruction in Intel + */ +#define MAXIMUM_CALL_INSTR_SIZE 7 + +////////////////////////////////////////////////// +// Symbols Details // +////////////////////////////////////////////////// + +/** + * @brief maximum supported modules to load + * their symbol information + */ +#define MAXIMUM_SUPPORTED_SYMBOLS 1000 + +/** + * @brief maximum size for GUID and Age of PE + * @detail It seems that 33 bytes is enough but let's + * have more space because there might be sth that we + * missed :) + */ +#define MAXIMUM_GUID_AND_AGE_SIZE 60 + +////////////////////////////////////////////////// +// Debuggee Communication // +////////////////////////////////////////////////// + +/** + * @brief constant indicator of a HyperDbg packet + * @warning used in hwdbg + * + */ +#define INDICATOR_OF_HYPERDBG_PACKET \ + 0x4859504552444247 // HYPERDBG = 0x4859504552444247 + +////////////////////////////////////////////////// +// Command Details // +////////////////////////////////////////////////// + +/** + * @brief maximum results that will be returned by !s* s* + * command + * + */ +#define MaximumSearchResults 0x1000 + +////////////////////////////////////////////////// +// Script Engine // +////////////////////////////////////////////////// + +/** + * @brief EFLAGS/RFLAGS + * + */ +#define X86_FLAGS_CF (1 << 0) +#define X86_FLAGS_PF (1 << 2) +#define X86_FLAGS_AF (1 << 4) +#define X86_FLAGS_ZF (1 << 6) +#define X86_FLAGS_SF (1 << 7) +#define X86_FLAGS_TF (1 << 8) +#define X86_FLAGS_IF (1 << 9) +#define X86_FLAGS_DF (1 << 10) +#define X86_FLAGS_OF (1 << 11) +#define X86_FLAGS_STATUS_MASK (0xfff) +#define X86_FLAGS_IOPL_MASK (3 << 12) +#define X86_FLAGS_IOPL_SHIFT (12) +#define X86_FLAGS_IOPL_SHIFT_2ND_BIT (13) +#define X86_FLAGS_NT (1 << 14) +#define X86_FLAGS_RF (1 << 16) +#define X86_FLAGS_VM (1 << 17) +#define X86_FLAGS_AC (1 << 18) +#define X86_FLAGS_VIF (1 << 19) +#define X86_FLAGS_VIP (1 << 20) +#define X86_FLAGS_ID (1 << 21) +#define X86_FLAGS_RESERVED_ONES 0x2 +#define X86_FLAGS_RESERVED 0xffc0802a + +#define X86_FLAGS_RESERVED_BITS 0xffc38028 +#define X86_FLAGS_FIXED 0x00000002 + +#ifndef LOWORD +# define LOWORD(l) ((WORD)(l)) +#endif // !LOWORD + +#ifndef HIWORD +# define HIWORD(l) ((WORD)(((DWORD)(l) >> 16) & 0xFFFF)) +#endif // !HIWORD + +#ifndef LOBYTE +# define LOBYTE(w) ((BYTE)(w)) +#endif // !LOBYTE + +#ifndef HIBYTE +# define HIBYTE(w) ((BYTE)(((WORD)(w) >> 8) & 0xFF)) +#endif // !HIBYTE + +#define MAX_TEMP_COUNT 128 + +#define MAX_STACK_BUFFER_COUNT 128 + +// TODO: Extract number of variables from input of ScriptEngine +// and allocate variableList Dynamically. +#define MAX_VAR_COUNT 512 + +#define MAX_FUNCTION_NAME_LENGTH 32 + +////////////////////////////////////////////////// +// Debugger // +////////////////////////////////////////////////// + +/** + * @brief Apply event modifications to all tags + * + */ +#define DEBUGGER_MODIFY_EVENTS_APPLY_TO_ALL_TAG 0xffffffffffffffff + +/** + * @brief Maximum length for a function (to be used in showing distance + * from symbol functions in the 'u' command) + * + */ +#define DISASSEMBLY_MAXIMUM_DISTANCE_FROM_OBJECT_NAME 0xffff + +/** + * @brief Read and write MSRs to all cores + * + */ +#define DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES 0xffffffff + +/** + * @brief Apply the event to all the cores + * + */ +#define DEBUGGER_DEBUGGEE_IS_RUNNING_NO_CORE 0xffffffff + +/** + * @brief Apply the event to all the cores + * + */ +#define DEBUGGER_EVENT_APPLY_TO_ALL_CORES 0xffffffff + +/** + * @brief Apply the event to all the processes + * + */ +#define DEBUGGER_EVENT_APPLY_TO_ALL_PROCESSES 0xffffffff + +/** + * @brief Apply to all Model Specific Registers + * + */ +#define DEBUGGER_EVENT_MSR_READ_OR_WRITE_ALL_MSRS 0xffffffff + +/** + * @brief Apply to all first 32 exceptions + * + */ +#define DEBUGGER_EVENT_EXCEPTIONS_ALL_FIRST_32_ENTRIES 0xffffffff + +/** + * @brief Apply to all syscalls and sysrets + * + */ +#define DEBUGGER_EVENT_SYSCALL_ALL_SYSRET_OR_SYSCALLS 0xffffffff + +/** + * @brief Apply to all I/O ports + * + */ +#define DEBUGGER_EVENT_ALL_IO_PORTS 0xffffffff + +/** + * @brief The constant to apply to all cores for bp command + * + */ +#define DEBUGGEE_BP_APPLY_TO_ALL_CORES 0xffffffff + +/** + * @brief The constant to apply to all processes for bp command + * + */ +#define DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES 0xffffffff + +/** + * @brief The constant to apply to all threads for bp command + * + */ +#define DEBUGGEE_BP_APPLY_TO_ALL_THREADS 0xffffffff + +/** + * @brief for reading all registers in r command. + * + */ +#define DEBUGGEE_SHOW_ALL_REGISTERS 0xffffffff + + +//..\..\..\bin\debug\SDK\Headers\DataTypes.h +/** + * @file DataTypes.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK data type definitions + * @details This file contains definitions of structures, enums, etc. + * used in HyperDbg + * @version 0.2 + * @date 2022-06-22 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Memory Stages // +////////////////////////////////////////////////// + +/** + * @brief Different levels of paging + * + */ +typedef enum _PAGING_LEVEL +{ + PagingLevelPageTable = 0, + PagingLevelPageDirectory, + PagingLevelPageDirectoryPointerTable, + PagingLevelPageMapLevel4 +} PAGING_LEVEL; + +////////////////////////////////////////////////// +// Pool Manager // +////////////////////////////////////////////////// + +/** + * @brief Inum of intentions for buffers (buffer tag) + * + */ +typedef enum _POOL_ALLOCATION_INTENTION +{ + TRACKING_HOOKED_PAGES, + EXEC_TRAMPOLINE, + SPLIT_2MB_PAGING_TO_4KB_PAGE, + DETOUR_HOOK_DETAILS, + BREAKPOINT_DEFINITION_STRUCTURE, + PROCESS_THREAD_HOLDER, + + // + // Instant event buffers + // + INSTANT_REGULAR_EVENT_BUFFER, + INSTANT_BIG_EVENT_BUFFER, + INSTANT_REGULAR_EVENT_ACTION_BUFFER, + INSTANT_BIG_EVENT_ACTION_BUFFER, + + // + // Use for request safe buffers of the event + // + INSTANT_REGULAR_SAFE_BUFFER_FOR_EVENTS, + INSTANT_BIG_SAFE_BUFFER_FOR_EVENTS, + +} POOL_ALLOCATION_INTENTION; + +////////////////////////////////////////////////// +// Debug Registers Modifications // +////////////////////////////////////////////////// + +typedef enum _DEBUG_REGISTER_TYPE +{ + BREAK_ON_INSTRUCTION_FETCH, + BREAK_ON_WRITE_ONLY, + BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED, + BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH +} DEBUG_REGISTER_TYPE; + +////////////////////////////////////////////////// +// Execution Stages // +////////////////////////////////////////////////// + +typedef enum _VMX_EXECUTION_MODE +{ + VmxExecutionModeNonRoot = FALSE, + VmxExecutionModeRoot = TRUE +} VMX_EXECUTION_MODE; + +/** + * @brief Type of calling the event + * + */ +typedef enum _VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE +{ + VMM_CALLBACK_CALLING_STAGE_INVALID_EVENT_EMULATION = 0, + VMM_CALLBACK_CALLING_STAGE_PRE_EVENT_EMULATION = 1, + VMM_CALLBACK_CALLING_STAGE_POST_EVENT_EMULATION = 2, + VMM_CALLBACK_CALLING_STAGE_ALL_EVENT_EMULATION = 3 + +} VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE; + +/** + * @brief enum to query different process and thread interception mechanisms + * + */ +typedef enum _DEBUGGER_THREAD_PROCESS_TRACING +{ + + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_THREAD_CHANGE, + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_INTERRUPTS_FOR_PROCESS_CHANGE, + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_DEBUG_REGISTER_INTERCEPTION, + DEBUGGER_THREAD_PROCESS_TRACING_INTERCEPT_CLOCK_WAITING_FOR_MOV_CR3_VM_EXITS, + +} DEBUGGER_THREAD_PROCESS_TRACING; + +////////////////////////////////////////////////// +// Callback Definitions // +////////////////////////////////////////////////// + +/** + * @brief Callback type that can be used to be used + * as a custom ShowMessages function + * + */ +typedef int (*Callback)(const char * Text); + +////////////////////////////////////////////////// +// Communications // +////////////////////////////////////////////////// + +/** + * @brief The structure of user-input packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_USER_INPUT_PACKET +{ + UINT32 CommandLen; + BOOLEAN IgnoreFinishedSignal; + UINT32 Result; + + // + // The user's input is here + // + +} DEBUGGEE_USER_INPUT_PACKET, *PDEBUGGEE_USER_INPUT_PACKET; + +/** + * @brief The structure of user-input packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET +{ + UINT32 Length; + + // + // The buffer for event and action is here + // + +} DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET, + *PDEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET; + +////////////////////////////////////////////////// +// Pausing // +////////////////////////////////////////////////// + +#define SIZEOF_DEBUGGER_PAUSE_PACKET_RECEIVED \ + sizeof(DEBUGGER_PAUSE_PACKET_RECEIVED) + +/** + * @brief request to pause and halt the system + * + */ +typedef struct _DEBUGGER_PAUSE_PACKET_RECEIVED +{ + UINT32 Result; // Result from kernel + +} DEBUGGER_PAUSE_PACKET_RECEIVED, *PDEBUGGER_PAUSE_PACKET_RECEIVED; + +/* ============================================================================================== + */ + +/** + * @brief The structure of detail of a triggered event in HyperDbg + * @details This structure is also used for transferring breakpoint ids, RIP as the context, etc. + * + */ +typedef struct _DEBUGGER_TRIGGERED_EVENT_DETAILS +{ + UINT64 Tag; /* in breakpoints Tag is breakpoint id, not event tag */ + PVOID Context; + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE Stage; + +} DEBUGGER_TRIGGERED_EVENT_DETAILS, *PDEBUGGER_TRIGGERED_EVENT_DETAILS; + +/* ============================================================================================== + */ + +/** + * @brief The structure of pausing packet in kHyperDbg + * + */ +typedef struct _DEBUGGEE_KD_PAUSED_PACKET +{ + UINT64 Rip; + BOOLEAN IsProcessorOn32BitMode; // if true shows that the address should be interpreted in 32-bit mode + BOOLEAN IgnoreDisassembling; // if check if diassembling should be ignored or not + DEBUGGEE_PAUSING_REASON PausingReason; + ULONG CurrentCore; + UINT64 EventTag; + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; + UINT64 Rflags; + BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; + UINT16 ReadInstructionLen; + +} DEBUGGEE_KD_PAUSED_PACKET, *PDEBUGGEE_KD_PAUSED_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of pausing packet in uHyperDbg + * + */ +typedef struct _DEBUGGEE_UD_PAUSED_PACKET +{ + UINT64 Rip; + UINT64 ProcessDebuggingToken; + BOOLEAN Is32Bit; // if true shows that the address should be interpreted in 32-bit mode + DEBUGGEE_PAUSING_REASON PausingReason; + UINT32 ProcessId; + UINT32 ThreadId; + UINT64 Rflags; + UINT64 EventTag; + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventCallingStage; + BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; + UINT16 ReadInstructionLen; + GUEST_REGS GuestRegs; + +} DEBUGGEE_UD_PAUSED_PACKET, *PDEBUGGEE_UD_PAUSED_PACKET; + +////////////////////////////////////////////////// +// Message Tracing Enums // +////////////////////////////////////////////////// + +/** + * @brief Type of transferring buffer between user-to-kernel + * + */ +typedef enum _NOTIFY_TYPE +{ + IRP_BASED, + EVENT_BASED +} NOTIFY_TYPE; + +////////////////////////////////////////////////// +// Structures // +////////////////////////////////////////////////// + +/** + * @brief The structure of message packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_MESSAGE_PACKET +{ + UINT32 OperationCode; + CHAR Message[PacketChunkSize]; + +} DEBUGGEE_MESSAGE_PACKET, *PDEBUGGEE_MESSAGE_PACKET; + +/** + * @brief Used to register event for transferring buffer between user-to-kernel + * + */ +typedef struct _REGISTER_NOTIFY_BUFFER +{ + NOTIFY_TYPE Type; + HANDLE hEvent; + +} REGISTER_NOTIFY_BUFFER, *PREGISTER_NOTIFY_BUFFER; + +////////////////////////////////////////////////// +// Direct VMCALL // +////////////////////////////////////////////////// + +/** + * @brief Used for sending direct VMCALLs on the VMX root-mode + * + */ +typedef struct _DIRECT_VMCALL_PARAMETERS +{ + UINT64 OptionalParam1; + UINT64 OptionalParam2; + UINT64 OptionalParam3; + +} DIRECT_VMCALL_PARAMETERS, *PDIRECT_VMCALL_PARAMETERS; + +////////////////////////////////////////////////// +// EPT Hook // +////////////////////////////////////////////////// + +/** + * @brief different type of memory addresses + * + */ +typedef enum _DEBUGGER_HOOK_MEMORY_TYPE +{ + DEBUGGER_MEMORY_HOOK_VIRTUAL_ADDRESS, + DEBUGGER_MEMORY_HOOK_PHYSICAL_ADDRESS +} DEBUGGER_HOOK_MEMORY_TYPE; + +/** + * @brief Temporary $context used in some EPT hook commands + * + */ +typedef struct _EPT_HOOKS_CONTEXT +{ + UINT64 HookingTag; // This is same as the event tag + UINT64 PhysicalAddress; + UINT64 VirtualAddress; +} EPT_HOOKS_CONTEXT, *PEPT_HOOKS_CONTEXT; + +/** + * @brief Setting details for EPT Hooks (!monitor) + * + */ +typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR +{ + UINT64 StartAddress; + UINT64 EndAddress; + BOOLEAN SetHookForRead; + BOOLEAN SetHookForWrite; + BOOLEAN SetHookForExec; + DEBUGGER_HOOK_MEMORY_TYPE MemoryType; + UINT64 Tag; + +} EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR; + +/** + * @brief Setting details for EPT Hooks (!epthook2) + * + */ +typedef struct _EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2 +{ + PVOID TargetAddress; + PVOID HookFunction; + +} EPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2, *PEPT_HOOKS_ADDRESS_DETAILS_FOR_EPTHOOK2; + +/** + * @brief Details of unhooking single EPT hooks + * + */ +typedef struct _EPT_SINGLE_HOOK_UNHOOKING_DETAILS +{ + BOOLEAN CallerNeedsToRestoreEntryAndInvalidateEpt; + BOOLEAN RemoveBreakpointInterception; + SIZE_T PhysicalAddress; + UINT64 /* EPT_PML1_ENTRY */ OriginalEntry; + +} EPT_SINGLE_HOOK_UNHOOKING_DETAILS, *PEPT_SINGLE_HOOK_UNHOOKING_DETAILS; + +////////////////////////////////////////////////// +// Segment Types // +////////////////////////////////////////////////// + +/** + * @brief Describe segment selector in VMX + * @details This structure is copied from ia32.h to the SDK to + * be used as a data type for functions + * + */ +typedef union +{ + struct + { + /** + * [Bits 3:0] Segment type. + */ + UINT32 Type : 4; + + /** + * [Bit 4] S - Descriptor type (0 = system; 1 = code or data). + */ + UINT32 DescriptorType : 1; + + /** + * [Bits 6:5] DPL - Descriptor privilege level. + */ + UINT32 DescriptorPrivilegeLevel : 2; + + /** + * [Bit 7] P - Segment present. + */ + UINT32 Present : 1; + + UINT32 Reserved1 : 4; + + /** + * [Bit 12] AVL - Available for use by system software. + */ + UINT32 AvailableBit : 1; + + /** + * [Bit 13] Reserved (except for CS). L - 64-bit mode active (for CS only). + */ + UINT32 LongMode : 1; + + /** + * [Bit 14] D/B - Default operation size (0 = 16-bit segment; 1 = 32-bit segment). + */ + UINT32 DefaultBig : 1; + + /** + * [Bit 15] G - Granularity. + */ + UINT32 Granularity : 1; + /** + * [Bit 16] Segment unusable (0 = usable; 1 = unusable). + */ + UINT32 Unusable : 1; + UINT32 Reserved2 : 15; + }; + + UINT32 AsUInt; +} VMX_SEGMENT_ACCESS_RIGHTS_TYPE; + +/** + * @brief Segment selector + * + */ +typedef struct _VMX_SEGMENT_SELECTOR +{ + UINT16 Selector; + VMX_SEGMENT_ACCESS_RIGHTS_TYPE Attributes; + UINT32 Limit; + UINT64 Base; +} VMX_SEGMENT_SELECTOR, *PVMX_SEGMENT_SELECTOR; + + +//..\..\..\bin\debug\SDK\Headers\ErrorCodes.h +/** + * @file ErrorCodes.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Error codes + * @details This file contains definitions of error codes used in HyperDbg + * @version 0.2 + * @date 2022-06-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Success Codes // +////////////////////////////////////////////////// + +/** + * @brief General value to indicate that the operation or + * request was successful + * + */ +#define DEBUGGER_OPERATION_WAS_SUCCESSFUL 0xFFFFFFFF + +////////////////////////////////////////////////// +// Error Codes // +////////////////////////////////////////////////// + +/** + * @brief error, the tag not exist + * + */ +#define DEBUGGER_ERROR_TAG_NOT_EXISTS 0xc0000000 + +/** + * @brief error, invalid type of action + * + */ +#define DEBUGGER_ERROR_INVALID_ACTION_TYPE 0xc0000001 + +/** + * @brief error, the action buffer size is invalid + * + */ +#define DEBUGGER_ERROR_ACTION_BUFFER_SIZE_IS_ZERO 0xc0000002 + +/** + * @brief error, the event type is unknown + * + */ +#define DEBUGGER_ERROR_EVENT_TYPE_IS_INVALID 0xc0000003 + +/** + * @brief error, enable to create event + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_CREATE_EVENT 0xc0000004 + +/** + * @brief error, invalid address specified for debugger + * + */ +#define DEBUGGER_ERROR_INVALID_ADDRESS 0xc0000005 + +/** + * @brief error, the core id is invalid + * + */ +#define DEBUGGER_ERROR_INVALID_CORE_ID 0xc0000006 + +/** + * @brief error, the index is greater than 32 in !exception command + * + */ +#define DEBUGGER_ERROR_EXCEPTION_INDEX_EXCEED_FIRST_32_ENTRIES 0xc0000007 + +/** + * @brief error, the index for !interrupt command is not between 32 to 256 + * + */ +#define DEBUGGER_ERROR_INTERRUPT_INDEX_IS_NOT_VALID 0xc0000008 + +/** + * @brief error, unable to hide the debugger and enter to transparent-mode + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER 0xc0000009 + +/** + * @brief error, the debugger is already in transparent-mode + * + */ +#define DEBUGGER_ERROR_DEBUGGER_ALREADY_UHIDE 0xc000000a + +/** + * @brief error, invalid parameters in !e* e* commands + * + */ +#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_PARAMETER 0xc000000b + +/** + * @brief error, an invalid address is specified based on current cr3 + * in !e* or e* commands + * + */ +#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_CURRENT_PROCESS \ + 0xc000000c + +/** + * @brief error, an invalid address is specified based on anotehr process's cr3 + * in !e* or e* commands + * + */ +#define DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_OTHER_PROCESS \ + 0xc000000d + +/** + * @brief error, invalid tag for 'events' command (tag id is unknown for kernel) + * + */ +#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TAG 0xc000000e + +/** + * @brief error, type of action (enable/disable/clear) is wrong + * + */ +#define DEBUGGER_ERROR_MODIFY_EVENTS_INVALID_TYPE_OF_ACTION 0xc000000f + +/** + * @brief error, invalid parameters steppings actions + * + */ +#define DEBUGGER_ERROR_STEPPING_INVALID_PARAMETER 0xc0000010 + +/** + * @brief error, thread is invalid (not found) or disabled in + * stepping (step-in & step-out) requests + * + */ +#define DEBUGGER_ERROR_STEPPINGS_EITHER_THREAD_NOT_FOUND_OR_DISABLED 0xc0000011 + +/** + * @brief error, baud rate is invalid + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_BAUDRATE 0xc0000012 + +/** + * @brief error, serial port address is invalid + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_SERIAL_PORT 0xc0000013 + +/** + * @brief error, invalid core selected in changing core in remote debuggee + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_INVALID_CORE_IN_REMOTE_DEBUGGE \ + 0xc0000014 + +/** + * @brief error, invalid process selected in changing process in remote debuggee + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_UNABLE_TO_SWITCH_TO_NEW_PROCESS \ + 0xc0000015 + +/** + * @brief error, unable to run script in remote debuggee + * + */ +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT 0xc0000016 + +/** + * @brief error, invalid register number + * + */ +#define DEBUGGER_ERROR_INVALID_REGISTER_NUMBER 0xc0000017 + +/** + * @brief error, maximum pools were used without continuing debuggee + * + */ +#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_WITHOUT_CONTINUE 0xc0000018 + +/** + * @brief error, breakpoint already exists on the target address + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_EXISTS_ON_THE_ADDRESS 0xc0000019 + +/** + * @brief error, breakpoint id not found + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND 0xc000001a + +/** + * @brief error, breakpoint already disabled + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_DISABLED 0xc000001b + +/** + * @brief error, breakpoint already enabled + * + */ +#define DEBUGGER_ERROR_BREAKPOINT_ALREADY_ENABLED 0xc000001c + +/** + * @brief error, memory type is invalid + * + */ +#define DEBUGGER_ERROR_MEMORY_TYPE_INVALID 0xc000001d + +/** + * @brief error, the process id is invalid + * + */ +#define DEBUGGER_ERROR_INVALID_PROCESS_ID 0xc000001e + +/** + * @brief error, for event specific reasons the event is not + * applied + * + */ +#define DEBUGGER_ERROR_EVENT_IS_NOT_APPLIED 0xc000001f + +/** + * @brief error, for process switch or process details, invalid parameter + * + */ +#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_PROCESS_INVALID_PARAMETER 0xc0000020 + +/** + * @brief error, for thread switch or thread details, invalid parameter + * + */ +#define DEBUGGER_ERROR_DETAILS_OR_SWITCH_THREAD_INVALID_PARAMETER 0xc0000021 + +/** + * @brief error, maximum breakpoint for a single page is hit + * + */ +#define DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_FOR_A_SINGLE_PAGE_IS_HIT 0xc0000022 + +/** + * @brief error, there is no pre-allocated buffer + * + */ +#define DEBUGGER_ERROR_PRE_ALLOCATED_BUFFER_IS_EMPTY 0xc0000023 + +/** + * @brief error, in the EPT handler, it could not split the 2MB pages to + * 512 entries of 4 KB pages + * + */ +#define DEBUGGER_ERROR_EPT_COULD_NOT_SPLIT_THE_LARGE_PAGE_TO_4KB_PAGES 0xc0000024 + +/** + * @brief error, failed to get PML1 entry of the target address + * + */ +#define DEBUGGER_ERROR_EPT_FAILED_TO_GET_PML1_ENTRY_OF_TARGET_ADDRESS 0xc0000025 + +/** + * @brief error, multiple EPT Hooks or Monitors are applied on a single page + * + */ +#define DEBUGGER_ERROR_EPT_MULTIPLE_HOOKS_IN_A_SINGLE_PAGE 0xc0000026 + +/** + * @brief error, could not build the EPT Hook + * + */ +#define DEBUGGER_ERROR_COULD_NOT_BUILD_THE_EPT_HOOK 0xc0000027 + +/** + * @brief error, could not find the type of allocation + * + */ +#define DEBUGGER_ERROR_COULD_NOT_FIND_ALLOCATION_TYPE 0xc0000028 + +/** + * @brief error, could not find the index of test query + * + */ +#define DEBUGGER_ERROR_INVALID_TEST_QUERY_INDEX 0xc0000029 + +/** + * @brief error, failed to attach to the target user-mode process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS 0xc000002a + +/** + * @brief error, failed to remove hooks as entrypoint is not reached yet + * @details The caller of this functionality should keep sending the previous + * IOCTL until the hook is remove successfully + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED 0xc000002b + +/** + * @brief error, could not remove the previous hook + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS 0xc000002c + +/** + * @brief error, the needed routines for debugging is not initialized + * + */ +#define DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED 0xc000002d + +/** + * @brief error, unable to get 32-bit or 64-bit of the target process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS 0xc000002e + +/** + * @brief error, unable to kill the target process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS 0xc000002f + +/** + * @brief error, invalid thread debugging token + * + */ +#define DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN 0xc0000030 + +/** + * @brief error, unable to pause the process's threads + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS 0xc0000031 + +/** + * @brief error, user debugger already attached to this process + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS 0xc0000032 + +/** + * @brief error, the user debugger is not attached to the target process + * + */ +#define DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS 0xc0000033 + +/** + * @brief error, cannot detach from the process as there are paused threads + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS 0xc0000034 + +/** + * @brief error, cannot switch to new thread as the process id or thread id is not found + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID 0xc0000035 + +/** + * @brief error, cannot switch to new thread the process doesn't contain an active thread + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS 0xc0000036 + +/** + * @brief error, unable to get modules + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS 0xc0000037 + +/** + * @brief error, unable to get the callstack + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_GET_CALLSTACK 0xc0000038 + +/** + * @brief error, unable to query count of processes or threads + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_QUERY_COUNT_OF_PROCESSES_OR_THREADS 0xc0000039 + +/** + * @brief error, using short-circuiting event with post-event mode is + * not supported in HyperDbg + * + */ +#define DEBUGGER_ERROR_USING_SHORT_CIRCUITING_EVENT_WITH_POST_EVENT_MODE_IS_FORBIDDEDN 0xc000003a + +/** + * @brief error, unknown test query is received + * + */ +#define DEBUGGER_ERROR_UNKNOWN_TEST_QUERY_RECEIVED 0xc000003b + +/** + * @brief error, for reading from memory in case of invalid parameters + * + */ +#define DEBUGGER_ERROR_READING_MEMORY_INVALID_PARAMETER 0xc000003c + +/** + * @brief error, the list of threads/process trap flag is full + * + */ +#define DEBUGGER_ERROR_THE_TRAP_FLAG_LIST_IS_FULL 0xc000003d + +/** + * @brief error, unable to kill the target process. process does not exists + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS 0xc000003e + +/** + * @brief error, the execution mode is incorrect + * + */ +#define DEBUGGER_ERROR_MODE_EXECUTION_IS_INVALID 0xc000003f + +/** + * @brief error, the process id cannot be specified while the debugger is in VMX-root mode + * + */ +#define DEBUGGER_ERROR_PROCESS_ID_CANNOT_BE_SPECIFIED_WHILE_APPLYING_EVENT_FROM_VMX_ROOT_MODE 0xc0000040 + +/** + * @brief error, the preallocated buffer is not enough for storing event+conditional buffer + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_EVENT_AND_CONDITIONALS 0xc0000041 + +/** + * @brief error, the regular preallocated buffer not found + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000042 + +/** + * @brief error, the big preallocated buffer not found + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000043 + +/** + * @brief error, enable to create action (cannot allocate buffer) + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_CREATE_ACTION_CANNOT_ALLOCATE_BUFFER 0xc0000044 + +/** + * @brief error, the regular preallocated buffer not found (for action) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_REGULAR_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000045 + +/** + * @brief error, the big preallocated buffer not found (for action) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_ACTION_BIG_PREALLOCATED_BUFFER_NOT_FOUND 0xc0000046 + +/** + * @brief error, the preallocated buffer is not enough for storing action buffer + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_ACTION_BUFFER 0xc0000047 + +/** + * @brief error, the requested optional buffer is bigger than send/receive stack of the debugger + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_REQUESTED_OPTIONAL_BUFFER_IS_BIGGER_THAN_DEBUGGERS_SEND_RECEIVE_STACK 0xc0000048 + +/** + * @brief error, the requested safe buffer does not exist (regular) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_REGULAR_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc0000049 + +/** + * @brief error, the requested safe buffer does not exists (big) + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_BIG_REQUESTED_SAFE_BUFFER_NOT_FOUND 0xc000004a + +/** + * @brief error, the preallocated buffer is not enough for storing safe requested buffer + * + */ +#define DEBUGGER_ERROR_INSTANT_EVENT_PREALLOCATED_BUFFER_IS_NOT_ENOUGH_FOR_REQUESTED_SAFE_BUFFER 0xc000004b + +/** + * @brief error, enable to create requested safe buffer (cannot allocate buffer) + * + */ +#define DEBUGGER_ERROR_UNABLE_TO_ALLOCATE_REQUESTED_SAFE_BUFFER 0xc000004c + +/** + * @brief error, could not find the type of preactivation + * + */ +#define DEBUGGER_ERROR_COULD_NOT_FIND_PREACTIVATION_TYPE 0xc000004d + +/** + * @brief error, the mode exec trap is not already initialized + * + */ +#define DEBUGGER_ERROR_THE_MODE_EXEC_TRAP_IS_NOT_INITIALIZED 0xc000004e + +/** + * @brief error, the target event(s) is/are disabled but cannot clear them because the buffer of the user-mode + * priority is full + * + */ +#define DEBUGGER_ERROR_THE_TARGET_EVENT_IS_DISABLED_BUT_CANNOT_BE_CLEARED_PRIRITY_BUFFER_IS_FULL 0xc000004f + +/** + * @brief error, not all cores are locked (probably due to a race condition in HyperDbg) in + * instant-event mechanism + * + */ +#define DEBUGGER_ERROR_NOT_ALL_CORES_ARE_LOCKED_FOR_APPLYING_INSTANT_EVENT 0xc0000050 + +/** + * @brief error, switching to the target core is not possible because core is not locked + * (probably due to a race condition in HyperDbg) + * + */ +#define DEBUGGER_ERROR_TARGET_SWITCHING_CORE_IS_NOT_LOCKED 0xc0000051 + +/** + * @brief error, invalid physical address + * + */ +#define DEBUGGER_ERROR_INVALID_PHYSICAL_ADDRESS 0xc0000052 + +// +// WHEN YOU ADD ANYTHING TO THIS LIST OF ERRORS, THEN +// MAKE SURE TO ADD AN ERROR MESSAGE TO ShowErrorMessage(UINT32 Error) +// FUNCTION +// + + +//..\..\..\bin\debug\SDK\Headers\Events.h +/** + * @file Events.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers for Events + * @details This file contains definitions of event datatypes + * @version 0.2 + * @date 2022-06-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// System Events // +////////////////////////////////////////////////// + +/** + * @brief Exceptions enum + * + */ +typedef enum _EXCEPTION_VECTORS +{ + EXCEPTION_VECTOR_DIVIDE_ERROR, + EXCEPTION_VECTOR_DEBUG_BREAKPOINT, + EXCEPTION_VECTOR_NMI, + EXCEPTION_VECTOR_BREAKPOINT, + EXCEPTION_VECTOR_OVERFLOW, + EXCEPTION_VECTOR_BOUND_RANGE_EXCEEDED, + EXCEPTION_VECTOR_UNDEFINED_OPCODE, + EXCEPTION_VECTOR_NO_MATH_COPROCESSOR, + EXCEPTION_VECTOR_DOUBLE_FAULT, + EXCEPTION_VECTOR_RESERVED0, + EXCEPTION_VECTOR_INVALID_TASK_SEGMENT_SELECTOR, + EXCEPTION_VECTOR_SEGMENT_NOT_PRESENT, + EXCEPTION_VECTOR_STACK_SEGMENT_FAULT, + EXCEPTION_VECTOR_GENERAL_PROTECTION_FAULT, + EXCEPTION_VECTOR_PAGE_FAULT, + EXCEPTION_VECTOR_RESERVED1, + EXCEPTION_VECTOR_MATH_FAULT, + EXCEPTION_VECTOR_ALIGNMENT_CHECK, + EXCEPTION_VECTOR_MACHINE_CHECK, + EXCEPTION_VECTOR_SIMD_FLOATING_POINT_NUMERIC_ERROR, + EXCEPTION_VECTOR_VIRTUAL_EXCEPTION, + EXCEPTION_VECTOR_RESERVED2, + EXCEPTION_VECTOR_RESERVED3, + EXCEPTION_VECTOR_RESERVED4, + EXCEPTION_VECTOR_RESERVED5, + EXCEPTION_VECTOR_RESERVED6, + EXCEPTION_VECTOR_RESERVED7, + EXCEPTION_VECTOR_RESERVED8, + EXCEPTION_VECTOR_RESERVED9, + EXCEPTION_VECTOR_RESERVED10, + EXCEPTION_VECTOR_RESERVED11, + EXCEPTION_VECTOR_RESERVED12, + + // + // NT (Windows) specific exception vectors. + // + APC_INTERRUPT = 31, + DPC_INTERRUPT = 47, + CLOCK_INTERRUPT = 209, + IPI_INTERRUPT = 225, + PMI_INTERRUPT = 254, + +} EXCEPTION_VECTORS; + +////////////////////////////////////////////////// +// Callback Enums // +////////////////////////////////////////////////// + +/** + * @brief The status of triggering events + * + */ +typedef enum _VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE +{ + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED = 0, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL = 0, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT = 1, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_DEBUGGER_NOT_ENABLED = 2, + VMM_CALLBACK_TRIGGERING_EVENT_STATUS_INVALID_EVENT_TYPE = 3, + +} VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE; + +////////////////////////////////////////////////// +// Event Details // +////////////////////////////////////////////////// + +/** + * @brief enum to show type of all HyperDbg events + * + */ +typedef enum _VMM_EVENT_TYPE_ENUM +{ + + // + // EPT Memory Monitoring Events + // + HIDDEN_HOOK_READ_AND_WRITE_AND_EXECUTE, + HIDDEN_HOOK_READ_AND_WRITE, + HIDDEN_HOOK_READ_AND_EXECUTE, + HIDDEN_HOOK_WRITE_AND_EXECUTE, + HIDDEN_HOOK_READ, + HIDDEN_HOOK_WRITE, + HIDDEN_HOOK_EXECUTE, + + // + // EPT Hook Events + // + HIDDEN_HOOK_EXEC_DETOURS, + HIDDEN_HOOK_EXEC_CC, + + // + // System-call Events + // + SYSCALL_HOOK_EFER_SYSCALL, + SYSCALL_HOOK_EFER_SYSRET, + + // + // CPUID Instruction Execution Events + // + CPUID_INSTRUCTION_EXECUTION, + + // + // Model-Specific Registers (MSRs) Reads/Modifications Events + // + RDMSR_INSTRUCTION_EXECUTION, + WRMSR_INSTRUCTION_EXECUTION, + + // + // PMIO Events + // + IN_INSTRUCTION_EXECUTION, + OUT_INSTRUCTION_EXECUTION, + + // + // Interrupts/Exceptions/Faults Events + // + EXCEPTION_OCCURRED, + EXTERNAL_INTERRUPT_OCCURRED, + + // + // Debug Registers Events + // + DEBUG_REGISTERS_ACCESSED, + + // + // Timing & Performance Events + // + TSC_INSTRUCTION_EXECUTION, + PMC_INSTRUCTION_EXECUTION, + + // + // VMCALL Instruction Execution Events + // + VMCALL_INSTRUCTION_EXECUTION, + + // + // Control Registers Events + // + CONTROL_REGISTER_MODIFIED, + CONTROL_REGISTER_READ, + CONTROL_REGISTER_3_MODIFIED, + + // + // Execution Trap Events + // + TRAP_EXECUTION_MODE_CHANGED, + TRAP_EXECUTION_INSTRUCTION_TRACE, + +} VMM_EVENT_TYPE_ENUM; + +/** + * @brief Type of Actions + * + */ +typedef enum _DEBUGGER_EVENT_ACTION_TYPE_ENUM +{ + BREAK_TO_DEBUGGER, + RUN_SCRIPT, + RUN_CUSTOM_CODE + +} DEBUGGER_EVENT_ACTION_TYPE_ENUM; + +/** + * @brief Type of handling !syscall or !sysret + * + */ +typedef enum _DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE +{ + DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY = 0, + DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD = 1, + +} DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE; + +#define SIZEOF_DEBUGGER_MODIFY_EVENTS sizeof(DEBUGGER_MODIFY_EVENTS) + +/** + * @brief Type of mode change traps + * + */ +typedef enum _DEBUGGER_EVENT_MODE_TYPE +{ + DEBUGGER_EVENT_MODE_TYPE_USER_MODE_AND_KERNEL_MODE = 1, + DEBUGGER_EVENT_MODE_TYPE_USER_MODE = 3, + DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE = 0, + DEBUGGER_EVENT_MODE_TYPE_INVALID = 0xffffffff, + +} DEBUGGER_EVENT_MODE_TYPE; + +/** + * @brief Type of tracing events + * + */ +typedef enum _DEBUGGER_EVENT_TRACE_TYPE +{ + DEBUGGER_EVENT_TRACE_TYPE_INVALID = 0, + DEBUGGER_EVENT_TRACE_TYPE_STEP_IN = 1, + DEBUGGER_EVENT_TRACE_TYPE_STEP_OUT = 2, + DEBUGGER_EVENT_TRACE_TYPE_INSTRUMENTATION_STEP_IN = 3, + +} DEBUGGER_EVENT_TRACE_TYPE; + +/** + * @brief different types of modifying events request (enable/disable/clear) + * + */ +typedef enum _DEBUGGER_MODIFY_EVENTS_TYPE +{ + DEBUGGER_MODIFY_EVENTS_QUERY_STATE, + DEBUGGER_MODIFY_EVENTS_ENABLE, + DEBUGGER_MODIFY_EVENTS_DISABLE, + DEBUGGER_MODIFY_EVENTS_CLEAR, +} DEBUGGER_MODIFY_EVENTS_TYPE; + +/** + * @brief request for modifying events (enable/disable/clear) + * + */ +typedef struct _DEBUGGER_MODIFY_EVENTS +{ + UINT64 Tag; // Tag of the target event that we want to modify + UINT64 KernelStatus; // Kernel put the status in this field + DEBUGGER_MODIFY_EVENTS_TYPE + TypeOfAction; // Determines what's the action (enable | disable | clear) + BOOLEAN IsEnabled; // Determines what's the action (enable | disable | clear) + +} DEBUGGER_MODIFY_EVENTS, *PDEBUGGER_MODIFY_EVENTS; + +/** + * @brief request for performing a short-circuiting event + * + */ +typedef struct _DEBUGGER_SHORT_CIRCUITING_EVENT +{ + UINT64 KernelStatus; // Kernel put the status in this field + BOOLEAN IsShortCircuiting; // Determines whether to perform short circuting (on | off) + +} DEBUGGER_SHORT_CIRCUITING_EVENT, *PDEBUGGER_SHORT_CIRCUITING_EVENT; + +////////////////////////////////////////////////// +// Event Options // +////////////////////////////////////////////////// + +/** + * @brief request for performing a short-circuiting event + * + */ +typedef struct _DEBUGGER_EVENT_OPTIONS +{ + UINT64 OptionalParam1; // Optional parameter + UINT64 OptionalParam2; // Optional parameter + UINT64 OptionalParam3; // Optional parameter + UINT64 OptionalParam4; // Optional parameter + UINT64 OptionalParam5; // Optional parameter + UINT64 OptionalParam6; // Optional parameter + +} DEBUGGER_EVENT_OPTIONS, *PDEBUGGER_EVENT_OPTIONS; + +////////////////////////////////////////////////// +// Enums For Event And Debugger Resources // +////////////////////////////////////////////////// + +/** + * @brief Things to consider when applying resources + * + */ +typedef enum _PROTECTED_HV_RESOURCES_PASSING_OVERS +{ + // + // for exception bitmap + // + PASSING_OVER_NONE = 0, + PASSING_OVER_UD_EXCEPTIONS_FOR_SYSCALL_SYSRET_HOOK = 1, + PASSING_OVER_EXCEPTION_EVENTS, + + // + // for external interupts-exitings + // + PASSING_OVER_INTERRUPT_EVENTS, + + // + // for external rdtsc/p exitings + // + PASSING_OVER_TSC_EVENTS, + + // + // for external mov to hardware debug registers exitings + // + PASSING_OVER_MOV_TO_HW_DEBUG_REGS_EVENTS, + + // + // for external mov to control registers exitings + // + PASSING_OVER_MOV_TO_CONTROL_REGS_EVENTS, + +} PROTECTED_HV_RESOURCES_PASSING_OVERS; + +/** + * @brief Type of protected (multi-used) resources + * + */ +typedef enum _PROTECTED_HV_RESOURCES_TYPE +{ + PROTECTED_HV_RESOURCES_EXCEPTION_BITMAP, + + PROTECTED_HV_RESOURCES_EXTERNAL_INTERRUPT_EXITING, + + PROTECTED_HV_RESOURCES_RDTSC_RDTSCP_EXITING, + + PROTECTED_HV_RESOURCES_MOV_TO_DEBUG_REGISTER_EXITING, + + PROTECTED_HV_RESOURCES_MOV_CONTROL_REGISTER_EXITING, + + PROTECTED_HV_RESOURCES_MOV_TO_CR3_EXITING, + +} PROTECTED_HV_RESOURCES_TYPE; + +////////////////////////////////////////////////// +// Event Details // +////////////////////////////////////////////////// + +/** + * @brief Each command is like the following struct, it also used for + * tracing works in user mode and sending it to the kernl mode + * @details THIS IS NOT WHAT HYPERDBG SAVES FOR EVENTS IN KERNEL-MODE + */ +typedef struct _DEBUGGER_GENERAL_EVENT_DETAIL +{ + LIST_ENTRY + CommandsEventList; // Linked-list of commands list (used for tracing purpose + // in user mode) + + time_t CreationTime; // Date of creating this event + + UINT32 CoreId; // determines the core index to apply this event to, if it's + // 0xffffffff means that we have to apply it to all cores + + UINT32 ProcessId; // determines the process id to apply this to + // only that 0xffffffff means that we have to + // apply it to all processes + + BOOLEAN IsEnabled; + + BOOLEAN EnableShortCircuiting; // indicates whether the short-circuiting event + // is enabled or not for this event + + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE EventStage; // reveals the calling stage of the event + // (whether it's a all- pre- or post- event) + + BOOLEAN HasCustomOutput; // Shows whether this event has a custom output + // source or not + + UINT64 + OutputSourceTags + [DebuggerOutputSourceMaximumRemoteSourceForSingleEvent]; // tags of + // multiple + // sources which + // can be used to + // send the event + // results of + // scripts to + // remote sources + + UINT32 CountOfActions; + + UINT64 Tag; // is same as operation code + VMM_EVENT_TYPE_ENUM EventType; + + DEBUGGER_EVENT_OPTIONS Options; + + PVOID CommandStringBuffer; + + UINT32 ConditionBufferSize; + +} DEBUGGER_GENERAL_EVENT_DETAIL, *PDEBUGGER_GENERAL_EVENT_DETAIL; + +/** + * @brief Each event can have multiple actions + * @details THIS STRUCTURE IS ONLY USED IN USER MODE + * WE USE SEPARATE STRUCTURE FOR ACTIONS IN + * KERNEL MODE + */ +typedef struct _DEBUGGER_GENERAL_ACTION +{ + UINT64 EventTag; + DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType; + BOOLEAN ImmediateMessagePassing; + UINT32 PreAllocatedBuffer; + + UINT32 CustomCodeBufferSize; + UINT32 ScriptBufferSize; + UINT32 ScriptBufferPointer; + +} DEBUGGER_GENERAL_ACTION, *PDEBUGGER_GENERAL_ACTION; + +/** + * @brief Status of register buffers + * + */ +typedef struct _DEBUGGER_EVENT_AND_ACTION_RESULT +{ + BOOLEAN IsSuccessful; + UINT32 Error; // If IsSuccessful was, FALSE + +} DEBUGGER_EVENT_AND_ACTION_RESULT, *PDEBUGGER_EVENT_AND_ACTION_RESULT; + +#define SIZEOF_REGISTER_EVENT sizeof(REGISTER_NOTIFY_BUFFER) + + +//..\..\..\bin\debug\SDK\Headers\HardwareDebugger.h +/** + * @file HardwareDebugger.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's Hardware Debugger (hwdbg) types and constants + * @details This file contains definitions of hwdbg elements + * used in HyperDbg + * @version 0.9 + * @date 2024-04-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Definitions // +////////////////////////////////////////////////// + +/** + * @brief Initial debuggee to debugger offset + * + */ +#define DEFAULT_INITIAL_DEBUGGEE_TO_DEBUGGER_OFFSET 0x200 + +/** + * @brief Initial debugger to debuggee offset + * + */ +#define DEFAULT_INITIAL_DEBUGGER_TO_DEBUGGEE_OFFSET 0x0 + +////////////////////////////////////////////////// +// Enums // +////////////////////////////////////////////////// + +/** + * @brief Different action of hwdbg + * @warning This file should be changed along with hwdbg files + * + */ +typedef enum _HWDBG_ACTION_ENUMS +{ + hwdbgActionSendInstanceInfo = 1, + hwdbgActionConfigureScriptBuffer = 2, + +} HWDBG_ACTION_ENUMS; + +/** + * @brief Different responses come from hwdbg + * @warning This file should be changed along with hwdbg files + * + */ +typedef enum _HWDBG_RESPONSE_ENUMS +{ + hwdbgResponseSuccessOrErrorMessage = 1, + hwdbgResponseInstanceInfo = 2, + +} HWDBG_RESPONSE_ENUMS; + +/** + * @brief Different success or error codes in hwdbg + * @warning This file should be changed along with hwdbg files + * + */ +typedef enum _HWDBG_SUCCESS_OR_ERROR_ENUMS +{ + hwdbgOperationWasSuccessful = 0x7FFFFFFF, + hwdbgErrorInvalidPacket = 1, + +} HWDBG_SUCCESS_OR_ERROR_ENUMS; + +////////////////////////////////////////////////// +// Structures // +////////////////////////////////////////////////// + +/** + * @brief The structure of port information (each item) in hwdbg + * + */ +typedef struct _HWDBG_PORT_INFORMATION_ITEMS +{ + UINT32 PortSize; + +} HWDBG_PORT_INFORMATION_ITEMS, *PHWDBG_PORT_INFORMATION_ITEMS; + +/** + * @brief The structure of script capabilities information in hwdbg + * + */ +typedef struct _HWDBG_INSTANCE_INFORMATION +{ + // + // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE + // + UINT32 version; // Target version of HyperDbg (same as hwdbg) + UINT32 maximumNumberOfStages; // Number of stages that this instance of hwdbg supports (NumberOfSupportedStages == 0 means script engine is disabled) + UINT32 scriptVariableLength; // maximum length of variables (and other script elements) + UINT32 maximumNumberOfSupportedGetScriptOperators; // Maximum supported GET operators in a single func + UINT32 maximumNumberOfSupportedSetScriptOperators; // Maximum supported SET operators in a single func + UINT32 sharedMemorySize; // Size of shared memory + UINT32 debuggerAreaOffset; // The memory offset of debugger + UINT32 debuggeeAreaOffset; // The memory offset of debuggee + UINT32 numberOfPins; // Number of pins + UINT32 numberOfPorts; // Number of ports + + // + // ANY ADDITION TO THIS STRUCTURE SHOULD BE SYNCHRONIZED WITH SCALA AND INSTANCE INFO SENDER MODULE + // + + struct _HWDBG_SCRIPT_CAPABILITIES + { + // + // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities + // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file + // + UINT64 func_or : 1; + UINT64 func_xor : 1; + UINT64 func_and : 1; + UINT64 func_asr : 1; + UINT64 func_asl : 1; + UINT64 func_add : 1; + UINT64 func_sub : 1; + UINT64 func_mul : 1; + UINT64 func_div : 1; + UINT64 func_mod : 1; + UINT64 func_gt : 1; + UINT64 func_lt : 1; + UINT64 func_egt : 1; + UINT64 func_elt : 1; + UINT64 func_equal : 1; + UINT64 func_neq : 1; + UINT64 func_jmp : 1; + UINT64 func_jz : 1; + UINT64 func_jnz : 1; + UINT64 func_mov : 1; + UINT64 func_printf : 1; + + // + // ANY ADDITION TO THIS MASK SHOULD BE ADDED TO HwdbgInterpreterShowScriptCapabilities + // and HwdbgInterpreterCheckScriptBufferWithScriptCapabilities as well Scala file + // + + } scriptCapabilities; + + UINT32 bramAddrWidth; // BRAM address width + UINT32 bramDataWidth; // BRAM data width + + // + // Here the details of port arrangements are located (HWDBG_PORT_INFORMATION_ITEMS) + // As the following type: + // HWDBG_PORT_INFORMATION_ITEMS portsConfiguration[numberOfPorts] ; Port arrangement + // + +} HWDBG_INSTANCE_INFORMATION, *PHWDBG_INSTANCE_INFORMATION; + +/** + * @brief The structure of script buffer in hwdbg + * + */ +typedef struct _HWDBG_SCRIPT_BUFFER +{ + UINT32 scriptNumberOfSymbols; // Number of symbols in the script + + // + // Here the script buffer is located + // + // UINT8 scriptBuffer[scriptNumberOfSymbols]; // The script buffer + // + +} HWDBG_SCRIPT_BUFFER, *PHWDBG_SCRIPT_BUFFER; + + +//..\..\..\bin\debug\SDK\Headers\Ioctls.h +/** + * @file Ioctls.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK IOCTL codes + * @details This file contains definitions of IOCTLs used in HyperDbg + * @version 0.2 + * @date 2022-06-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Definitions // +////////////////////////////////////////////////// + +// +// The following controls are mainly defined in +// + +// +// Macro definition for defining IOCTL and FSCTL function control codes. Note +// that function codes 0-2047 are reserved for Microsoft Corporation, and +// 2048-4095 are reserved for customers. +// +#ifndef CTL_CODE + +# define CTL_CODE(DeviceType, Function, Method, Access) ( \ + ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method)) + +#endif // ! CTL_CODE + +#ifndef FILE_ANY_ACCESS + +# define FILE_ANY_ACCESS 0 + +#endif // !FILE_ANY_ACCESS + +// +// Define the method codes for how buffers are passed for I/O and FS controls +// + +#ifndef METHOD_BUFFERED + +# define METHOD_BUFFERED 0 + +#endif // !METHOD_BUFFERED + +#ifndef FILE_DEVICE_UNKNOWN + +# define FILE_DEVICE_UNKNOWN 0x00000022 + +#endif // !FILE_DEVICE_UNKNOWN + +////////////////////////////////////////////////// +// IOCTLs // +////////////////////////////////////////////////// + +/** + * @brief ioctl, register a new event + * + */ +#define IOCTL_REGISTER_EVENT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, irp pending mechanism for reading from message tracing buffers + * + */ +#define IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to terminate vmx and exit form debugger + * + */ +#define IOCTL_TERMINATE_VMX \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to read memory + * + */ +#define IOCTL_DEBUGGER_READ_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to read or write on a special MSR + * + */ +#define IOCTL_DEBUGGER_READ_OR_WRITE_MSR \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x804, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to read page table entries + * + */ +#define IOCTL_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x805, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, register an event + * + */ +#define IOCTL_DEBUGGER_REGISTER_EVENT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x806, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, add action to event + * + */ +#define IOCTL_DEBUGGER_ADD_ACTION_TO_EVENT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x807, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to enable or disable transparent-mode + * + */ +#define IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x808, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, for !va2pa and !pa2va commands + * + */ +#define IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x809, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to edit virtual and physical memory + * + */ +#define IOCTL_DEBUGGER_EDIT_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80a, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to search virtual and physical memory + * + */ +#define IOCTL_DEBUGGER_SEARCH_MEMORY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80b, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to modify an event (enable/disable/clear) + * + */ +#define IOCTL_DEBUGGER_MODIFY_EVENTS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80c, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, flush the kernel buffers + * + */ +#define IOCTL_DEBUGGER_FLUSH_LOGGING_BUFFERS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80d, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, attach or detach user-mode processes + * + */ +#define IOCTL_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80e, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, print states (Deprecated) + * + * + */ +#define IOCTL_DEBUGGER_PRINT \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x80f, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, prepare debuggee + * + */ +#define IOCTL_PREPARE_DEBUGGEE \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x810, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, pause and halt the system + * + */ +#define IOCTL_PAUSE_PACKET_RECEIVED \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x811, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, send a signal that execution of command finished + * + */ +#define IOCTL_SEND_SIGNAL_EXECUTION_IN_DEBUGGEE_FINISHED \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x812, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, send user-mode messages to the debugger + * + */ +#define IOCTL_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x813, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, send general buffer from debuggee to debugger + * + */ +#define IOCTL_SEND_GENERAL_BUFFER_FROM_DEBUGGEE_TO_DEBUGGER \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x814, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to perform kernel-side tests + * + */ +#define IOCTL_PERFROM_KERNEL_SIDE_TESTS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to reserve pre-allocated pools + * + */ +#define IOCTL_RESERVE_PRE_ALLOCATED_POOLS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x816, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to send user debugger commands + * + */ +#define IOCTL_SEND_USER_DEBUGGER_COMMANDS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x817, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to get active threads/processes that are debugging + * + */ +#define IOCTL_GET_DETAIL_OF_ACTIVE_THREADS_AND_PROCESSES \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x818, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to get user mode modules details + * + */ +#define IOCTL_GET_USER_MODE_MODULE_DETAILS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x819, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, query count of active threads or processes + * + */ +#define IOCTL_QUERY_COUNT_OF_ACTIVE_PROCESSES_OR_THREADS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81a, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to get list threads/processes + * + */ +#define IOCTL_GET_LIST_OF_THREADS_AND_PROCESSES \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81b, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, query the current process details + * + */ +#define IOCTL_QUERY_CURRENT_PROCESS \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81c, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, query the current thread details + * + */ +#define IOCTL_QUERY_CURRENT_THREAD \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81d, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request service from the reversing machine + * + */ +#define IOCTL_REQUEST_REV_MACHINE_SERVICE \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81e, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, request to bring pages in + * + */ +#define IOCTL_DEBUGGER_BRING_PAGES_IN \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x81f, METHOD_BUFFERED, FILE_ANY_ACCESS) + +/** + * @brief ioctl, to preactivate a functionality + * + */ +#define IOCTL_PREACTIVATE_FUNCTIONALITY \ + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x820, METHOD_BUFFERED, FILE_ANY_ACCESS) + + +//..\..\..\bin\debug\SDK\Headers\RequestStructures.h +/** + * @file RequestStructures.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Headers Request Packets + * @details This file contains definitions of request packets (enums, structs) + * @version 0.2 + * @date 2022-06-28 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#define SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \ + sizeof(DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS) + +/** + * @brief request for !pte command + * + */ +typedef struct _DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS +{ + UINT64 VirtualAddress; + UINT32 ProcessId; + + UINT64 Pml4eVirtualAddress; + UINT64 Pml4eValue; + + UINT64 PdpteVirtualAddress; + UINT64 PdpteValue; + + UINT64 PdeVirtualAddress; + UINT64 PdeValue; + + UINT64 PteVirtualAddress; + UINT64 PteValue; + + UINT32 KernelStatus; + +} DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS, + *PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \ + sizeof(DEBUGGER_VA2PA_AND_PA2VA_COMMANDS) + +/** + * @brief requests for !va2pa and !pa2va commands + * + */ +typedef struct _DEBUGGER_VA2PA_AND_PA2VA_COMMANDS +{ + UINT64 VirtualAddress; + UINT64 PhysicalAddress; + UINT32 ProcessId; + BOOLEAN IsVirtual2Physical; + UINT32 KernelStatus; + +} DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, *PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS; + +/* ============================================================================================== + */ +#define SIZEOF_DEBUGGER_PAGE_IN_REQUEST \ + sizeof(DEBUGGER_PAGE_IN_REQUEST) + +/** + * @brief requests for the '.pagein' command + * + */ +typedef struct _DEBUGGER_PAGE_IN_REQUEST +{ + UINT64 VirtualAddressFrom; + UINT64 VirtualAddressTo; + UINT32 ProcessId; + UINT32 PageFaultErrorCode; + UINT32 KernelStatus; + +} DEBUGGER_PAGE_IN_REQUEST, *PDEBUGGER_PAGE_IN_REQUEST; + +/* ============================================================================================== + */ + +/** + * @brief different modes of reconstruct requests + * + */ +typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE +{ + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN = 0, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_USER_MODE, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_KERNEL_MODE, +} REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE; + +/** + * @brief different types of reconstruct requests + * + */ +typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE +{ + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN = 0, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT, + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN, +} REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE; + +#define SIZEOF_REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST \ + sizeof(REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST) + +/** + * @brief requests for !rev command + * + */ +typedef struct _REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST +{ + UINT32 ProcessId; + UINT32 Size; + REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE Mode; + REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE Type; + UINT32 KernelStatus; + +} REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST, *PREVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_DT_COMMAND_OPTIONS \ + sizeof(DEBUGGER_DT_COMMAND_OPTIONS) + +/** + * @brief requests options for dt and struct command + * + */ +typedef struct _DEBUGGER_DT_COMMAND_OPTIONS +{ + const char * TypeName; + UINT64 SizeOfTypeName; + UINT64 Address; + BOOLEAN IsStruct; + PVOID BufferAddress; + UINT32 TargetPid; + const char * AdditionalParameters; + +} DEBUGGER_DT_COMMAND_OPTIONS, *PDEBUGGER_DT_COMMAND_OPTIONS; + +/* ============================================================================================== + */ + +/** + * @brief different types of prealloc requests + * + */ +typedef enum _DEBUGGER_PREALLOC_COMMAND_TYPE +{ + DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION, + DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR, + DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK, + DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK2, + DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_EVENT, + DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_EVENT, + DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_SAFE_BUFFER, + DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_SAFE_BUFFER, + +} DEBUGGER_PREALLOC_COMMAND_TYPE; + +#define SIZEOF_DEBUGGER_PREALLOC_COMMAND \ + sizeof(DEBUGGER_PREALLOC_COMMAND) + +/** + * @brief requests for the 'prealloc' command + * + */ +typedef struct _DEBUGGER_PREALLOC_COMMAND +{ + DEBUGGER_PREALLOC_COMMAND_TYPE Type; + UINT32 Count; + UINT32 KernelStatus; + +} DEBUGGER_PREALLOC_COMMAND, *PDEBUGGER_PREALLOC_COMMAND; + +/* ============================================================================================== + */ + +/** + * @brief different types of preactivate requests + * + */ +typedef enum _DEBUGGER_PREACTIVATE_COMMAND_TYPE +{ + DEBUGGER_PREACTIVATE_COMMAND_TYPE_MODE, + +} DEBUGGER_PREACTIVATE_COMMAND_TYPE; + +#define SIZEOF_DEBUGGER_PREACTIVATE_COMMAND \ + sizeof(DEBUGGER_PREACTIVATE_COMMAND) + +/** + * @brief requests for the 'preactivate' command + * + */ +typedef struct _DEBUGGER_PREACTIVATE_COMMAND +{ + DEBUGGER_PREACTIVATE_COMMAND_TYPE Type; + UINT32 KernelStatus; + +} DEBUGGER_PREACTIVATE_COMMAND, *PDEBUGGER_PREACTIVATE_COMMAND; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_READ_MEMORY sizeof(DEBUGGER_READ_MEMORY) + +/** + * @brief different types of reading memory + * + */ +typedef enum _DEBUGGER_READ_READING_TYPE +{ + READ_FROM_KERNEL, + READ_FROM_VMX_ROOT +} DEBUGGER_READ_READING_TYPE; + +/** + * @brief different type of addresses + * + */ +typedef enum _DEBUGGER_READ_MEMORY_TYPE +{ + DEBUGGER_READ_PHYSICAL_ADDRESS, + DEBUGGER_READ_VIRTUAL_ADDRESS +} DEBUGGER_READ_MEMORY_TYPE; + +/** + * @brief the way that debugger should show + * the details of memory or disassemble them + * + */ +typedef enum _DEBUGGER_SHOW_MEMORY_STYLE +{ + DEBUGGER_SHOW_COMMAND_DT = 1, + DEBUGGER_SHOW_COMMAND_DISASSEMBLE64, + DEBUGGER_SHOW_COMMAND_DISASSEMBLE32, + DEBUGGER_SHOW_COMMAND_DB, + DEBUGGER_SHOW_COMMAND_DC, + DEBUGGER_SHOW_COMMAND_DQ, + DEBUGGER_SHOW_COMMAND_DD, + DEBUGGER_SHOW_COMMAND_DUMP +} DEBUGGER_SHOW_MEMORY_STYLE; + +/** + * @brief request for reading virtual and physical memory + * + */ +typedef struct _DEBUGGER_READ_MEMORY +{ + UINT32 Pid; // Read from cr3 of what process + UINT64 Address; + UINT32 Size; + BOOLEAN IsForDisasm; // Debugger sets whether the read memory is for diassembler or not + BOOLEAN Is32BitAddress; // Debuggee sets the status of address + DEBUGGER_READ_MEMORY_TYPE MemoryType; + DEBUGGER_READ_READING_TYPE ReadingType; + PDEBUGGER_DT_COMMAND_OPTIONS DtDetails; + DEBUGGER_SHOW_MEMORY_STYLE Style; // not used in local debugging + UINT32 ReturnLength; // not used in local debugging + UINT32 KernelStatus; // not used in local debugging + + // + // Here is the target buffer (actual memory) + // + +} DEBUGGER_READ_MEMORY, *PDEBUGGER_READ_MEMORY; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_FLUSH_LOGGING_BUFFERS \ + sizeof(DEBUGGER_FLUSH_LOGGING_BUFFERS) + +/** + * @brief request for flushing buffers + * + */ +typedef struct _DEBUGGER_FLUSH_LOGGING_BUFFERS +{ + UINT32 KernelStatus; + UINT32 CountOfMessagesThatSetAsReadFromVmxRoot; + UINT32 CountOfMessagesThatSetAsReadFromVmxNonRoot; + +} DEBUGGER_FLUSH_LOGGING_BUFFERS, *PDEBUGGER_FLUSH_LOGGING_BUFFERS; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_TEST_QUERY_BUFFER \ + sizeof(DEBUGGER_TEST_QUERY_BUFFER) + +/** + * @brief test query used for test purposed + * + */ +typedef enum _DEBUGGER_TEST_QUERY_STATE +{ + TEST_QUERY_HALTING_CORE_STATUS = 1, // Query constant to show detail of halting of core + TEST_QUERY_PREALLOCATED_POOL_STATE = 2, // Query pre-allocated pool state + TEST_QUERY_TRAP_STATE = 3, // Query trap state + TEST_BREAKPOINT_TURN_OFF_BPS = 4, // Turn off the breakpoints (#BP) + TEST_BREAKPOINT_TURN_ON_BPS = 5, // Turn on the breakpoints (#BP) + TEST_BREAKPOINT_TURN_OFF_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 6, // Turn off the breakpoints and events for executing the commands in the remote computer + TEST_BREAKPOINT_TURN_ON_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 7, // Turn on the breakpoints and events for executing the commands in the remote computer + TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_SYNCHRONOUS = 8, // For testing synchronized event + TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_ASYNCHRONOUS = 9, // For testing unsynchronized event + TEST_SETTING_TARGET_TASKS_ON_TARGET_HALTED_CORES = 10, // Send the task to the halted core + TEST_BREAKPOINT_TURN_OFF_DBS = 11, // Turn off the debug breaks (#DB) + TEST_BREAKPOINT_TURN_ON_DBS = 12, // Turn on the debug breaks (#DB) + +} DEBUGGER_TEST_QUERY_STATE; + +/** + * @brief request for test query buffers + * + */ +typedef struct _DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER +{ + DEBUGGER_TEST_QUERY_STATE RequestType; + UINT64 Context; + UINT32 KernelStatus; + +} DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER, *PDEBUGGER_DEBUGGER_TEST_QUERY_BUFFER; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_PERFORM_KERNEL_TESTS \ + sizeof(DEBUGGER_PERFORM_KERNEL_TESTS) + +/** + * @brief request performing kernel tests + * + */ +typedef struct _DEBUGGER_PERFORM_KERNEL_TESTS +{ + UINT32 KernelStatus; + +} DEBUGGER_PERFORM_KERNEL_TESTS, *PDEBUGGER_PERFORM_KERNEL_TESTS; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL \ + sizeof(DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL) + +/** + * @brief request for send a signal that command execution finished + * + */ +typedef struct _DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL +{ + UINT32 KernelStatus; + +} DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL, + *PDEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER \ + sizeof(DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER) + +/** + * @brief request for send general packets from debuggee to debugger + * + */ +typedef struct _DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER +{ + DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction; + UINT32 LengthOfBuffer; + BOOLEAN PauseDebuggeeWhenSent; + UINT32 KernelResult; + + // + // The buffer for the general packet is here + // + +} DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER, + *PDEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER \ + sizeof(DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER) + +/** + * @brief request for send a user-mode message to debugger + * + */ +typedef struct _DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER +{ + UINT32 KernelStatus; + UINT32 Length; + + // + // Here is the messages + // + +} DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER, + *PDEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR \ + sizeof(DEBUGGER_READ_AND_WRITE_ON_MSR) + +/** + * @brief different types of actions on MSRs + * + */ +typedef enum _DEBUGGER_MSR_ACTION_TYPE +{ + DEBUGGER_MSR_READ, + DEBUGGER_MSR_WRITE +} DEBUGGER_MSR_ACTION_TYPE; + +/** + * @brief request to read or write on MSRs + * + */ +typedef struct _DEBUGGER_READ_AND_WRITE_ON_MSR +{ + UINT64 Msr; // It's actually a 32-Bit value but let's not mess with a register + UINT32 CoreNumber; // specifies the core to execute wrmsr or read the msr + // (DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES mean all + // the cores) + DEBUGGER_MSR_ACTION_TYPE + ActionType; // Detects whether user needs wrmsr or rdmsr + UINT64 Value; + +} DEBUGGER_READ_AND_WRITE_ON_MSR, *PDEBUGGER_READ_AND_WRITE_ON_MSR; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_EDIT_MEMORY sizeof(DEBUGGER_EDIT_MEMORY) + +/** + * @brief different type of addresses for editing memory + * + */ +typedef enum _DEBUGGER_EDIT_MEMORY_TYPE +{ + EDIT_PHYSICAL_MEMORY, + EDIT_VIRTUAL_MEMORY +} DEBUGGER_EDIT_MEMORY_TYPE; + +/** + * @brief size of editing memory + * + */ +typedef enum _DEBUGGER_EDIT_MEMORY_BYTE_SIZE +{ + EDIT_BYTE, + EDIT_DWORD, + EDIT_QWORD +} DEBUGGER_EDIT_MEMORY_BYTE_SIZE; + +/** + * @brief request for edit virtual and physical memory + * + */ +typedef struct _DEBUGGER_EDIT_MEMORY +{ + UINT32 Result; // Result from kernel + UINT64 Address; // Target address to modify + UINT32 ProcessId; // specifies the process id + DEBUGGER_EDIT_MEMORY_TYPE MemoryType; // Type of memory + DEBUGGER_EDIT_MEMORY_BYTE_SIZE ByteSize; // Modification size + UINT32 CountOf64Chunks; + UINT32 FinalStructureSize; + UINT32 KernelStatus; // not used in local debugging + +} DEBUGGER_EDIT_MEMORY, *PDEBUGGER_EDIT_MEMORY; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_SEARCH_MEMORY sizeof(DEBUGGER_SEARCH_MEMORY) + +/** + * @brief different types of address for searching on memory + * + */ +typedef enum _DEBUGGER_SEARCH_MEMORY_TYPE +{ + SEARCH_PHYSICAL_MEMORY, + SEARCH_VIRTUAL_MEMORY, + SEARCH_PHYSICAL_FROM_VIRTUAL_MEMORY, + +} DEBUGGER_SEARCH_MEMORY_TYPE; + +/** + * @brief different sizes on searching memory + * + */ +typedef enum _DEBUGGER_SEARCH_MEMORY_BYTE_SIZE +{ + SEARCH_BYTE, + SEARCH_DWORD, + SEARCH_QWORD + +} DEBUGGER_SEARCH_MEMORY_BYTE_SIZE; + +/** + * @brief request for searching memory + * + */ +typedef struct _DEBUGGER_SEARCH_MEMORY +{ + UINT64 Address; // Target address to start searching + UINT64 Length; // Length of bytes to search + UINT32 ProcessId; // specifies the process id + DEBUGGER_SEARCH_MEMORY_TYPE MemoryType; // Type of memory + DEBUGGER_SEARCH_MEMORY_BYTE_SIZE ByteSize; // Modification size + UINT32 CountOf64Chunks; + UINT32 FinalStructureSize; + +} DEBUGGER_SEARCH_MEMORY, *PDEBUGGER_SEARCH_MEMORY; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE \ + sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) + +/** + * @brief request for enable or disable transparent-mode + * + */ +typedef struct _DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE +{ + BOOLEAN IsHide; + + UINT64 CpuidAverage; + UINT64 CpuidStandardDeviation; + UINT64 CpuidMedian; + + UINT64 RdtscAverage; + UINT64 RdtscStandardDeviation; + UINT64 RdtscMedian; + + BOOLEAN TrueIfProcessIdAndFalseIfProcessName; + UINT32 ProcId; + UINT32 LengthOfProcessName; // in the case of !hide name xxx, this parameter + // shows the length of xxx + + UINT64 KernelStatus; /* DEBUGGER_OPERATION_WAS_SUCCESSFUL , + DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER + */ + +} DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, + *PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE; + +/* ============================================================================================== + */ + +#define SIZEOF_DEBUGGER_PREPARE_DEBUGGEE sizeof(DEBUGGER_PREPARE_DEBUGGEE) + +/** + * @brief request to make this computer to a debuggee + * + */ +typedef struct _DEBUGGER_PREPARE_DEBUGGEE +{ + UINT32 PortAddress; + UINT32 Baudrate; + UINT64 NtoskrnlBaseAddress; + UINT32 Result; // Result from the kernel + CHAR OsName[MAXIMUM_CHARACTER_FOR_OS_NAME]; + +} DEBUGGER_PREPARE_DEBUGGEE, *PDEBUGGER_PREPARE_DEBUGGEE; + +/* ============================================================================================== + */ + +/** + * @brief The structure of changing core packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_CHANGE_CORE_PACKET +{ + UINT32 NewCore; + UINT32 Result; + +} DEBUGGEE_CHANGE_CORE_PACKET, *PDEBUGGEE_CHANGE_CORE_PACKET; + +/* ============================================================================================== + */ +#define SIZEOF_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \ + sizeof(DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS) + +/** + * @brief different actions of switchings + * + */ +typedef enum _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE +{ + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD, + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS, + +} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE; + +/** + * @brief request for attaching user-mode process + * + */ +typedef struct _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS +{ + BOOLEAN IsStartingNewProcess; + UINT32 ProcessId; + UINT32 ThreadId; + BOOLEAN CheckCallbackAtFirstInstruction; + BOOLEAN Is32Bit; + BOOLEAN IsPaused; // used in switching to threads + DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE Action; + UINT32 CountOfActiveDebuggingThreadsAndProcesses; // used in showing the list of active threads/processes + UINT64 Token; + UINT64 Result; + +} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS, + *PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS; + +/* ============================================================================================== + */ +#define SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS \ + sizeof(DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS) + +/** + * @brief different type of process or thread queries + * + */ +typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES +{ + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT = 1, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT = 2, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST = 3, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST = 4, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_PROCESS = 5, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_THREAD = 6, + +} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES; + +/** + * @brief different actions on showing or querying list of process or threads + * + */ +typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS +{ + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_SHOW_INSTANTLY = 1, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT = 2, + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_SAVE_DETAILS = 3, + +} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS; + +/** + * @brief The structure of needed information to get the details + * of the process from nt!_EPROCESS and location of needed variables + * + */ +typedef struct _DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS +{ + UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead + ULONG ImageFileNameOffset; // nt!_EPROCESS.ImageFileName + ULONG UniquePidOffset; // nt!_EPROCESS.UniqueProcessId + ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks + +} DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS, *PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS; + +/** + * @brief The structure of needed information to get the details + * of the thread from nt!_ETHREAD and location of needed variables + * + */ +typedef struct _DEBUGGEE_THREAD_LIST_NEEDED_DETAILS +{ + UINT32 ThreadListHeadOffset; // nt!_EPROCESS.ThreadListHead + UINT32 ThreadListEntryOffset; // nt!_ETHREAD.ThreadListEntry + UINT32 CidOffset; // nt!_ETHREAD.Cid + UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead + ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks + UINT64 Process; + +} DEBUGGEE_THREAD_LIST_NEEDED_DETAILS, *PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS; + +/** + * @brief The structure showing list of processes (details of each + * entry) + * + */ +typedef struct _DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY +{ + UINT64 Eprocess; + UINT32 ProcessId; + UINT64 Cr3; + UCHAR ImageFileName[15 + 1]; + +} DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY, *PDEBUGGEE_PROCESS_LIST_DETAILS_ENTRY; + +/** + * @brief The structure showing list of threads (details of each + * entry) + * + */ +typedef struct _DEBUGGEE_THREAD_LIST_DETAILS_ENTRY +{ + UINT64 Eprocess; + UINT64 Ethread; + UINT32 ProcessId; + UINT32 ThreadId; + UCHAR ImageFileName[15 + 1]; + +} DEBUGGEE_THREAD_LIST_DETAILS_ENTRY, *PDEBUGGEE_THREAD_LIST_DETAILS_ENTRY; + +/** + * @brief request for query count of active processes and threads + * + */ +typedef struct _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS +{ + DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededDetails; + DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListNeededDetails; + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES QueryType; + DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS QueryAction; + UINT32 Count; + UINT64 Result; + +} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS, + *PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS; + +/* ============================================================================================== + */ + +/** + * @brief The structure for saving the callstack frame of one parameter + * + */ +typedef struct _DEBUGGER_SINGLE_CALLSTACK_FRAME +{ + BOOLEAN IsStackAddressValid; + BOOLEAN IsValidAddress; + BOOLEAN IsExecutable; + UINT64 Value; + BYTE InstructionBytesOnRip[MAXIMUM_CALL_INSTR_SIZE]; + +} DEBUGGER_SINGLE_CALLSTACK_FRAME, *PDEBUGGER_SINGLE_CALLSTACK_FRAME; + +#define SIZEOF_DEBUGGER_CALLSTACK_REQUEST \ + sizeof(DEBUGGER_CALLSTACK_REQUEST) + +/** + * @brief callstack showing method + * + */ +typedef enum _DEBUGGER_CALLSTACK_DISPLAY_METHOD +{ + DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITHOUT_PARAMS, + DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS, + +} DEBUGGER_CALLSTACK_DISPLAY_METHOD; + +/** + * @brief request for callstack frames + * + */ +typedef struct _DEBUGGER_CALLSTACK_REQUEST +{ + BOOLEAN Is32Bit; + UINT32 KernelStatus; + DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod; + UINT32 Size; + UINT32 FrameCount; + UINT64 BaseAddress; + UINT64 BufferSize; + + // + // Here is the size of stack frames + // + +} DEBUGGER_CALLSTACK_REQUEST, *PDEBUGGER_CALLSTACK_REQUEST; + +/* ============================================================================================== + */ +#define SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS \ + sizeof(USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS) + +typedef struct _USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS +{ + UINT32 ProcessId; + UINT32 ThreadId; + BOOLEAN IsProcess; + +} USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS, *PUSERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS; + +/* ============================================================================================== + */ + +/** + * @brief Used for run the script + * + */ +typedef struct _DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION +{ + UINT64 ScriptBuffer; + UINT32 ScriptLength; + UINT32 ScriptPointer; + UINT32 OptionalRequestedBufferSize; + +} DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION, + *PDEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION; + +/** + * @brief used in the case of requesting a "request buffer" + * + */ +typedef struct _DEBUGGER_EVENT_REQUEST_BUFFER +{ + BOOLEAN EnabledRequestBuffer; + UINT32 RequestBufferSize; + UINT64 RequstBufferAddress; + +} DEBUGGER_EVENT_REQUEST_BUFFER, *PDEBUGGER_EVENT_REQUEST_BUFFER; + +/** + * @brief used in the case of custom code requests to the debugger + * + */ +typedef struct _DEBUGGER_EVENT_REQUEST_CUSTOM_CODE +{ + UINT32 CustomCodeBufferSize; + PVOID CustomCodeBufferAddress; + UINT32 OptionalRequestedBufferSize; + +} DEBUGGER_EVENT_REQUEST_CUSTOM_CODE, *PDEBUGGER_EVENT_REQUEST_CUSTOM_CODE; + +/* ============================================================================================== + */ + +/** + * @brief User-mode debugging actions + * + */ +typedef enum _DEBUGGER_UD_COMMAND_ACTION_TYPE +{ + DEBUGGER_UD_COMMAND_ACTION_TYPE_NONE = 0, + DEBUGGER_UD_COMMAND_ACTION_TYPE_PAUSE, + DEBUGGER_UD_COMMAND_ACTION_TYPE_CONTINUE, + DEBUGGER_UD_COMMAND_ACTION_TYPE_REGULAR_STEP, + +} DEBUGGER_UD_COMMAND_ACTION_TYPE; + +/** + * @brief Description of user-mode debugging actions + * + */ +typedef struct _DEBUGGER_UD_COMMAND_ACTION +{ + DEBUGGER_UD_COMMAND_ACTION_TYPE ActionType; + UINT64 OptionalParam1; + UINT64 OptionalParam2; + UINT64 OptionalParam3; + UINT64 OptionalParam4; + +} DEBUGGER_UD_COMMAND_ACTION, *PDEBUGGER_UD_COMMAND_ACTION; + +/** + * @brief The structure of command packet in uHyperDbg + * + */ +typedef struct _DEBUGGER_UD_COMMAND_PACKET +{ + DEBUGGER_UD_COMMAND_ACTION UdAction; + UINT64 ProcessDebuggingDetailToken; + UINT32 TargetThreadId; + BOOLEAN ApplyToAllPausedThreads; + UINT32 Result; + +} DEBUGGER_UD_COMMAND_PACKET, *PDEBUGGER_UD_COMMAND_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Debugger process switch and process details + * + */ +typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE +{ + + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS, + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST, + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH, + +} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE; + +/** + * @brief The structure of changing process and show process + * packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET +{ + DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType; + UINT32 ProcessId; + UINT64 Process; + BOOLEAN IsSwitchByClkIntr; + UCHAR ProcessName[16]; + DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListSymDetails; + UINT32 Result; + +} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET + * + */ +#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET \ + sizeof(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET) + +/** + * @brief Debugger thread switch and thread details + * + */ +typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE +{ + + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH, + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS, + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LIST, + +} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE; + +/** + * @brief The structure of changing thead and show thread + * packet in HyperDbg + */ +typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET +{ + DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType; + UINT32 ThreadId; + UINT32 ProcessId; + UINT64 Thread; + UINT64 Process; + BOOLEAN CheckByClockInterrupt; + UCHAR ProcessName[16]; + DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListSymDetails; + UINT32 Result; + +} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET; + +/** + * @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET + * + */ +#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET \ + sizeof(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET) + +/* ============================================================================================== + */ + +/** + * @brief stepping and tracking types + * + */ +typedef enum _DEBUGGER_REMOTE_STEPPING_REQUEST +{ + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_IN, + DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN, + DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN_FOR_TRACKING, + + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER, + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU, + DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU_LAST_INSTRUCTION, + +} DEBUGGER_REMOTE_STEPPING_REQUEST; + +/** + * @brief The structure of stepping packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_STEP_PACKET +{ + DEBUGGER_REMOTE_STEPPING_REQUEST StepType; + + // + // Only in the case of call instructions + // the 'p' command + // + BOOLEAN IsCurrentInstructionACall; + UINT32 CallLength; + +} DEBUGGEE_STEP_PACKET, *PDEBUGGEE_STEP_PACKET; + +/** + * @brief default number of instructions used in tracking and stepping + * + */ +#define DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING 0xffffffff + +/* ============================================================================================== + */ + +/** + * @brief The structure of .formats result packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_FORMATS_PACKET +{ + UINT64 Value; + UINT32 Result; + +} DEBUGGEE_FORMATS_PACKET, *PDEBUGGEE_FORMATS_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of .sym reload packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_SYMBOL_REQUEST_PACKET +{ + UINT32 ProcessId; + +} DEBUGGEE_SYMBOL_REQUEST_PACKET, *PDEBUGGEE_SYMBOL_REQUEST_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of bp command packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_BP_PACKET +{ + UINT64 Address; + UINT32 Pid; + UINT32 Tid; + UINT32 Core; + BOOLEAN RemoveAfterHit; + BOOLEAN CheckForCallbacks; + UINT32 Result; + +} DEBUGGEE_BP_PACKET, *PDEBUGGEE_BP_PACKET; + +/** + * @brief breakpoint modification types + * + */ +typedef enum _DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST +{ + + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS, + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE, + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE, + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR, + +} DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST; + +/** + * @brief The structure of breakpoint modification requests packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_BP_LIST_OR_MODIFY_PACKET +{ + UINT64 BreakpointId; + DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST Request; + UINT32 Result; + +} DEBUGGEE_BP_LIST_OR_MODIFY_PACKET, *PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Whether a jump is taken or not taken + * + */ +typedef enum _DEBUGGER_CONDITIONAL_JUMP_STATUS +{ + + DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR = 0, + DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP, + DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN, + DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN, + +} DEBUGGER_CONDITIONAL_JUMP_STATUS; + +/* ============================================================================================== + */ + +/** + * @brief The structure of script packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_SCRIPT_PACKET +{ + UINT32 ScriptBufferSize; + UINT32 ScriptBufferPointer; + BOOLEAN IsFormat; + UINT32 Result; + + // + // The script buffer is here + // + +} DEBUGGEE_SCRIPT_PACKET, *PDEBUGGEE_SCRIPT_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief The structure of result of search packet in HyperDbg + * + */ +typedef struct _DEBUGGEE_RESULT_OF_SEARCH_PACKET +{ + UINT32 CountOfResults; + UINT32 Result; + +} DEBUGGEE_RESULT_OF_SEARCH_PACKET, *PDEBUGGEE_RESULT_OF_SEARCH_PACKET; + +/* ============================================================================================== + */ + +/** + * @brief Register Descriptor Structure to use in r command. + * + */ +typedef struct _DEBUGGEE_REGISTER_READ_DESCRIPTION +{ + UINT32 RegisterID; // the number is from REGS_ENUM + UINT64 Value; + UINT32 KernelStatus; + +} DEBUGGEE_REGISTER_READ_DESCRIPTION, *PDEBUGGEE_REGISTER_READ_DESCRIPTION; + +/* ============================================================================================== + */ + + +//..\..\..\bin\debug\SDK\Headers\Symbols.h +/** + * @file Symbols.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK Header Files For Symbol Parsing + * @details This file contains definitions of symbol parsers + * @version 0.2 + * @date 2022-06-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Symbols Details // +////////////////////////////////////////////////// + +/** + * @brief structures for sending and saving details + * about each module and symbols details + * + */ +typedef struct _MODULE_SYMBOL_DETAIL +{ + BOOLEAN IsSymbolDetailsFound; // TRUE if the details of symbols found, FALSE if not found + BOOLEAN IsLocalSymbolPath; // TRUE if the ModuleSymbolPath is a real path + // and FALSE if ModuleSymbolPath is just a module name + BOOLEAN IsSymbolPDBAvaliable; // TRUE if the module's pdb is available(if exists in the sympath) + BOOLEAN IsUserMode; // TRUE if the module is a user-mode module + BOOLEAN Is32Bit; // TRUE if the module is a 32-bit + UINT64 BaseAddress; + char FilePath[MAX_PATH]; + char ModuleSymbolPath[MAX_PATH]; + char ModuleSymbolGuidAndAge[MAXIMUM_GUID_AND_AGE_SIZE]; + +} MODULE_SYMBOL_DETAIL, *PMODULE_SYMBOL_DETAIL; + +typedef struct _USERMODE_LOADED_MODULE_SYMBOLS +{ + UINT64 BaseAddress; + UINT64 Entrypoint; + wchar_t FilePath[MAX_PATH]; + +} USERMODE_LOADED_MODULE_SYMBOLS, *PUSERMODE_LOADED_MODULE_SYMBOLS; + +typedef struct _USERMODE_LOADED_MODULE_DETAILS +{ + UINT32 ProcessId; + BOOLEAN OnlyCountModules; + BOOLEAN Is32Bit; + UINT32 ModulesCount; + UINT32 Result; + + // + // Here is a list of USERMODE_LOADED_MODULE_SYMBOLS (appended) + // + +} USERMODE_LOADED_MODULE_DETAILS, *PUSERMODE_LOADED_MODULE_DETAILS; + +/** + * @brief Callback type that should be used to add + * list of Addresses to ObjectNames + * + */ +typedef VOID (*SymbolMapCallback)(UINT64 Address, char * ModuleName, char * ObjectName, unsigned int ObjectSize); + +/** + * @brief request to add new symbol detail or update a previous + * symbol table entry + * + */ +typedef struct _DEBUGGER_UPDATE_SYMBOL_TABLE +{ + UINT32 TotalSymbols; + UINT32 CurrentSymbolIndex; + MODULE_SYMBOL_DETAIL SymbolDetailPacket; + +} DEBUGGER_UPDATE_SYMBOL_TABLE, *PDEBUGGER_UPDATE_SYMBOL_TABLE; + +/* +============================================================================================== + */ + +/** + * @brief request that shows, symbol reload process is finished + * + */ +typedef struct _DEBUGGEE_SYMBOL_UPDATE_RESULT +{ + UINT64 KernelStatus; // Kernel put the status in this field + +} DEBUGGEE_SYMBOL_UPDATE_RESULT, *PDEBUGGEE_SYMBOL_UPDATE_RESULT; + +/* +============================================================================================== + */ + + +//..\..\..\bin\debug\SDK\Modules\HyperLog.h +/** + * @file HyperLog.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK for HyperLog project + * @details This file contains definitions of HyperLog routines + * @version 0.2 + * @date 2023-01-15 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Callback Types // +////////////////////////////////////////////////// + +/** + * @brief A function that checks whether the current operation + * is on vmx-root mode or not + * + */ +typedef BOOLEAN (*CHECK_VMX_OPERATION)(); + +/** + * @brief A function that checks whether the immediate message + * sending is needed or not + * + */ +typedef BOOLEAN (*CHECK_IMMEDIATE_MESSAGE_SENDING)(UINT32 OperationCode); + +/** + * @brief A function that sends immediate messages + * + */ +typedef BOOLEAN (*SEND_IMMEDIATE_MESSAGE)(CHAR * OptionalBuffer, + UINT32 OptionalBufferLength, + UINT32 OperationCode); + +////////////////////////////////////////////////// +// Callback Structure // +////////////////////////////////////////////////// + +/** + * @brief Prototype of each function needed by message tracer + * + */ +typedef struct _MESSAGE_TRACING_CALLBACKS +{ + CHECK_VMX_OPERATION VmxOperationCheck; + CHECK_IMMEDIATE_MESSAGE_SENDING CheckImmediateMessageSending; + SEND_IMMEDIATE_MESSAGE SendImmediateMessage; + +} MESSAGE_TRACING_CALLBACKS, *PMESSAGE_TRACING_CALLBACKS; + + +//..\..\..\bin\debug\SDK\Modules\VMM.h +/** + * @file VMM.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief HyperDbg's SDK for VMM project + * @details This file contains definitions of HyperLog routines + * @version 0.2 + * @date 2023-01-15 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Callback Types // +////////////////////////////////////////////////// + +/** + * @brief A function from the message tracer that send the inputs to the + * queue of the messages + * + */ +typedef BOOLEAN (*LOG_CALLBACK_PREPARE_AND_SEND_MESSAGE_TO_QUEUE)(UINT32 OperationCode, + BOOLEAN IsImmediateMessage, + BOOLEAN ShowCurrentSystemTime, + BOOLEAN Priority, + const char * Fmt, + va_list ArgList); + +/** + * @brief A function that sends the messages to message tracer buffers + * + */ +typedef BOOLEAN (*LOG_CALLBACK_SEND_MESSAGE_TO_QUEUE)(UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR * LogMessage, UINT32 BufferLen, BOOLEAN Priority); + +/** + * @brief A function that sends the messages to message tracer buffers + * + */ +typedef BOOLEAN (*LOG_CALLBACK_SEND_BUFFER)(_In_ UINT32 OperationCode, + _In_reads_bytes_(BufferLength) PVOID Buffer, + _In_ UINT32 BufferLength, + _In_ BOOLEAN Priority); + +/** + * @brief A function that checks whether the priority or regular buffer is full or not + * + */ +typedef BOOLEAN (*LOG_CALLBACK_CHECK_IF_BUFFER_IS_FULL)(BOOLEAN Priority); + +/** + * @brief A function that handles trigger events + * + */ +typedef VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE (*VMM_CALLBACK_TRIGGER_EVENTS)(VMM_EVENT_TYPE_ENUM EventType, + VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE CallingStage, + PVOID Context, + BOOLEAN * PostEventRequired, + GUEST_REGS * Regs); + +/** + * @brief A function that checks and handles breakpoints + * + */ +typedef BOOLEAN (*DEBUGGING_CALLBACK_HANDLE_BREAKPOINT_EXCEPTION)(UINT32 CoreId); + +/** + * @brief A function that checks and handles debug breakpoints + * + */ +typedef BOOLEAN (*DEBUGGING_CALLBACK_HANDLE_DEBUG_BREAKPOINT_EXCEPTION)(UINT32 CoreId); + +/** + * @brief Check for page-faults in user-debugger + * + */ +typedef BOOLEAN (*DEBUGGING_CALLBACK_CONDITIONAL_PAGE_FAULT_EXCEPTION)(UINT32 CoreId, + UINT64 Address, + UINT32 PageFaultErrorCode); + +/** + * @brief Check for commands in user-debugger + * + */ +typedef BOOLEAN (*UD_CHECK_FOR_COMMAND)(); + +/** + * @brief Handle registered MTF callback + * + */ +typedef VOID (*VMM_CALLBACK_REGISTERED_MTF_HANDLER)(UINT32 CoreId); + +/** + * @brief Check for user-mode access for loaded module details + * + */ +typedef BOOLEAN (*VMM_CALLBACK_RESTORE_EPT_STATE)(UINT32 CoreId); + +/** + * @brief Check for unhandled EPT violations + * + */ +typedef BOOLEAN (*VMM_CALLBACK_CHECK_UNHANDLED_EPT_VIOLATION)(UINT32 CoreId, UINT64 ViolationQualification, UINT64 GuestPhysicalAddr); + +/** + * @brief Handle cr3 process change callbacks + * + */ +typedef VOID (*INTERCEPTION_CALLBACK_TRIGGER_CR3_CHANGE)(UINT32 CoreId); + +/** + * @brief Check for process or thread change callback + * + */ +typedef BOOLEAN (*INTERCEPTION_CALLBACK_TRIGGER_CLOCK_AND_IPI)(_In_ UINT32 CoreId); + +/** + * @brief Check to handle cr3 events for thread interception + * + */ +typedef BOOLEAN (*ATTACHING_HANDLE_CR3_EVENTS_FOR_THREAD_INTERCEPTION)(UINT32 CoreId, CR3_TYPE NewCr3); + +/** + * @brief Check and handle reapplying breakpoint + * + */ +typedef BOOLEAN (*BREAKPOINT_CHECK_AND_HANDLE_REAPPLYING_BREAKPOINT)(UINT32 CoreId); + +/** + * @brief Handle NMI broadcast + * + */ +typedef VOID (*VMM_CALLBACK_NMI_BROADCAST_REQUEST_HANDLER)(UINT32 CoreId, BOOLEAN IsOnVmxNmiHandler); + +/** + * @brief Check and handle NMI callbacks + * + */ +typedef BOOLEAN (*KD_CHECK_AND_HANDLE_NMI_CALLBACK)(UINT32 CoreId); + +/** + * @brief Set the top-level driver's error status + * + */ +typedef VOID (*VMM_CALLBACK_SET_LAST_ERROR)(UINT32 LastError); + +/** + * @brief Check and modify the protected resources of the hypervisor + * + */ +typedef BOOLEAN (*VMM_CALLBACK_QUERY_TERMINATE_PROTECTED_RESOURCE)(UINT32 CoreId, + PROTECTED_HV_RESOURCES_TYPE ResourceType, + PVOID Context, + PROTECTED_HV_RESOURCES_PASSING_OVERS PassOver); + +/** + * @brief Query debugger thread or process tracing details by core ID + * + */ +typedef BOOLEAN (*KD_QUERY_DEBUGGER_THREAD_OR_PROCESS_TRACING_DETAILS_BY_CORE_ID)(UINT32 CoreId, + DEBUGGER_THREAD_PROCESS_TRACING TracingType); +/** + * @brief Handler of debugger specific VMCALLs + * + */ +typedef BOOLEAN (*VMM_CALLBACK_VMCALL_HANDLER)(UINT32 CoreId, + UINT64 VmcallNumber, + UINT64 OptionalParam1, + UINT64 OptionalParam2, + UINT64 OptionalParam3); + +////////////////////////////////////////////////// +// Callback Structure // +////////////////////////////////////////////////// + +/** + * @brief Prototype of each function needed by VMM module + * + */ +typedef struct _VMM_CALLBACKS +{ + // + // Log (Hyperlog) callbacks + // + LOG_CALLBACK_PREPARE_AND_SEND_MESSAGE_TO_QUEUE LogCallbackPrepareAndSendMessageToQueueWrapper; // Fixed + LOG_CALLBACK_SEND_MESSAGE_TO_QUEUE LogCallbackSendMessageToQueue; // Fixed + LOG_CALLBACK_SEND_BUFFER LogCallbackSendBuffer; // Fixed + LOG_CALLBACK_CHECK_IF_BUFFER_IS_FULL LogCallbackCheckIfBufferIsFull; // Fixed + + // + // VMM callbacks + // + VMM_CALLBACK_TRIGGER_EVENTS VmmCallbackTriggerEvents; // Fixed + VMM_CALLBACK_SET_LAST_ERROR VmmCallbackSetLastError; // Fixed + VMM_CALLBACK_VMCALL_HANDLER VmmCallbackVmcallHandler; // Fixed + VMM_CALLBACK_NMI_BROADCAST_REQUEST_HANDLER VmmCallbackNmiBroadcastRequestHandler; // Fixed + VMM_CALLBACK_QUERY_TERMINATE_PROTECTED_RESOURCE VmmCallbackQueryTerminateProtectedResource; // Fixed + VMM_CALLBACK_RESTORE_EPT_STATE VmmCallbackRestoreEptState; // Fixed + VMM_CALLBACK_CHECK_UNHANDLED_EPT_VIOLATION VmmCallbackCheckUnhandledEptViolations; // Fixed + + // + // Debugging callbacks + // + DEBUGGING_CALLBACK_HANDLE_BREAKPOINT_EXCEPTION DebuggingCallbackHandleBreakpointException; // Fixed + DEBUGGING_CALLBACK_HANDLE_DEBUG_BREAKPOINT_EXCEPTION DebuggingCallbackHandleDebugBreakpointException; // Fixed + DEBUGGING_CALLBACK_CONDITIONAL_PAGE_FAULT_EXCEPTION DebuggingCallbackConditionalPageFaultException; // Fixed + + // + // Interception callbacks + // + INTERCEPTION_CALLBACK_TRIGGER_CR3_CHANGE InterceptionCallbackTriggerCr3ProcessChange; // Fixed + + // + // Callbacks to be removed + // + BREAKPOINT_CHECK_AND_HANDLE_REAPPLYING_BREAKPOINT BreakpointCheckAndHandleReApplyingBreakpoint; + UD_CHECK_FOR_COMMAND UdCheckForCommand; + KD_CHECK_AND_HANDLE_NMI_CALLBACK KdCheckAndHandleNmiCallback; + VMM_CALLBACK_REGISTERED_MTF_HANDLER VmmCallbackRegisteredMtfHandler; // Fixed but not good + INTERCEPTION_CALLBACK_TRIGGER_CLOCK_AND_IPI DebuggerCheckProcessOrThreadChange; + ATTACHING_HANDLE_CR3_EVENTS_FOR_THREAD_INTERCEPTION AttachingHandleCr3VmexitsForThreadInterception; + KD_QUERY_DEBUGGER_THREAD_OR_PROCESS_TRACING_DETAILS_BY_CORE_ID KdQueryDebuggerQueryThreadOrProcessTracingDetailsByCoreId; + +} VMM_CALLBACKS, *PVMM_CALLBACKS; + + +//..\..\..\bin\debug\SDK\Imports\HyperDbgCtrlImports.h +/** + * @file HyperDbgCtrlImports.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers relating exported functions from controller interface + * @version 0.2 + * @date 2023-02-02 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#ifdef HYPERDBG_HPRDBGCTRL +# define IMPORT_EXPORT_CTRL __declspec(dllexport) +#else +# define IMPORT_EXPORT_CTRL __declspec(dllimport) +#endif + +// +// Header file of HPRDBGCTRL +// Imports +// +#ifdef __cplusplus +extern "C" { +#endif + +// +// Support Detection +// +IMPORT_EXPORT_CTRL bool HyperDbgVmxSupportDetection(); +IMPORT_EXPORT_CTRL void HyperDbgReadVendorString(char *); + +// +// VMM Module +// +IMPORT_EXPORT_CTRL int HyperDbgLoadVmm(); +IMPORT_EXPORT_CTRL int HyperDbgUnloadVmm(); +IMPORT_EXPORT_CTRL int HyperDbgInstallVmmDriver(); +IMPORT_EXPORT_CTRL int HyperDbgUninstallVmmDriver(); +IMPORT_EXPORT_CTRL int HyperDbgStopVmmDriver(); + +// +// General imports +// +IMPORT_EXPORT_CTRL int HyperDbgInterpreter(char * Command); +IMPORT_EXPORT_CTRL void HyperDbgShowSignature(); +IMPORT_EXPORT_CTRL void HyperDbgSetTextMessageCallback(Callback handler); +IMPORT_EXPORT_CTRL int HyperDbgScriptReadFileAndExecuteCommandline(int argc, char * argv[]); +IMPORT_EXPORT_CTRL bool HyperDbgContinuePreviousCommand(); +IMPORT_EXPORT_CTRL bool HyperDbgCheckMultilineCommand(char * CurrentCommand, bool Reset); + +#ifdef __cplusplus +} +#endif + + +//..\..\..\bin\debug\SDK\Imports\HyperDbgHyperLogImports.h +/** + * @file HyperDbgHyperLogImports.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers relating exported functions from hyperlog project + * @version 0.1 + * @date 2023-01-15 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#ifdef HYPERDBG_HYPER_LOG +# define IMPORT_EXPORT_HYPERLOG __declspec(dllexport) +#else +# define IMPORT_EXPORT_HYPERLOG __declspec(dllimport) +#endif + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +IMPORT_EXPORT_HYPERLOG BOOLEAN +LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks); + +IMPORT_EXPORT_HYPERLOG VOID +LogUnInitialize(); + +IMPORT_EXPORT_HYPERLOG UINT32 +LogMarkAllAsRead(BOOLEAN IsVmxRoot); + +IMPORT_EXPORT_HYPERLOG BOOLEAN +LogCallbackPrepareAndSendMessageToQueue(UINT32 OperationCode, + BOOLEAN IsImmediateMessage, + BOOLEAN ShowCurrentSystemTime, + BOOLEAN Priority, + const char * Fmt, + ...); + +IMPORT_EXPORT_HYPERLOG BOOLEAN +LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode, + BOOLEAN IsImmediateMessage, + BOOLEAN ShowCurrentSystemTime, + BOOLEAN Priority, + const char * Fmt, + va_list ArgList); + +IMPORT_EXPORT_HYPERLOG BOOLEAN +LogCallbackSendBuffer(_In_ UINT32 OperationCode, + _In_reads_bytes_(BufferLength) PVOID Buffer, + _In_ UINT32 BufferLength, + _In_ BOOLEAN Priority); + +IMPORT_EXPORT_HYPERLOG BOOLEAN +LogCallbackCheckIfBufferIsFull(BOOLEAN Priority); + +IMPORT_EXPORT_HYPERLOG BOOLEAN +LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR * LogMessage, UINT32 BufferLen, BOOLEAN Priority); + +IMPORT_EXPORT_HYPERLOG NTSTATUS +LogRegisterEventBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp); + +IMPORT_EXPORT_HYPERLOG NTSTATUS +LogRegisterIrpBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp); + + +//..\..\..\bin\debug\SDK\Imports\HyperDbgHyperLogIntrinsics.h +/** + * @file HyperDbgHyperLogIntrinsics.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers relating exported functions from hyperlog project + * @version 0.1 + * @date 2023-01-15 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Enums // +////////////////////////////////////////////////// + +/** + * @brief Types of log messages + * + */ +typedef enum _LOG_TYPE +{ + LOG_INFO, + LOG_WARNING, + LOG_ERROR + +} LOG_TYPE; + +////////////////////////////////////////////////// +// Logging // +////////////////////////////////////////////////// + +/** + * @brief Define log variables + * + */ +#if UseDbgPrintInsteadOfUsermodeMessageTracking +/* Use DbgPrint */ +# define Logformat, ...) \ + DbgPrint("[+] Information (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__) + +# define LogWarning(format, ...) \ + DbgPrint("[-] Warning (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__) + +# define LogError(format, ...) \ + DbgPrint("[!] Error (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__); \ + DbgBreakPoint() + +/** + * @brief Log without any prefix + * + */ +# define Log(format, ...) \ + DbgPrint(format, __VA_ARGS__) + +#else + +/** + * @brief Log, general + * + */ +# define LogInfo(format, ...) \ + LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ + UseImmediateMessaging, \ + ShowSystemTimeOnDebugMessages, \ + FALSE, \ + "[+] Information (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__) + +/** + * @brief Log in the case of priority message + * + */ +# define LogInfoPriority(format, ...) \ + LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ + TRUE, \ + ShowSystemTimeOnDebugMessages, \ + TRUE, \ + "[+] Information (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__) + +/** + * @brief Log in the case of warning + * + */ +# define LogWarning(format, ...) \ + LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_WARNING_MESSAGE, \ + UseImmediateMessaging, \ + ShowSystemTimeOnDebugMessages, \ + TRUE, \ + "[-] Warning (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__) + +/** + * @brief Log in the case of error + * + */ +# define LogError(format, ...) \ + LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_ERROR_MESSAGE, \ + UseImmediateMessaging, \ + ShowSystemTimeOnDebugMessages, \ + TRUE, \ + "[!] Error (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__); \ + if (DebugMode) \ + DbgBreakPoint() + +/** + * @brief Log without any prefix + * + */ +# define Log(format, ...) \ + LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ + TRUE, \ + FALSE, \ + FALSE, \ + format, \ + __VA_ARGS__) + +/** + * @brief Log without any prefix and bypass the stack + * problem (getting two temporary stacks in preparing phase) + * + */ +# define LogSimpleWithTag(tag, isimmdte, buffer, len) \ + LogCallbackSendMessageToQueue(tag, \ + isimmdte, \ + buffer, \ + len, \ + FALSE) + +#endif // UseDbgPrintInsteadOfUsermodeMessageTracking + +/** + * @brief Log, initialize boot information and debug information + * + */ +#define LogDebugInfo(format, ...) \ + if (DebugMode) \ + LogCallbackPrepareAndSendMessageToQueue(OPERATION_LOG_INFO_MESSAGE, \ + UseImmediateMessaging, \ + ShowSystemTimeOnDebugMessages, \ + FALSE, \ + "[+] Information (%s:%d) | " format "\n", \ + __func__, \ + __LINE__, \ + __VA_ARGS__) + + +//..\..\..\bin\debug\SDK\Imports\HyperDbgRevImports.h +/** + * @file HyperDbgRevImports.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers relating exported functions from reversing machine interface + * @version 0.2 + * @date 2023-02-02 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +// +// Header file of hpr +// Imports +// +#ifdef __cplusplus +extern "C" { +#endif + +// +// Reversing Machine Module +// +__declspec(dllimport) int ReversingMachineStart(); +__declspec(dllimport) int ReversingMachineStop(); + +#ifdef __cplusplus +} +#endif + + +//..\..\..\bin\debug\SDK\Imports\HyperDbgScriptImports.h +/** + * @file HyperDbgScriptImports.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers relating exported functions from script engine + * @version 0.2 + * @date 2023-02-02 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +// +// Header file of script-engine +// Imports +// +#ifdef __cplusplus +extern "C" { +#endif + +// +// Script engine +// +__declspec(dllimport) PSYMBOL_BUFFER +ScriptEngineParse(char * str); +__declspec(dllimport) void +PrintSymbolBuffer(const PSYMBOL_BUFFER SymbolBuffer); +__declspec(dllimport) void +PrintSymbol(PSYMBOL Symbol); +__declspec(dllimport) void +RemoveSymbolBuffer(PSYMBOL_BUFFER SymbolBuffer); +__declspec(dllimport) BOOLEAN +FuncGetNumberOfOperands(UINT64 FuncType, UINT32 * NumberOfGetOperands, UINT32 * NumberOfSetOperands); +__declspec(dllimport) BOOLEAN +ScriptEngineSetHwdbgInstanceInfo(HWDBG_INSTANCE_INFORMATION * InstancInfo); + +; + +// +// pdb parser +// +__declspec(dllimport) VOID +ScriptEngineSetTextMessageCallback(PVOID Handler); +__declspec(dllimport) VOID +ScriptEngineSymbolAbortLoading(); +__declspec(dllimport) UINT64 +ScriptEngineConvertNameToAddress(const char * FunctionOrVariableName, PBOOLEAN WasFound); +__declspec(dllimport) UINT32 +ScriptEngineLoadFileSymbol(UINT64 BaseAddress, const char * PdbFileName, const char * CustomModuleName); +__declspec(dllimport) UINT32 +ScriptEngineUnloadAllSymbols(); +__declspec(dllimport) UINT32 +ScriptEngineUnloadModuleSymbol(char * ModuleName); +__declspec(dllimport) UINT32 +ScriptEngineSearchSymbolForMask(const char * SearchMask); +__declspec(dllimport) BOOLEAN +ScriptEngineGetFieldOffset(CHAR * TypeName, CHAR * FieldName, UINT32 * FieldOffset); +__declspec(dllimport) BOOLEAN +ScriptEngineGetDataTypeSize(CHAR * TypeName, UINT64 * TypeSize); +__declspec(dllimport) BOOLEAN +ScriptEngineCreateSymbolTableForDisassembler(void * CallbackFunction); +__declspec(dllimport) BOOLEAN +ScriptEngineConvertFileToPdbPath(const char * LocalFilePath, char * ResultPath); +__declspec(dllimport) BOOLEAN +ScriptEngineConvertFileToPdbFileAndGuidAndAgeDetails(const char * LocalFilePath, char * PdbFilePath, char * GuidAndAgeDetails, BOOLEAN Is32BitModule); +__declspec(dllimport) BOOLEAN +ScriptEngineSymbolInitLoad(PVOID BufferToStoreDetails, UINT32 StoredLength, BOOLEAN DownloadIfAvailable, const char * SymbolPath, BOOLEAN IsSilentLoad); +__declspec(dllimport) BOOLEAN +ScriptEngineShowDataBasedOnSymbolTypes(const char * TypeName, UINT64 Address, BOOLEAN IsStruct, PVOID BufferAddress, const char * AdditionalParameters); + +#ifdef __cplusplus +} +#endif + + +//..\..\..\bin\debug\SDK\Imports\HyperDbgSymImports.h +/** + * @file HyperDbgSymImports.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers relating exported functions from symbol parser + * @version 0.2 + * @date 2023-02-02 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +// +// Header file of symbol-parser +// Imports +// +#ifdef __cplusplus +extern "C" { +#endif + +__declspec(dllimport) VOID + SymSetTextMessageCallback(PVOID Handler); +__declspec(dllimport) VOID + SymbolAbortLoading(); +__declspec(dllimport) UINT64 + SymConvertNameToAddress(const char * FunctionOrVariableName, PBOOLEAN WasFound); +__declspec(dllimport) UINT32 + SymLoadFileSymbol(UINT64 BaseAddress, const char * PdbFileName, const char * CustomModuleName); +__declspec(dllimport) UINT32 + SymUnloadAllSymbols(); +__declspec(dllimport) UINT32 + SymUnloadModuleSymbol(char * ModuleName); +__declspec(dllimport) UINT32 + SymSearchSymbolForMask(const char * SearchMask); +__declspec(dllimport) BOOLEAN + SymGetFieldOffset(CHAR * TypeName, CHAR * FieldName, UINT32 * FieldOffset); +__declspec(dllimport) BOOLEAN + SymGetDataTypeSize(CHAR * TypeName, UINT64 * TypeSize); +__declspec(dllimport) BOOLEAN + SymCreateSymbolTableForDisassembler(void * CallbackFunction); +__declspec(dllimport) BOOLEAN + SymConvertFileToPdbPath(const char * LocalFilePath, char * ResultPath); +__declspec(dllimport) BOOLEAN + SymConvertFileToPdbFileAndGuidAndAgeDetails(const char * LocalFilePath, + char * PdbFilePath, + char * GuidAndAgeDetails, + BOOLEAN Is32BitModule); +__declspec(dllimport) BOOLEAN + SymbolInitLoad(PVOID BufferToStoreDetails, + UINT32 StoredLength, + BOOLEAN DownloadIfAvailable, + const char * SymbolPath, + BOOLEAN IsSilentLoad); +__declspec(dllimport) BOOLEAN + SymShowDataBasedOnSymbolTypes(const char * TypeName, + UINT64 Address, + BOOLEAN IsStruct, + PVOID BufferAddress, + const char * AdditionalParameters); +__declspec(dllimport) BOOLEAN + SymQuerySizeof(_In_ const char * StructNameOrTypeName, _Out_ UINT32 * SizeOfField); +__declspec(dllimport) BOOLEAN + SymCastingQueryForFiledsAndTypes(_In_ const char * StructName, + _In_ const char * FiledOfStructName, + _Out_ PBOOLEAN IsStructNamePointerOrNot, + _Out_ PBOOLEAN IsFiledOfStructNamePointerOrNot, + _Out_ char ** NewStructOrTypeName, + _Out_ UINT32 * OffsetOfFieldFromTop, + _Out_ UINT32 * SizeOfField); + +#ifdef __cplusplus +} +#endif + + +//..\..\..\bin\debug\SDK\Imports\HyperDbgVmmImports.h +/** + * @file HyperDbgVmmImports.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers relating exported functions from hypervisor + * @version 0.1 + * @date 2022-12-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#ifdef HYPERDBG_VMM +# define IMPORT_EXPORT_VMM __declspec(dllexport) +#else +# define IMPORT_EXPORT_VMM __declspec(dllimport) +#endif + +////////////////////////////////////////////////// +// VM Functions // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM NTSTATUS +VmFuncVmxVmcall(unsigned long long VmcallNumber, + unsigned long long OptionalParam1, + unsigned long long OptionalParam2, + unsigned long long OptionalParam3); + +IMPORT_EXPORT_VMM VOID +VmFuncPerformRipIncrement(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncSuppressRipIncrement(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncChangeMtfUnsettingState(UINT32 CoreId, BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncChangeIgnoreOneMtfState(UINT32 CoreId, BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetMonitorTrapFlag(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetRflagTrapFlag(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncRegisterMtfBreak(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncUnRegisterMtfBreak(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncSetLoadDebugControls(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetSaveDebugControls(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetPmcVmexit(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetMovControlRegsExiting(BOOLEAN Set, UINT64 ControlRegister, UINT64 MaskRegister); + +IMPORT_EXPORT_VMM VOID +VmFuncSetMovToCr3Vmexit(UINT32 CoreId, BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncWriteExceptionBitmap(UINT32 BitmapMask); + +IMPORT_EXPORT_VMM VOID +VmFuncSetInterruptWindowExiting(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetNmiWindowExiting(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetNmiExiting(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetExceptionBitmap(UINT32 CoreId, UINT32 IdtIndex); + +IMPORT_EXPORT_VMM VOID +VmFuncUnsetExceptionBitmap(UINT32 CoreId, UINT32 IdtIndex); + +IMPORT_EXPORT_VMM VOID +VmFuncSetExternalInterruptExiting(UINT32 CoreId, BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetRdtscExiting(UINT32 CoreId, BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetMovDebugRegsExiting(UINT32 CoreId, BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncInjectPendingExternalInterrupts(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncSetRflags(UINT64 Rflags); + +IMPORT_EXPORT_VMM VOID +VmFuncSetRip(UINT64 Rip); + +IMPORT_EXPORT_VMM VOID +VmFuncSetTriggerEventForVmcalls(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetTriggerEventForCpuids(BOOLEAN Set); + +IMPORT_EXPORT_VMM VOID +VmFuncSetInterruptibilityState(UINT64 InterruptibilityState); + +IMPORT_EXPORT_VMM VOID +VmFuncCheckAndEnableExternalInterrupts(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncDisableExternalInterruptsAndInterruptWindow(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncEventInjectPageFaultWithCr2(UINT32 CoreId, UINT64 Address, UINT32 PageFaultCode); + +IMPORT_EXPORT_VMM VOID +VmFuncEventInjectPageFaultRangeAddress(UINT32 CoreId, + UINT64 AddressFrom, + UINT64 AddressTo, + UINT32 PageFaultCode); + +IMPORT_EXPORT_VMM VOID +VmFuncEventInjectInterruption(UINT32 InterruptionType, + UINT32 Vector, + BOOLEAN DeliverErrorCode, + UINT32 ErrorCode); + +IMPORT_EXPORT_VMM VOID +VmFuncVmxBroadcastInitialize(); + +IMPORT_EXPORT_VMM VOID +VmFuncVmxBroadcastUninitialize(); + +IMPORT_EXPORT_VMM VOID +VmFuncEventInjectBreakpoint(); + +IMPORT_EXPORT_VMM VOID +VmFuncInvalidateEptSingleContext(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncInvalidateEptAllContexts(); + +IMPORT_EXPORT_VMM VOID +VmFuncUninitVmm(); + +IMPORT_EXPORT_VMM VOID +VmFuncEnableMtfAndChangeExternalInterruptState(UINT32 CoreId); + +IMPORT_EXPORT_VMM VOID +VmFuncEnableAndCheckForPreviousExternalInterrupts(UINT32 CoreId); + +IMPORT_EXPORT_VMM UINT16 +VmFuncGetCsSelector(); + +IMPORT_EXPORT_VMM UINT32 +VmFuncReadExceptionBitmap(); + +IMPORT_EXPORT_VMM UINT64 +VmFuncGetLastVmexitRip(UINT32 CoreId); + +IMPORT_EXPORT_VMM UINT64 +VmFuncGetRflags(); + +IMPORT_EXPORT_VMM UINT64 +VmFuncGetRip(); + +IMPORT_EXPORT_VMM UINT64 +VmFuncGetInterruptibilityState(); + +IMPORT_EXPORT_VMM UINT64 +VmFuncClearSteppingBits(UINT64 Interruptibility); + +IMPORT_EXPORT_VMM BOOLEAN +VmFuncInitVmm(VMM_CALLBACKS * VmmCallbacks); + +IMPORT_EXPORT_VMM UINT32 +VmFuncVmxCompatibleStrlen(const CHAR * s); + +IMPORT_EXPORT_VMM UINT32 +VmFuncVmxCompatibleWcslen(const wchar_t * s); + +IMPORT_EXPORT_VMM BOOLEAN +VmFuncNmiBroadcastRequest(UINT32 CoreId); + +IMPORT_EXPORT_VMM BOOLEAN +VmFuncNmiBroadcastInvalidateEptSingleContext(UINT32 CoreId); + +IMPORT_EXPORT_VMM BOOLEAN +VmFuncNmiBroadcastInvalidateEptAllContexts(UINT32 CoreId); + +IMPORT_EXPORT_VMM BOOLEAN +VmFuncVmxGetCurrentExecutionMode(); + +IMPORT_EXPORT_VMM BOOLEAN +VmFuncQueryModeExecTrap(); + +IMPORT_EXPORT_VMM INT32 +VmFuncVmxCompatibleStrcmp(const CHAR * Address1, const CHAR * Address2); + +IMPORT_EXPORT_VMM INT32 +VmFuncVmxCompatibleStrncmp(const CHAR * Address1, const CHAR * Address2, SIZE_T Num); + +IMPORT_EXPORT_VMM INT32 +VmFuncVmxCompatibleWcscmp(const wchar_t * Address1, const wchar_t * Address2); + +IMPORT_EXPORT_VMM INT32 +VmFuncVmxCompatibleWcsncmp(const wchar_t * Address1, const wchar_t * Address2, SIZE_T Num); + +IMPORT_EXPORT_VMM INT32 +VmFuncVmxCompatibleMemcmp(const CHAR * Address1, const CHAR * Address2, size_t Count); + +////////////////////////////////////////////////// +// Configuration Functions // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM VOID +ConfigureEnableMovToCr3ExitingOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +ConfigureDisableMovToCr3ExitingOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +ConfigureEnableEferSyscallEventsOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +ConfigureDisableEferSyscallEventsOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +ConfigureSetExternalInterruptExitingOnSingleCore(UINT32 TargetCoreId); + +IMPORT_EXPORT_VMM VOID +ConfigureEnableRdtscExitingOnSingleCore(UINT32 TargetCoreId); + +IMPORT_EXPORT_VMM VOID +ConfigureEnableRdpmcExitingOnSingleCore(UINT32 TargetCoreId); + +IMPORT_EXPORT_VMM VOID +ConfigureEnableMovToDebugRegistersExitingOnSingleCore(UINT32 TargetCoreId); + +IMPORT_EXPORT_VMM VOID +ConfigureSetExceptionBitmapOnSingleCore(UINT32 TargetCoreId, UINT32 BitMask); + +IMPORT_EXPORT_VMM VOID +ConfigureEnableMovToControlRegisterExitingOnSingleCore(UINT32 TargetCoreId, DEBUGGER_EVENT_OPTIONS * BroadcastingOption); + +IMPORT_EXPORT_VMM VOID +ConfigureChangeMsrBitmapWriteOnSingleCore(UINT32 TargetCoreId, UINT64 MsrMask); + +IMPORT_EXPORT_VMM VOID +ConfigureChangeMsrBitmapReadOnSingleCore(UINT32 TargetCoreId, UINT64 MsrMask); + +IMPORT_EXPORT_VMM VOID +ConfigureChangeIoBitmapOnSingleCore(UINT32 TargetCoreId, UINT64 Port); + +IMPORT_EXPORT_VMM VOID +ConfigureEnableEferSyscallHookOnSingleCore(UINT32 TargetCoreId); + +IMPORT_EXPORT_VMM VOID +ConfigureSetEferSyscallOrSysretHookType(DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE SyscallHookType); + +IMPORT_EXPORT_VMM VOID +ConfigureDirtyLoggingInitializeOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +ConfigureDirtyLoggingUninitializeOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +ConfigureModeBasedExecHookUninitializeOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +ConfigureUninitializeExecTrapOnAllProcessors(); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureInitializeExecTrapOnAllProcessors(); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHook(PVOID TargetAddress, UINT32 ProcessId); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookFromVmxRoot(PVOID TargetAddress); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHook2(UINT32 CoreId, + PVOID TargetAddress, + PVOID HookFunction, + UINT32 ProcessId); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHook2FromVmxRoot(UINT32 CoreId, + PVOID TargetAddress, + PVOID HookFunction); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookMonitor(UINT32 CoreId, + EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR * HookingDetails, + UINT32 ProcessId); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookMonitorFromVmxRoot(UINT32 CoreId, + EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR * MemoryAddressDetails); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookModifyInstructionFetchState(UINT32 CoreId, + PVOID PhysicalAddress, + BOOLEAN IsUnset); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookModifyPageReadState(UINT32 CoreId, + PVOID PhysicalAddress, + BOOLEAN IsUnset); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookModifyPageWriteState(UINT32 CoreId, + PVOID PhysicalAddress, + BOOLEAN IsUnset); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookUnHookSingleAddress(UINT64 VirtualAddress, + UINT64 PhysAddress, + UINT32 ProcessId); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureEptHookUnHookSingleAddressFromVmxRoot(UINT64 VirtualAddress, + UINT64 PhysAddress, + EPT_SINGLE_HOOK_UNHOOKING_DETAILS * TargetUnhookingDetails); + +IMPORT_EXPORT_VMM VOID +ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks(UINT32 Count); + +IMPORT_EXPORT_VMM VOID +ConfigureEptHookReservePreallocatedPoolsForEptHooks(UINT32 Count); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureExecTrapAddProcessToWatchingList(UINT32 ProcessId); + +IMPORT_EXPORT_VMM BOOLEAN +ConfigureExecTrapRemoveProcessFromWatchingList(UINT32 ProcessId); + +////////////////////////////////////////////////// +// Direct VMCALL Functions // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallTest(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallPerformVmcall(UINT32 CoreId, UINT64 VmcallNumber, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallChangeMsrBitmapRead(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallChangeMsrBitmapWrite(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallChangeIoBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallEnableRdpmcExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallEnableRdtscpExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallEnableMov2DebugRegsExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallSetExceptionBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallEnableExternalInterruptExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallEnableMovToCrExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallEnableEferSyscall(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallSetHiddenBreakpointHook(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallInvalidateEptAllContexts(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallInvalidateSingleContext(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallUnsetExceptionBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallUnhookSinglePage(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallResetMsrBitmapRead(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallResetMsrBitmapWrite(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallResetIoBitmap(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallDisableRdtscExitingForClearingTscEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallDisableRdpmcExiting(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallDisableEferSyscallEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallDisableMov2DrExitingForClearingDrEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +IMPORT_EXPORT_VMM NTSTATUS +DirectVmcallDisableMov2CrExitingForClearingCrEvents(UINT32 CoreId, DIRECT_VMCALL_PARAMETERS * DirectVmcallOptions); + +////////////////////////////////////////////////// +// Disassembler // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM BOOLEAN +DisassemblerShowInstructionsInVmxNonRootMode(PVOID Address, UINT32 Length, BOOLEAN Is32Bit); + +IMPORT_EXPORT_VMM BOOLEAN +DisassemblerShowOneInstructionInVmxNonRootMode(PVOID Address, UINT64 ActualRip, BOOLEAN Is32Bit); + +IMPORT_EXPORT_VMM UINT32 +DisassemblerShowOneInstructionInVmxRootMode(PVOID Address, BOOLEAN Is32Bit); + +////////////////////////////////////////////////// +// General Functions // +////////////////////////////////////////////////// + +// ---------------------------------------------------------------------------- +// Exported Interfaces For Virtual Addresses +// + +IMPORT_EXPORT_VMM UINT64 +VirtualAddressToPhysicalAddress(_In_ PVOID VirtualAddress); + +IMPORT_EXPORT_VMM UINT64 +VirtualAddressToPhysicalAddressByProcessId(_In_ PVOID VirtualAddress, + _In_ UINT32 ProcessId); + +IMPORT_EXPORT_VMM UINT64 +VirtualAddressToPhysicalAddressByProcessCr3(_In_ PVOID VirtualAddress, + _In_ CR3_TYPE TargetCr3); + +IMPORT_EXPORT_VMM UINT64 +VirtualAddressToPhysicalAddressOnTargetProcess(_In_ PVOID VirtualAddress); + +// ---------------------------------------------------------------------------- +// Exported Interfaces For Physical Addresses +// +IMPORT_EXPORT_VMM UINT64 +PhysicalAddressToVirtualAddress(_In_ UINT64 PhysicalAddress); + +IMPORT_EXPORT_VMM UINT64 +PhysicalAddressToVirtualAddressByProcessId(_In_ PVOID PhysicalAddress, _In_ UINT32 ProcessId); + +IMPORT_EXPORT_VMM UINT64 +PhysicalAddressToVirtualAddressByCr3(_In_ PVOID PhysicalAddress, _In_ CR3_TYPE TargetCr3); + +IMPORT_EXPORT_VMM UINT64 +PhysicalAddressToVirtualAddressOnTargetProcess(_In_ PVOID PhysicalAddress); + +// ---------------------------------------------------------------------------- +// Exported Interfaces For Layout Switching Functions +// +IMPORT_EXPORT_VMM CR3_TYPE +SwitchToProcessMemoryLayout(_In_ UINT32 ProcessId); + +IMPORT_EXPORT_VMM CR3_TYPE +SwitchToCurrentProcessMemoryLayout(); + +IMPORT_EXPORT_VMM CR3_TYPE +SwitchToProcessMemoryLayoutByCr3(_In_ CR3_TYPE TargetCr3); + +IMPORT_EXPORT_VMM VOID +SwitchToPreviousProcess(_In_ CR3_TYPE PreviousProcess); + +// ---------------------------------------------------------------------------- +// Exported Interfaces For Check Validity of Addresses +// +IMPORT_EXPORT_VMM BOOLEAN +CheckAddressValidityUsingTsx(CHAR * Address); + +IMPORT_EXPORT_VMM BOOLEAN +CheckAccessValidityAndSafety(UINT64 TargetAddress, UINT32 Size); + +IMPORT_EXPORT_VMM BOOLEAN +CheckAddressPhysical(UINT64 PAddr); + +IMPORT_EXPORT_VMM UINT32 +CheckAddressMaximumInstructionLength(PVOID Address); + +// ---------------------------------------------------------------------------- +// Exported Interfaces For Layout Functions +// +IMPORT_EXPORT_VMM CR3_TYPE +LayoutGetCurrentProcessCr3(); + +IMPORT_EXPORT_VMM CR3_TYPE +LayoutGetExactGuestProcessCr3(); + +////////////////////////////////////////////////// +// Memory Management Functions // +////////////////////////////////////////////////// + +// ---------------------------------------------------------------------------- +// PTE-related Functions +// + +IMPORT_EXPORT_VMM PVOID +MemoryMapperGetPteVa(_In_ PVOID Va, + _In_ PAGING_LEVEL Level); + +IMPORT_EXPORT_VMM PVOID +MemoryMapperGetPteVaByCr3(_In_ PVOID Va, + _In_ PAGING_LEVEL Level, + _In_ CR3_TYPE TargetCr3); + +IMPORT_EXPORT_VMM PVOID +MemoryMapperGetPteVaWithoutSwitchingByCr3(_In_ PVOID Va, + _In_ PAGING_LEVEL Level, + _In_ CR3_TYPE TargetCr3); + +IMPORT_EXPORT_VMM PVOID +MemoryMapperGetPteVaOnTargetProcess(_In_ PVOID Va, + _In_ PAGING_LEVEL Level); + +IMPORT_EXPORT_VMM PVOID +MemoryMapperSetExecuteDisableToPteOnTargetProcess(_In_ PVOID Va, + _In_ BOOLEAN Set); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperCheckPteIsPresentOnTargetProcess(PVOID Va, + PAGING_LEVEL Level); + +// ---------------------------------------------------------------------------- +// Reading Memory Functions +// +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperReadMemorySafe(_In_ UINT64 VaAddressToRead, + _Inout_ PVOID BufferToSaveMemory, + _In_ SIZE_T SizeToRead); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperReadMemorySafeByPhysicalAddress(_In_ UINT64 PaAddressToRead, + _Inout_ UINT64 BufferToSaveMemory, + _In_ SIZE_T SizeToRead); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperReadMemorySafeOnTargetProcess(_In_ UINT64 VaAddressToRead, + _Inout_ PVOID BufferToSaveMemory, + _In_ SIZE_T SizeToRead); + +// ---------------------------------------------------------------------------- +// Disassembler Functions +// +IMPORT_EXPORT_VMM UINT32 +DisassemblerLengthDisassembleEngine(PVOID Address, BOOLEAN Is32Bit); + +IMPORT_EXPORT_VMM UINT32 +DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess(PVOID Address, BOOLEAN Is32Bit); + +// ---------------------------------------------------------------------------- +// Writing Memory Functions +// +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperWriteMemorySafe(_Inout_ UINT64 Destination, + _In_ PVOID Source, + _In_ SIZE_T SizeToWrite, + _In_ CR3_TYPE TargetProcessCr3); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperWriteMemorySafeOnTargetProcess(_Inout_ UINT64 Destination, + _In_ PVOID Source, + _In_ SIZE_T Size); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperWriteMemorySafeByPhysicalAddress(_Inout_ UINT64 DestinationPa, + _In_ UINT64 Source, + _In_ SIZE_T SizeToWrite); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperWriteMemoryUnsafe(_Inout_ UINT64 Destination, + _In_ PVOID Source, + _In_ SIZE_T SizeToWrite, + _In_ UINT32 TargetProcessId); + +// ---------------------------------------------------------------------------- +// Reserving Memory Functions +// +IMPORT_EXPORT_VMM UINT64 +MemoryMapperReserveUsermodeAddressOnTargetProcess(_In_ UINT32 ProcessId, + _In_ BOOLEAN Allocate); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperFreeMemoryOnTargetProcess(_In_ UINT32 ProcessId, + _Inout_ PVOID BaseAddress); + +// ---------------------------------------------------------------------------- +// Miscellaneous Memory Functions +// +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperSetSupervisorBitWithoutSwitchingByCr3(_In_ PVOID Va, + _In_ BOOLEAN Set, + _In_ PAGING_LEVEL Level, + _In_ CR3_TYPE TargetCr3); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess(_In_ PVOID Va); + +IMPORT_EXPORT_VMM BOOLEAN +MemoryMapperCheckIfPdeIsLargePageOnTargetProcess(_In_ PVOID Va); + +////////////////////////////////////////////////// +// Memory Manager // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM BOOLEAN +MemoryManagerReadProcessMemoryNormal(HANDLE PID, PVOID Address, DEBUGGER_READ_MEMORY_TYPE MemType, PVOID UserBuffer, SIZE_T Size, PSIZE_T ReturnSize); + +////////////////////////////////////////////////// +// Pool Manager // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM BOOLEAN +PoolManagerCheckAndPerformAllocationAndDeallocation(); + +IMPORT_EXPORT_VMM BOOLEAN +PoolManagerRequestAllocation(SIZE_T Size, UINT32 Count, POOL_ALLOCATION_INTENTION Intention); + +IMPORT_EXPORT_VMM UINT64 +PoolManagerRequestPool(POOL_ALLOCATION_INTENTION Intention, BOOLEAN RequestNewPool, UINT32 Size); + +IMPORT_EXPORT_VMM BOOLEAN +PoolManagerFreePool(UINT64 AddressToFree); + +IMPORT_EXPORT_VMM VOID +PoolManagerShowPreAllocatedPools(); + +////////////////////////////////////////////////// +// VMX Registers Modification // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM VOID +SetGuestCsSel(PVMX_SEGMENT_SELECTOR Cs); + +IMPORT_EXPORT_VMM VOID +SetGuestCs(PVMX_SEGMENT_SELECTOR Cs); + +IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR +GetGuestCs(); + +IMPORT_EXPORT_VMM VOID +SetGuestSsSel(PVMX_SEGMENT_SELECTOR Ss); + +IMPORT_EXPORT_VMM VOID +SetGuestSs(PVMX_SEGMENT_SELECTOR Ss); + +IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR +GetGuestSs(); + +IMPORT_EXPORT_VMM VOID +SetGuestDsSel(PVMX_SEGMENT_SELECTOR Ds); + +IMPORT_EXPORT_VMM VOID +SetGuestDs(PVMX_SEGMENT_SELECTOR Ds); + +IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR +GetGuestDs(); + +IMPORT_EXPORT_VMM VOID +SetGuestFsSel(PVMX_SEGMENT_SELECTOR Fs); + +IMPORT_EXPORT_VMM VOID +SetGuestFs(PVMX_SEGMENT_SELECTOR Fs); + +IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR +GetGuestFs(); + +IMPORT_EXPORT_VMM VOID +SetGuestGsSel(PVMX_SEGMENT_SELECTOR Gs); + +IMPORT_EXPORT_VMM VOID +SetGuestGs(PVMX_SEGMENT_SELECTOR Gs); + +IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR +GetGuestGs(); + +IMPORT_EXPORT_VMM VOID +SetGuestEsSel(PVMX_SEGMENT_SELECTOR Es); + +IMPORT_EXPORT_VMM VOID +SetGuestEs(PVMX_SEGMENT_SELECTOR Es); + +IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR +GetGuestEs(); + +IMPORT_EXPORT_VMM VOID +SetGuestIdtr(UINT64 Idtr); + +IMPORT_EXPORT_VMM UINT64 +GetGuestIdtr(); + +IMPORT_EXPORT_VMM VOID +SetGuestLdtr(UINT64 Ldtr); + +IMPORT_EXPORT_VMM UINT64 +GetGuestLdtr(); + +IMPORT_EXPORT_VMM VOID +SetGuestGdtr(UINT64 Gdtr); + +IMPORT_EXPORT_VMM UINT64 +GetGuestGdtr(); + +IMPORT_EXPORT_VMM VOID +SetGuestTr(UINT64 Tr); + +IMPORT_EXPORT_VMM UINT64 +GetGuestTr(); + +IMPORT_EXPORT_VMM VOID +SetGuestRFlags(UINT64 RFlags); + +IMPORT_EXPORT_VMM UINT64 +GetGuestRFlags(); + +IMPORT_EXPORT_VMM VOID +SetGuestRIP(UINT64 RIP); + +IMPORT_EXPORT_VMM VOID +SetGuestRSP(UINT64 RSP); + +IMPORT_EXPORT_VMM UINT64 +GetGuestRIP(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestCr0(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestCr2(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestCr3(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestCr4(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestCr8(); + +IMPORT_EXPORT_VMM VOID +SetGuestCr0(UINT64 Cr0); + +IMPORT_EXPORT_VMM VOID +SetGuestCr2(UINT64 Cr2); + +IMPORT_EXPORT_VMM VOID +SetGuestCr3(UINT64 Cr3); + +IMPORT_EXPORT_VMM VOID +SetGuestCr4(UINT64 Cr4); + +IMPORT_EXPORT_VMM VOID +SetGuestCr8(UINT64 Cr8); + +IMPORT_EXPORT_VMM UINT64 +GetGuestDr0(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestDr1(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestDr2(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestDr3(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestDr6(); + +IMPORT_EXPORT_VMM UINT64 +GetGuestDr7(); + +IMPORT_EXPORT_VMM VOID +SetGuestDr0(UINT64 value); + +IMPORT_EXPORT_VMM VOID +SetGuestDr1(UINT64 value); + +IMPORT_EXPORT_VMM VOID +SetGuestDr2(UINT64 value); + +IMPORT_EXPORT_VMM VOID +SetGuestDr3(UINT64 value); + +IMPORT_EXPORT_VMM VOID +SetGuestDr6(UINT64 value); + +IMPORT_EXPORT_VMM VOID +SetGuestDr7(UINT64 value); + +IMPORT_EXPORT_VMM BOOLEAN +SetDebugRegisters(UINT32 DebugRegNum, DEBUG_REGISTER_TYPE ActionType, BOOLEAN ApplyToVmcs, UINT64 TargetAddress); + +////////////////////////////////////////////////// +// Transparent Mode // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM NTSTATUS +TransparentHideDebugger(PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE Measurements); + +IMPORT_EXPORT_VMM NTSTATUS +TransparentUnhideDebugger(); + +////////////////////////////////////////////////// +// Non-internal Broadcasting Functions // +////////////////////////////////////////////////// + +IMPORT_EXPORT_VMM VOID +BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastEnableDbAndBpExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableDbAndBpExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastEnableRdtscExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableRdtscExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastChangeAllMsrBitmapReadAllCores(UINT64 BitmapMask); + +IMPORT_EXPORT_VMM VOID +BroadcastResetChangeAllMsrBitmapReadAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastChangeAllMsrBitmapWriteAllCores(UINT64 BitmapMask); + +IMPORT_EXPORT_VMM VOID +BroadcastResetAllMsrBitmapWriteAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableRdtscExitingForClearingEventsAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores(PDEBUGGER_EVENT_OPTIONS BroadcastingOption); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastEnableRdpmcExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableRdpmcExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastSetExceptionBitmapAllCores(UINT64 ExceptionIndex); + +IMPORT_EXPORT_VMM VOID +BroadcastUnsetExceptionBitmapAllCores(UINT64 ExceptionIndex); + +IMPORT_EXPORT_VMM VOID +BroadcastResetExceptionBitmapAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastEnableMovControlRegisterExitingAllCores(PDEBUGGER_EVENT_OPTIONS BroadcastingOption); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableMovToControlRegistersExitingAllCores(PDEBUGGER_EVENT_OPTIONS BroadcastingOption); + +IMPORT_EXPORT_VMM VOID +BroadcastEnableMovDebugRegistersExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableMovDebugRegistersExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastSetExternalInterruptExitingAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastIoBitmapChangeAllCores(UINT64 Port); + +IMPORT_EXPORT_VMM VOID +BroadcastIoBitmapResetAllCores(); + +IMPORT_EXPORT_VMM VOID +BroadcastEnableMovToCr3ExitingOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableMovToCr3ExitingOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +BroadcastEnableEferSyscallEventsOnAllProcessors(); + +IMPORT_EXPORT_VMM VOID +BroadcastDisableEferSyscallEventsOnAllProcessors(); + + diff --git a/gengo/bind/sdk/tmp/vars.go b/gengo/bind/sdk/tmp/vars.go new file mode 100644 index 000000000..0919fd1b0 --- /dev/null +++ b/gengo/bind/sdk/tmp/vars.go @@ -0,0 +1 @@ +package sdk From a9a780b77d7f9e87394aec66354a8c8b149eb9ad Mon Sep 17 00:00:00 2001 From: Admin <2762713521@qq.com> Date: Sat, 22 Jun 2024 00:11:42 +0800 Subject: [PATCH 4/4] TestMergeHeader --- gengo/bind/zydis/{ => tmp}/zydis.dll | Bin gengo/bind/zydis/zydis.go | 7100 -------------------------- gengo/bind/zydis/zydis_test.go | 7 +- gengo/clang/invoke.go | 2 +- 4 files changed, 5 insertions(+), 7104 deletions(-) rename gengo/bind/zydis/{ => tmp}/zydis.dll (100%) delete mode 100644 gengo/bind/zydis/zydis.go diff --git a/gengo/bind/zydis/zydis.dll b/gengo/bind/zydis/tmp/zydis.dll similarity index 100% rename from gengo/bind/zydis/zydis.dll rename to gengo/bind/zydis/tmp/zydis.dll diff --git a/gengo/bind/zydis/zydis.go b/gengo/bind/zydis/zydis.go deleted file mode 100644 index 5b5802409..000000000 --- a/gengo/bind/zydis/zydis.go +++ /dev/null @@ -1,7100 +0,0 @@ -// Code generated by gengo. DO NOT EDIT. -package zydis - -import ( - "unsafe" - - "github.com/can1357/gengo/gengort" -) - -const GengoLibraryName = "zydis" - -var GengoLibrary = gengort.NewLibrary(GengoLibraryName) - -// Defines the `ZydisInstructionCategory` enum. -type InstructionCategory int32 - -const ( - CATEGORY_INVALID InstructionCategory = 0 - CATEGORY_ADOX_ADCX InstructionCategory = 1 - CATEGORY_AES InstructionCategory = 2 - CATEGORY_AMD3DNOW InstructionCategory = 3 - CATEGORY_AMX_TILE InstructionCategory = 4 - CATEGORY_AVX InstructionCategory = 5 - CATEGORY_AVX2 InstructionCategory = 6 - CATEGORY_AVX2GATHER InstructionCategory = 7 - CATEGORY_AVX512 InstructionCategory = 8 - CATEGORY_AVX512_4FMAPS InstructionCategory = 9 - CATEGORY_AVX512_4VNNIW InstructionCategory = 10 - CATEGORY_AVX512_BITALG InstructionCategory = 11 - CATEGORY_AVX512_VBMI InstructionCategory = 12 - CATEGORY_AVX512_VP2INTERSECT InstructionCategory = 13 - CATEGORY_AVX_IFMA InstructionCategory = 14 - CATEGORY_BINARY InstructionCategory = 15 - CATEGORY_BITBYTE InstructionCategory = 16 - CATEGORY_BLEND InstructionCategory = 17 - CATEGORY_BMI1 InstructionCategory = 18 - CATEGORY_BMI2 InstructionCategory = 19 - CATEGORY_BROADCAST InstructionCategory = 20 - CATEGORY_CALL InstructionCategory = 21 - CATEGORY_CET InstructionCategory = 22 - CATEGORY_CLDEMOTE InstructionCategory = 23 - CATEGORY_CLFLUSHOPT InstructionCategory = 24 - CATEGORY_CLWB InstructionCategory = 25 - CATEGORY_CLZERO InstructionCategory = 26 - CATEGORY_CMOV InstructionCategory = 27 - CATEGORY_COMPRESS InstructionCategory = 28 - CATEGORY_COND_BR InstructionCategory = 29 - CATEGORY_CONFLICT InstructionCategory = 30 - CATEGORY_CONVERT InstructionCategory = 31 - CATEGORY_DATAXFER InstructionCategory = 32 - CATEGORY_DECIMAL InstructionCategory = 33 - CATEGORY_ENQCMD InstructionCategory = 34 - CATEGORY_EXPAND InstructionCategory = 35 - CATEGORY_FCMOV InstructionCategory = 36 - CATEGORY_FLAGOP InstructionCategory = 37 - CATEGORY_FMA4 InstructionCategory = 38 - CATEGORY_FP16 InstructionCategory = 39 - CATEGORY_GATHER InstructionCategory = 40 - CATEGORY_GFNI InstructionCategory = 41 - CATEGORY_HRESET InstructionCategory = 42 - CATEGORY_IFMA InstructionCategory = 43 - CATEGORY_INTERRUPT InstructionCategory = 44 - CATEGORY_IO InstructionCategory = 45 - CATEGORY_IOSTRINGOP InstructionCategory = 46 - CATEGORY_KEYLOCKER InstructionCategory = 47 - CATEGORY_KEYLOCKER_WIDE InstructionCategory = 48 - CATEGORY_KMASK InstructionCategory = 49 - CATEGORY_KNC InstructionCategory = 50 - CATEGORY_KNCMASK InstructionCategory = 51 - CATEGORY_KNCSCALAR InstructionCategory = 52 - CATEGORY_LEGACY InstructionCategory = 53 - CATEGORY_LOGICAL InstructionCategory = 54 - CATEGORY_LOGICAL_FP InstructionCategory = 55 - CATEGORY_LZCNT InstructionCategory = 56 - CATEGORY_MISC InstructionCategory = 57 - CATEGORY_MMX InstructionCategory = 58 - CATEGORY_MOVDIR InstructionCategory = 59 - CATEGORY_MPX InstructionCategory = 60 - CATEGORY_MSRLIST InstructionCategory = 61 - CATEGORY_NOP InstructionCategory = 62 - CATEGORY_PADLOCK InstructionCategory = 63 - CATEGORY_PBNDKB InstructionCategory = 64 - CATEGORY_PCLMULQDQ InstructionCategory = 65 - CATEGORY_PCOMMIT InstructionCategory = 66 - CATEGORY_PCONFIG InstructionCategory = 67 - CATEGORY_PKU InstructionCategory = 68 - CATEGORY_POP InstructionCategory = 69 - CATEGORY_PREFETCH InstructionCategory = 70 - CATEGORY_PREFETCHWT1 InstructionCategory = 71 - CATEGORY_PT InstructionCategory = 72 - CATEGORY_PUSH InstructionCategory = 73 - CATEGORY_RDPID InstructionCategory = 74 - CATEGORY_RDPRU InstructionCategory = 75 - CATEGORY_RDRAND InstructionCategory = 76 - CATEGORY_RDSEED InstructionCategory = 77 - CATEGORY_RDWRFSGS InstructionCategory = 78 - CATEGORY_RET InstructionCategory = 79 - CATEGORY_ROTATE InstructionCategory = 80 - CATEGORY_SCATTER InstructionCategory = 81 - CATEGORY_SEGOP InstructionCategory = 82 - CATEGORY_SEMAPHORE InstructionCategory = 83 - CATEGORY_SERIALIZE InstructionCategory = 84 - CATEGORY_SETCC InstructionCategory = 85 - CATEGORY_SGX InstructionCategory = 86 - CATEGORY_SHA InstructionCategory = 87 - CATEGORY_SHA512 InstructionCategory = 88 - CATEGORY_SHIFT InstructionCategory = 89 - CATEGORY_SMAP InstructionCategory = 90 - CATEGORY_SSE InstructionCategory = 91 - CATEGORY_STRINGOP InstructionCategory = 92 - CATEGORY_STTNI InstructionCategory = 93 - CATEGORY_SYSCALL InstructionCategory = 94 - CATEGORY_SYSRET InstructionCategory = 95 - CATEGORY_SYSTEM InstructionCategory = 96 - CATEGORY_TBM InstructionCategory = 97 - CATEGORY_TSX_LDTRK InstructionCategory = 98 - CATEGORY_UFMA InstructionCategory = 99 - CATEGORY_UINTR InstructionCategory = 100 - CATEGORY_UNCOND_BR InstructionCategory = 101 - CATEGORY_VAES InstructionCategory = 102 - CATEGORY_VBMI2 InstructionCategory = 103 - CATEGORY_VEX InstructionCategory = 104 - CATEGORY_VFMA InstructionCategory = 105 - CATEGORY_VPCLMULQDQ InstructionCategory = 106 - CATEGORY_VTX InstructionCategory = 107 - CATEGORY_WAITPKG InstructionCategory = 108 - CATEGORY_WIDENOP InstructionCategory = 109 - CATEGORY_WRMSRNS InstructionCategory = 110 - CATEGORY_X87_ALU InstructionCategory = 111 - CATEGORY_XOP InstructionCategory = 112 - CATEGORY_XSAVE InstructionCategory = 113 - CATEGORY_XSAVEOPT InstructionCategory = 114 - // Maximum value of this enum. - CATEGORY_MAX_VALUE InstructionCategory = 114 - // The minimum number of bits required to represent all values of this enum. - CATEGORY_REQUIRED_BITS InstructionCategory = 7 -) - -// Defines the `ZydisISASet` enum. -type ISASet int32 - -const ( - ISA_SET_INVALID ISASet = 0 - ISA_SET_ADOX_ADCX ISASet = 1 - ISA_SET_AES ISASet = 2 - ISA_SET_AMD ISASet = 3 - ISA_SET_AMD3DNOW ISASet = 4 - ISA_SET_AMD_INVLPGB ISASet = 5 - ISA_SET_AMX_BF16 ISASet = 6 - ISA_SET_AMX_FP16 ISASet = 7 - ISA_SET_AMX_INT8 ISASet = 8 - ISA_SET_AMX_TILE ISASet = 9 - ISA_SET_AVX ISASet = 10 - ISA_SET_AVX2 ISASet = 11 - ISA_SET_AVX2GATHER ISASet = 12 - ISA_SET_AVX512BW_128 ISASet = 13 - ISA_SET_AVX512BW_128N ISASet = 14 - ISA_SET_AVX512BW_256 ISASet = 15 - ISA_SET_AVX512BW_512 ISASet = 16 - ISA_SET_AVX512BW_KOP ISASet = 17 - ISA_SET_AVX512CD_128 ISASet = 18 - ISA_SET_AVX512CD_256 ISASet = 19 - ISA_SET_AVX512CD_512 ISASet = 20 - ISA_SET_AVX512DQ_128 ISASet = 21 - ISA_SET_AVX512DQ_128N ISASet = 22 - ISA_SET_AVX512DQ_256 ISASet = 23 - ISA_SET_AVX512DQ_512 ISASet = 24 - ISA_SET_AVX512DQ_KOP ISASet = 25 - ISA_SET_AVX512DQ_SCALAR ISASet = 26 - ISA_SET_AVX512ER_512 ISASet = 27 - ISA_SET_AVX512ER_SCALAR ISASet = 28 - ISA_SET_AVX512F_128 ISASet = 29 - ISA_SET_AVX512F_128N ISASet = 30 - ISA_SET_AVX512F_256 ISASet = 31 - ISA_SET_AVX512F_512 ISASet = 32 - ISA_SET_AVX512F_KOP ISASet = 33 - ISA_SET_AVX512F_SCALAR ISASet = 34 - ISA_SET_AVX512PF_512 ISASet = 35 - ISA_SET_AVX512_4FMAPS_512 ISASet = 36 - ISA_SET_AVX512_4FMAPS_SCALAR ISASet = 37 - ISA_SET_AVX512_4VNNIW_512 ISASet = 38 - ISA_SET_AVX512_BF16_128 ISASet = 39 - ISA_SET_AVX512_BF16_256 ISASet = 40 - ISA_SET_AVX512_BF16_512 ISASet = 41 - ISA_SET_AVX512_BITALG_128 ISASet = 42 - ISA_SET_AVX512_BITALG_256 ISASet = 43 - ISA_SET_AVX512_BITALG_512 ISASet = 44 - ISA_SET_AVX512_FP16_128 ISASet = 45 - ISA_SET_AVX512_FP16_128N ISASet = 46 - ISA_SET_AVX512_FP16_256 ISASet = 47 - ISA_SET_AVX512_FP16_512 ISASet = 48 - ISA_SET_AVX512_FP16_SCALAR ISASet = 49 - ISA_SET_AVX512_GFNI_128 ISASet = 50 - ISA_SET_AVX512_GFNI_256 ISASet = 51 - ISA_SET_AVX512_GFNI_512 ISASet = 52 - ISA_SET_AVX512_IFMA_128 ISASet = 53 - ISA_SET_AVX512_IFMA_256 ISASet = 54 - ISA_SET_AVX512_IFMA_512 ISASet = 55 - ISA_SET_AVX512_VAES_128 ISASet = 56 - ISA_SET_AVX512_VAES_256 ISASet = 57 - ISA_SET_AVX512_VAES_512 ISASet = 58 - ISA_SET_AVX512_VBMI2_128 ISASet = 59 - ISA_SET_AVX512_VBMI2_256 ISASet = 60 - ISA_SET_AVX512_VBMI2_512 ISASet = 61 - ISA_SET_AVX512_VBMI_128 ISASet = 62 - ISA_SET_AVX512_VBMI_256 ISASet = 63 - ISA_SET_AVX512_VBMI_512 ISASet = 64 - ISA_SET_AVX512_VNNI_128 ISASet = 65 - ISA_SET_AVX512_VNNI_256 ISASet = 66 - ISA_SET_AVX512_VNNI_512 ISASet = 67 - ISA_SET_AVX512_VP2INTERSECT_128 ISASet = 68 - ISA_SET_AVX512_VP2INTERSECT_256 ISASet = 69 - ISA_SET_AVX512_VP2INTERSECT_512 ISASet = 70 - ISA_SET_AVX512_VPCLMULQDQ_128 ISASet = 71 - ISA_SET_AVX512_VPCLMULQDQ_256 ISASet = 72 - ISA_SET_AVX512_VPCLMULQDQ_512 ISASet = 73 - ISA_SET_AVX512_VPOPCNTDQ_128 ISASet = 74 - ISA_SET_AVX512_VPOPCNTDQ_256 ISASet = 75 - ISA_SET_AVX512_VPOPCNTDQ_512 ISASet = 76 - ISA_SET_AVXAES ISASet = 77 - ISA_SET_AVX_GFNI ISASet = 78 - ISA_SET_AVX_IFMA ISASet = 79 - ISA_SET_AVX_NE_CONVERT ISASet = 80 - ISA_SET_AVX_VNNI ISASet = 81 - ISA_SET_AVX_VNNI_INT16 ISASet = 82 - ISA_SET_AVX_VNNI_INT8 ISASet = 83 - ISA_SET_BMI1 ISASet = 84 - ISA_SET_BMI2 ISASet = 85 - ISA_SET_CET ISASet = 86 - ISA_SET_CLDEMOTE ISASet = 87 - ISA_SET_CLFLUSHOPT ISASet = 88 - ISA_SET_CLFSH ISASet = 89 - ISA_SET_CLWB ISASet = 90 - ISA_SET_CLZERO ISASet = 91 - ISA_SET_CMOV ISASet = 92 - ISA_SET_CMPXCHG16B ISASet = 93 - ISA_SET_ENQCMD ISASet = 94 - ISA_SET_F16C ISASet = 95 - ISA_SET_FAT_NOP ISASet = 96 - ISA_SET_FCMOV ISASet = 97 - ISA_SET_FCOMI ISASet = 98 - ISA_SET_FMA ISASet = 99 - ISA_SET_FMA4 ISASet = 100 - ISA_SET_FXSAVE ISASet = 101 - ISA_SET_FXSAVE64 ISASet = 102 - ISA_SET_GFNI ISASet = 103 - ISA_SET_HRESET ISASet = 104 - ISA_SET_I186 ISASet = 105 - ISA_SET_I286PROTECTED ISASet = 106 - ISA_SET_I286REAL ISASet = 107 - ISA_SET_I386 ISASet = 108 - ISA_SET_I486 ISASet = 109 - ISA_SET_I486REAL ISASet = 110 - ISA_SET_I86 ISASet = 111 - ISA_SET_ICACHE_PREFETCH ISASet = 112 - ISA_SET_INVPCID ISASet = 113 - ISA_SET_KEYLOCKER ISASet = 114 - ISA_SET_KEYLOCKER_WIDE ISASet = 115 - ISA_SET_KNCE ISASet = 116 - ISA_SET_KNCJKBR ISASet = 117 - ISA_SET_KNCSTREAM ISASet = 118 - ISA_SET_KNCV ISASet = 119 - ISA_SET_KNC_MISC ISASet = 120 - ISA_SET_KNC_PF_HINT ISASet = 121 - ISA_SET_LAHF ISASet = 122 - ISA_SET_LONGMODE ISASet = 123 - ISA_SET_LWP ISASet = 124 - ISA_SET_LZCNT ISASet = 125 - ISA_SET_MCOMMIT ISASet = 126 - ISA_SET_MONITOR ISASet = 127 - ISA_SET_MONITORX ISASet = 128 - ISA_SET_MOVBE ISASet = 129 - ISA_SET_MOVDIR ISASet = 130 - ISA_SET_MPX ISASet = 131 - ISA_SET_MSRLIST ISASet = 132 - ISA_SET_PADLOCK_ACE ISASet = 133 - ISA_SET_PADLOCK_PHE ISASet = 134 - ISA_SET_PADLOCK_PMM ISASet = 135 - ISA_SET_PADLOCK_RNG ISASet = 136 - ISA_SET_PAUSE ISASet = 137 - ISA_SET_PBNDKB ISASet = 138 - ISA_SET_PCLMULQDQ ISASet = 139 - ISA_SET_PCOMMIT ISASet = 140 - ISA_SET_PCONFIG ISASet = 141 - ISA_SET_PENTIUMMMX ISASet = 142 - ISA_SET_PENTIUMREAL ISASet = 143 - ISA_SET_PKU ISASet = 144 - ISA_SET_POPCNT ISASet = 145 - ISA_SET_PPRO ISASet = 146 - ISA_SET_PREFETCHWT1 ISASet = 147 - ISA_SET_PREFETCH_NOP ISASet = 148 - ISA_SET_PT ISASet = 149 - ISA_SET_RAO_INT ISASet = 150 - ISA_SET_RDPID ISASet = 151 - ISA_SET_RDPMC ISASet = 152 - ISA_SET_RDPRU ISASet = 153 - ISA_SET_RDRAND ISASet = 154 - ISA_SET_RDSEED ISASet = 155 - ISA_SET_RDTSCP ISASet = 156 - ISA_SET_RDWRFSGS ISASet = 157 - ISA_SET_RTM ISASet = 158 - ISA_SET_SERIALIZE ISASet = 159 - ISA_SET_SGX ISASet = 160 - ISA_SET_SGX_ENCLV ISASet = 161 - ISA_SET_SHA ISASet = 162 - ISA_SET_SHA512 ISASet = 163 - ISA_SET_SM3 ISASet = 164 - ISA_SET_SM4 ISASet = 165 - ISA_SET_SMAP ISASet = 166 - ISA_SET_SMX ISASet = 167 - ISA_SET_SNP ISASet = 168 - ISA_SET_SSE ISASet = 169 - ISA_SET_SSE2 ISASet = 170 - ISA_SET_SSE2MMX ISASet = 171 - ISA_SET_SSE3 ISASet = 172 - ISA_SET_SSE3X87 ISASet = 173 - ISA_SET_SSE4 ISASet = 174 - ISA_SET_SSE42 ISASet = 175 - ISA_SET_SSE4A ISASet = 176 - ISA_SET_SSEMXCSR ISASet = 177 - ISA_SET_SSE_PREFETCH ISASet = 178 - ISA_SET_SSSE3 ISASet = 179 - ISA_SET_SSSE3MMX ISASet = 180 - ISA_SET_SVM ISASet = 181 - ISA_SET_TBM ISASet = 182 - ISA_SET_TDX ISASet = 183 - ISA_SET_TSX_LDTRK ISASet = 184 - ISA_SET_UINTR ISASet = 185 - ISA_SET_VAES ISASet = 186 - ISA_SET_VMFUNC ISASet = 187 - ISA_SET_VPCLMULQDQ ISASet = 188 - ISA_SET_VTX ISASet = 189 - ISA_SET_WAITPKG ISASet = 190 - ISA_SET_WRMSRNS ISASet = 191 - ISA_SET_X87 ISASet = 192 - ISA_SET_XOP ISASet = 193 - ISA_SET_XSAVE ISASet = 194 - ISA_SET_XSAVEC ISASet = 195 - ISA_SET_XSAVEOPT ISASet = 196 - ISA_SET_XSAVES ISASet = 197 - // Maximum value of this enum. - ISA_SET_MAX_VALUE ISASet = 197 - // The minimum number of bits required to represent all values of this enum. - ISA_SET_REQUIRED_BITS ISASet = 8 -) - -// Defines the `ZydisISAExt` enum. -type ISAExt int32 - -const ( - ISA_EXT_INVALID ISAExt = 0 - ISA_EXT_ADOX_ADCX ISAExt = 1 - ISA_EXT_AES ISAExt = 2 - ISA_EXT_AMD3DNOW ISAExt = 3 - ISA_EXT_AMD3DNOW_PREFETCH ISAExt = 4 - ISA_EXT_AMD_INVLPGB ISAExt = 5 - ISA_EXT_AMX_BF16 ISAExt = 6 - ISA_EXT_AMX_FP16 ISAExt = 7 - ISA_EXT_AMX_INT8 ISAExt = 8 - ISA_EXT_AMX_TILE ISAExt = 9 - ISA_EXT_AVX ISAExt = 10 - ISA_EXT_AVX2 ISAExt = 11 - ISA_EXT_AVX2GATHER ISAExt = 12 - ISA_EXT_AVX512EVEX ISAExt = 13 - ISA_EXT_AVX512VEX ISAExt = 14 - ISA_EXT_AVXAES ISAExt = 15 - ISA_EXT_AVX_IFMA ISAExt = 16 - ISA_EXT_AVX_NE_CONVERT ISAExt = 17 - ISA_EXT_AVX_VNNI ISAExt = 18 - ISA_EXT_AVX_VNNI_INT16 ISAExt = 19 - ISA_EXT_AVX_VNNI_INT8 ISAExt = 20 - ISA_EXT_BASE ISAExt = 21 - ISA_EXT_BMI1 ISAExt = 22 - ISA_EXT_BMI2 ISAExt = 23 - ISA_EXT_CET ISAExt = 24 - ISA_EXT_CLDEMOTE ISAExt = 25 - ISA_EXT_CLFLUSHOPT ISAExt = 26 - ISA_EXT_CLFSH ISAExt = 27 - ISA_EXT_CLWB ISAExt = 28 - ISA_EXT_CLZERO ISAExt = 29 - ISA_EXT_ENQCMD ISAExt = 30 - ISA_EXT_F16C ISAExt = 31 - ISA_EXT_FMA ISAExt = 32 - ISA_EXT_FMA4 ISAExt = 33 - ISA_EXT_GFNI ISAExt = 34 - ISA_EXT_HRESET ISAExt = 35 - ISA_EXT_ICACHE_PREFETCH ISAExt = 36 - ISA_EXT_INVPCID ISAExt = 37 - ISA_EXT_KEYLOCKER ISAExt = 38 - ISA_EXT_KEYLOCKER_WIDE ISAExt = 39 - ISA_EXT_KNC ISAExt = 40 - ISA_EXT_KNCE ISAExt = 41 - ISA_EXT_KNCV ISAExt = 42 - ISA_EXT_LONGMODE ISAExt = 43 - ISA_EXT_LZCNT ISAExt = 44 - ISA_EXT_MCOMMIT ISAExt = 45 - ISA_EXT_MMX ISAExt = 46 - ISA_EXT_MONITOR ISAExt = 47 - ISA_EXT_MONITORX ISAExt = 48 - ISA_EXT_MOVBE ISAExt = 49 - ISA_EXT_MOVDIR ISAExt = 50 - ISA_EXT_MPX ISAExt = 51 - ISA_EXT_MSRLIST ISAExt = 52 - ISA_EXT_PADLOCK ISAExt = 53 - ISA_EXT_PAUSE ISAExt = 54 - ISA_EXT_PBNDKB ISAExt = 55 - ISA_EXT_PCLMULQDQ ISAExt = 56 - ISA_EXT_PCOMMIT ISAExt = 57 - ISA_EXT_PCONFIG ISAExt = 58 - ISA_EXT_PKU ISAExt = 59 - ISA_EXT_PREFETCHWT1 ISAExt = 60 - ISA_EXT_PT ISAExt = 61 - ISA_EXT_RAO_INT ISAExt = 62 - ISA_EXT_RDPID ISAExt = 63 - ISA_EXT_RDPRU ISAExt = 64 - ISA_EXT_RDRAND ISAExt = 65 - ISA_EXT_RDSEED ISAExt = 66 - ISA_EXT_RDTSCP ISAExt = 67 - ISA_EXT_RDWRFSGS ISAExt = 68 - ISA_EXT_RTM ISAExt = 69 - ISA_EXT_SERIALIZE ISAExt = 70 - ISA_EXT_SGX ISAExt = 71 - ISA_EXT_SGX_ENCLV ISAExt = 72 - ISA_EXT_SHA ISAExt = 73 - ISA_EXT_SHA512 ISAExt = 74 - ISA_EXT_SM3 ISAExt = 75 - ISA_EXT_SM4 ISAExt = 76 - ISA_EXT_SMAP ISAExt = 77 - ISA_EXT_SMX ISAExt = 78 - ISA_EXT_SNP ISAExt = 79 - ISA_EXT_SSE ISAExt = 80 - ISA_EXT_SSE2 ISAExt = 81 - ISA_EXT_SSE3 ISAExt = 82 - ISA_EXT_SSE4 ISAExt = 83 - ISA_EXT_SSE4A ISAExt = 84 - ISA_EXT_SSSE3 ISAExt = 85 - ISA_EXT_SVM ISAExt = 86 - ISA_EXT_TBM ISAExt = 87 - ISA_EXT_TDX ISAExt = 88 - ISA_EXT_TSX_LDTRK ISAExt = 89 - ISA_EXT_UINTR ISAExt = 90 - ISA_EXT_VAES ISAExt = 91 - ISA_EXT_VMFUNC ISAExt = 92 - ISA_EXT_VPCLMULQDQ ISAExt = 93 - ISA_EXT_VTX ISAExt = 94 - ISA_EXT_WAITPKG ISAExt = 95 - ISA_EXT_WRMSRNS ISAExt = 96 - ISA_EXT_X87 ISAExt = 97 - ISA_EXT_XOP ISAExt = 98 - ISA_EXT_XSAVE ISAExt = 99 - ISA_EXT_XSAVEC ISAExt = 100 - ISA_EXT_XSAVEOPT ISAExt = 101 - ISA_EXT_XSAVES ISAExt = 102 - // Maximum value of this enum. - ISA_EXT_MAX_VALUE ISAExt = 102 - // The minimum number of bits required to represent all values of this enum. - ISA_EXT_REQUIRED_BITS ISAExt = 7 -) - -// Defines the `ZydisMnemonic` enum. -type Mnemonic int32 - -const ( - MNEMONIC_INVALID Mnemonic = 0 - MNEMONIC_AAA Mnemonic = 1 - MNEMONIC_AAD Mnemonic = 2 - MNEMONIC_AADD Mnemonic = 3 - MNEMONIC_AAM Mnemonic = 4 - MNEMONIC_AAND Mnemonic = 5 - MNEMONIC_AAS Mnemonic = 6 - MNEMONIC_ADC Mnemonic = 7 - MNEMONIC_ADCX Mnemonic = 8 - MNEMONIC_ADD Mnemonic = 9 - MNEMONIC_ADDPD Mnemonic = 10 - MNEMONIC_ADDPS Mnemonic = 11 - MNEMONIC_ADDSD Mnemonic = 12 - MNEMONIC_ADDSS Mnemonic = 13 - MNEMONIC_ADDSUBPD Mnemonic = 14 - MNEMONIC_ADDSUBPS Mnemonic = 15 - MNEMONIC_ADOX Mnemonic = 16 - MNEMONIC_AESDEC Mnemonic = 17 - MNEMONIC_AESDEC128KL Mnemonic = 18 - MNEMONIC_AESDEC256KL Mnemonic = 19 - MNEMONIC_AESDECLAST Mnemonic = 20 - MNEMONIC_AESDECWIDE128KL Mnemonic = 21 - MNEMONIC_AESDECWIDE256KL Mnemonic = 22 - MNEMONIC_AESENC Mnemonic = 23 - MNEMONIC_AESENC128KL Mnemonic = 24 - MNEMONIC_AESENC256KL Mnemonic = 25 - MNEMONIC_AESENCLAST Mnemonic = 26 - MNEMONIC_AESENCWIDE128KL Mnemonic = 27 - MNEMONIC_AESENCWIDE256KL Mnemonic = 28 - MNEMONIC_AESIMC Mnemonic = 29 - MNEMONIC_AESKEYGENASSIST Mnemonic = 30 - MNEMONIC_AND Mnemonic = 31 - MNEMONIC_ANDN Mnemonic = 32 - MNEMONIC_ANDNPD Mnemonic = 33 - MNEMONIC_ANDNPS Mnemonic = 34 - MNEMONIC_ANDPD Mnemonic = 35 - MNEMONIC_ANDPS Mnemonic = 36 - MNEMONIC_AOR Mnemonic = 37 - MNEMONIC_ARPL Mnemonic = 38 - MNEMONIC_AXOR Mnemonic = 39 - MNEMONIC_BEXTR Mnemonic = 40 - MNEMONIC_BLCFILL Mnemonic = 41 - MNEMONIC_BLCI Mnemonic = 42 - MNEMONIC_BLCIC Mnemonic = 43 - MNEMONIC_BLCMSK Mnemonic = 44 - MNEMONIC_BLCS Mnemonic = 45 - MNEMONIC_BLENDPD Mnemonic = 46 - MNEMONIC_BLENDPS Mnemonic = 47 - MNEMONIC_BLENDVPD Mnemonic = 48 - MNEMONIC_BLENDVPS Mnemonic = 49 - MNEMONIC_BLSFILL Mnemonic = 50 - MNEMONIC_BLSI Mnemonic = 51 - MNEMONIC_BLSIC Mnemonic = 52 - MNEMONIC_BLSMSK Mnemonic = 53 - MNEMONIC_BLSR Mnemonic = 54 - MNEMONIC_BNDCL Mnemonic = 55 - MNEMONIC_BNDCN Mnemonic = 56 - MNEMONIC_BNDCU Mnemonic = 57 - MNEMONIC_BNDLDX Mnemonic = 58 - MNEMONIC_BNDMK Mnemonic = 59 - MNEMONIC_BNDMOV Mnemonic = 60 - MNEMONIC_BNDSTX Mnemonic = 61 - MNEMONIC_BOUND Mnemonic = 62 - MNEMONIC_BSF Mnemonic = 63 - MNEMONIC_BSR Mnemonic = 64 - MNEMONIC_BSWAP Mnemonic = 65 - MNEMONIC_BT Mnemonic = 66 - MNEMONIC_BTC Mnemonic = 67 - MNEMONIC_BTR Mnemonic = 68 - MNEMONIC_BTS Mnemonic = 69 - MNEMONIC_BZHI Mnemonic = 70 - MNEMONIC_CALL Mnemonic = 71 - MNEMONIC_CBW Mnemonic = 72 - MNEMONIC_CDQ Mnemonic = 73 - MNEMONIC_CDQE Mnemonic = 74 - MNEMONIC_CLAC Mnemonic = 75 - MNEMONIC_CLC Mnemonic = 76 - MNEMONIC_CLD Mnemonic = 77 - MNEMONIC_CLDEMOTE Mnemonic = 78 - MNEMONIC_CLEVICT0 Mnemonic = 79 - MNEMONIC_CLEVICT1 Mnemonic = 80 - MNEMONIC_CLFLUSH Mnemonic = 81 - MNEMONIC_CLFLUSHOPT Mnemonic = 82 - MNEMONIC_CLGI Mnemonic = 83 - MNEMONIC_CLI Mnemonic = 84 - MNEMONIC_CLRSSBSY Mnemonic = 85 - MNEMONIC_CLTS Mnemonic = 86 - MNEMONIC_CLUI Mnemonic = 87 - MNEMONIC_CLWB Mnemonic = 88 - MNEMONIC_CLZERO Mnemonic = 89 - MNEMONIC_CMC Mnemonic = 90 - MNEMONIC_CMOVB Mnemonic = 91 - MNEMONIC_CMOVBE Mnemonic = 92 - MNEMONIC_CMOVL Mnemonic = 93 - MNEMONIC_CMOVLE Mnemonic = 94 - MNEMONIC_CMOVNB Mnemonic = 95 - MNEMONIC_CMOVNBE Mnemonic = 96 - MNEMONIC_CMOVNL Mnemonic = 97 - MNEMONIC_CMOVNLE Mnemonic = 98 - MNEMONIC_CMOVNO Mnemonic = 99 - MNEMONIC_CMOVNP Mnemonic = 100 - MNEMONIC_CMOVNS Mnemonic = 101 - MNEMONIC_CMOVNZ Mnemonic = 102 - MNEMONIC_CMOVO Mnemonic = 103 - MNEMONIC_CMOVP Mnemonic = 104 - MNEMONIC_CMOVS Mnemonic = 105 - MNEMONIC_CMOVZ Mnemonic = 106 - MNEMONIC_CMP Mnemonic = 107 - MNEMONIC_CMPPD Mnemonic = 108 - MNEMONIC_CMPPS Mnemonic = 109 - MNEMONIC_CMPSB Mnemonic = 110 - MNEMONIC_CMPSD Mnemonic = 111 - MNEMONIC_CMPSQ Mnemonic = 112 - MNEMONIC_CMPSS Mnemonic = 113 - MNEMONIC_CMPSW Mnemonic = 114 - MNEMONIC_CMPXCHG Mnemonic = 115 - MNEMONIC_CMPXCHG16B Mnemonic = 116 - MNEMONIC_CMPXCHG8B Mnemonic = 117 - MNEMONIC_COMISD Mnemonic = 118 - MNEMONIC_COMISS Mnemonic = 119 - MNEMONIC_CPUID Mnemonic = 120 - MNEMONIC_CQO Mnemonic = 121 - MNEMONIC_CRC32 Mnemonic = 122 - MNEMONIC_CVTDQ2PD Mnemonic = 123 - MNEMONIC_CVTDQ2PS Mnemonic = 124 - MNEMONIC_CVTPD2DQ Mnemonic = 125 - MNEMONIC_CVTPD2PI Mnemonic = 126 - MNEMONIC_CVTPD2PS Mnemonic = 127 - MNEMONIC_CVTPI2PD Mnemonic = 128 - MNEMONIC_CVTPI2PS Mnemonic = 129 - MNEMONIC_CVTPS2DQ Mnemonic = 130 - MNEMONIC_CVTPS2PD Mnemonic = 131 - MNEMONIC_CVTPS2PI Mnemonic = 132 - MNEMONIC_CVTSD2SI Mnemonic = 133 - MNEMONIC_CVTSD2SS Mnemonic = 134 - MNEMONIC_CVTSI2SD Mnemonic = 135 - MNEMONIC_CVTSI2SS Mnemonic = 136 - MNEMONIC_CVTSS2SD Mnemonic = 137 - MNEMONIC_CVTSS2SI Mnemonic = 138 - MNEMONIC_CVTTPD2DQ Mnemonic = 139 - MNEMONIC_CVTTPD2PI Mnemonic = 140 - MNEMONIC_CVTTPS2DQ Mnemonic = 141 - MNEMONIC_CVTTPS2PI Mnemonic = 142 - MNEMONIC_CVTTSD2SI Mnemonic = 143 - MNEMONIC_CVTTSS2SI Mnemonic = 144 - MNEMONIC_CWD Mnemonic = 145 - MNEMONIC_CWDE Mnemonic = 146 - MNEMONIC_DAA Mnemonic = 147 - MNEMONIC_DAS Mnemonic = 148 - MNEMONIC_DEC Mnemonic = 149 - MNEMONIC_DELAY Mnemonic = 150 - MNEMONIC_DIV Mnemonic = 151 - MNEMONIC_DIVPD Mnemonic = 152 - MNEMONIC_DIVPS Mnemonic = 153 - MNEMONIC_DIVSD Mnemonic = 154 - MNEMONIC_DIVSS Mnemonic = 155 - MNEMONIC_DPPD Mnemonic = 156 - MNEMONIC_DPPS Mnemonic = 157 - MNEMONIC_EMMS Mnemonic = 158 - MNEMONIC_ENCLS Mnemonic = 159 - MNEMONIC_ENCLU Mnemonic = 160 - MNEMONIC_ENCLV Mnemonic = 161 - MNEMONIC_ENCODEKEY128 Mnemonic = 162 - MNEMONIC_ENCODEKEY256 Mnemonic = 163 - MNEMONIC_ENDBR32 Mnemonic = 164 - MNEMONIC_ENDBR64 Mnemonic = 165 - MNEMONIC_ENQCMD Mnemonic = 166 - MNEMONIC_ENQCMDS Mnemonic = 167 - MNEMONIC_ENTER Mnemonic = 168 - MNEMONIC_EXTRACTPS Mnemonic = 169 - MNEMONIC_EXTRQ Mnemonic = 170 - MNEMONIC_F2XM1 Mnemonic = 171 - MNEMONIC_FABS Mnemonic = 172 - MNEMONIC_FADD Mnemonic = 173 - MNEMONIC_FADDP Mnemonic = 174 - MNEMONIC_FBLD Mnemonic = 175 - MNEMONIC_FBSTP Mnemonic = 176 - MNEMONIC_FCHS Mnemonic = 177 - MNEMONIC_FCMOVB Mnemonic = 178 - MNEMONIC_FCMOVBE Mnemonic = 179 - MNEMONIC_FCMOVE Mnemonic = 180 - MNEMONIC_FCMOVNB Mnemonic = 181 - MNEMONIC_FCMOVNBE Mnemonic = 182 - MNEMONIC_FCMOVNE Mnemonic = 183 - MNEMONIC_FCMOVNU Mnemonic = 184 - MNEMONIC_FCMOVU Mnemonic = 185 - MNEMONIC_FCOM Mnemonic = 186 - MNEMONIC_FCOMI Mnemonic = 187 - MNEMONIC_FCOMIP Mnemonic = 188 - MNEMONIC_FCOMP Mnemonic = 189 - MNEMONIC_FCOMPP Mnemonic = 190 - MNEMONIC_FCOS Mnemonic = 191 - MNEMONIC_FDECSTP Mnemonic = 192 - MNEMONIC_FDISI8087_NOP Mnemonic = 193 - MNEMONIC_FDIV Mnemonic = 194 - MNEMONIC_FDIVP Mnemonic = 195 - MNEMONIC_FDIVR Mnemonic = 196 - MNEMONIC_FDIVRP Mnemonic = 197 - MNEMONIC_FEMMS Mnemonic = 198 - MNEMONIC_FENI8087_NOP Mnemonic = 199 - MNEMONIC_FFREE Mnemonic = 200 - MNEMONIC_FFREEP Mnemonic = 201 - MNEMONIC_FIADD Mnemonic = 202 - MNEMONIC_FICOM Mnemonic = 203 - MNEMONIC_FICOMP Mnemonic = 204 - MNEMONIC_FIDIV Mnemonic = 205 - MNEMONIC_FIDIVR Mnemonic = 206 - MNEMONIC_FILD Mnemonic = 207 - MNEMONIC_FIMUL Mnemonic = 208 - MNEMONIC_FINCSTP Mnemonic = 209 - MNEMONIC_FIST Mnemonic = 210 - MNEMONIC_FISTP Mnemonic = 211 - MNEMONIC_FISTTP Mnemonic = 212 - MNEMONIC_FISUB Mnemonic = 213 - MNEMONIC_FISUBR Mnemonic = 214 - MNEMONIC_FLD Mnemonic = 215 - MNEMONIC_FLD1 Mnemonic = 216 - MNEMONIC_FLDCW Mnemonic = 217 - MNEMONIC_FLDENV Mnemonic = 218 - MNEMONIC_FLDL2E Mnemonic = 219 - MNEMONIC_FLDL2T Mnemonic = 220 - MNEMONIC_FLDLG2 Mnemonic = 221 - MNEMONIC_FLDLN2 Mnemonic = 222 - MNEMONIC_FLDPI Mnemonic = 223 - MNEMONIC_FLDZ Mnemonic = 224 - MNEMONIC_FMUL Mnemonic = 225 - MNEMONIC_FMULP Mnemonic = 226 - MNEMONIC_FNCLEX Mnemonic = 227 - MNEMONIC_FNINIT Mnemonic = 228 - MNEMONIC_FNOP Mnemonic = 229 - MNEMONIC_FNSAVE Mnemonic = 230 - MNEMONIC_FNSTCW Mnemonic = 231 - MNEMONIC_FNSTENV Mnemonic = 232 - MNEMONIC_FNSTSW Mnemonic = 233 - MNEMONIC_FPATAN Mnemonic = 234 - MNEMONIC_FPREM Mnemonic = 235 - MNEMONIC_FPREM1 Mnemonic = 236 - MNEMONIC_FPTAN Mnemonic = 237 - MNEMONIC_FRNDINT Mnemonic = 238 - MNEMONIC_FRSTOR Mnemonic = 239 - MNEMONIC_FSCALE Mnemonic = 240 - MNEMONIC_FSETPM287_NOP Mnemonic = 241 - MNEMONIC_FSIN Mnemonic = 242 - MNEMONIC_FSINCOS Mnemonic = 243 - MNEMONIC_FSQRT Mnemonic = 244 - MNEMONIC_FST Mnemonic = 245 - MNEMONIC_FSTP Mnemonic = 246 - MNEMONIC_FSTPNCE Mnemonic = 247 - MNEMONIC_FSUB Mnemonic = 248 - MNEMONIC_FSUBP Mnemonic = 249 - MNEMONIC_FSUBR Mnemonic = 250 - MNEMONIC_FSUBRP Mnemonic = 251 - MNEMONIC_FTST Mnemonic = 252 - MNEMONIC_FUCOM Mnemonic = 253 - MNEMONIC_FUCOMI Mnemonic = 254 - MNEMONIC_FUCOMIP Mnemonic = 255 - MNEMONIC_FUCOMP Mnemonic = 256 - MNEMONIC_FUCOMPP Mnemonic = 257 - MNEMONIC_FWAIT Mnemonic = 258 - MNEMONIC_FXAM Mnemonic = 259 - MNEMONIC_FXCH Mnemonic = 260 - MNEMONIC_FXRSTOR Mnemonic = 261 - MNEMONIC_FXRSTOR64 Mnemonic = 262 - MNEMONIC_FXSAVE Mnemonic = 263 - MNEMONIC_FXSAVE64 Mnemonic = 264 - MNEMONIC_FXTRACT Mnemonic = 265 - MNEMONIC_FYL2X Mnemonic = 266 - MNEMONIC_FYL2XP1 Mnemonic = 267 - MNEMONIC_GETSEC Mnemonic = 268 - MNEMONIC_GF2P8AFFINEINVQB Mnemonic = 269 - MNEMONIC_GF2P8AFFINEQB Mnemonic = 270 - MNEMONIC_GF2P8MULB Mnemonic = 271 - MNEMONIC_HADDPD Mnemonic = 272 - MNEMONIC_HADDPS Mnemonic = 273 - MNEMONIC_HLT Mnemonic = 274 - MNEMONIC_HRESET Mnemonic = 275 - MNEMONIC_HSUBPD Mnemonic = 276 - MNEMONIC_HSUBPS Mnemonic = 277 - MNEMONIC_IDIV Mnemonic = 278 - MNEMONIC_IMUL Mnemonic = 279 - MNEMONIC_IN Mnemonic = 280 - MNEMONIC_INC Mnemonic = 281 - MNEMONIC_INCSSPD Mnemonic = 282 - MNEMONIC_INCSSPQ Mnemonic = 283 - MNEMONIC_INSB Mnemonic = 284 - MNEMONIC_INSD Mnemonic = 285 - MNEMONIC_INSERTPS Mnemonic = 286 - MNEMONIC_INSERTQ Mnemonic = 287 - MNEMONIC_INSW Mnemonic = 288 - MNEMONIC_INT Mnemonic = 289 - MNEMONIC_INT1 Mnemonic = 290 - MNEMONIC_INT3 Mnemonic = 291 - MNEMONIC_INTO Mnemonic = 292 - MNEMONIC_INVD Mnemonic = 293 - MNEMONIC_INVEPT Mnemonic = 294 - MNEMONIC_INVLPG Mnemonic = 295 - MNEMONIC_INVLPGA Mnemonic = 296 - MNEMONIC_INVLPGB Mnemonic = 297 - MNEMONIC_INVPCID Mnemonic = 298 - MNEMONIC_INVVPID Mnemonic = 299 - MNEMONIC_IRET Mnemonic = 300 - MNEMONIC_IRETD Mnemonic = 301 - MNEMONIC_IRETQ Mnemonic = 302 - MNEMONIC_JB Mnemonic = 303 - MNEMONIC_JBE Mnemonic = 304 - MNEMONIC_JCXZ Mnemonic = 305 - MNEMONIC_JECXZ Mnemonic = 306 - MNEMONIC_JKNZD Mnemonic = 307 - MNEMONIC_JKZD Mnemonic = 308 - MNEMONIC_JL Mnemonic = 309 - MNEMONIC_JLE Mnemonic = 310 - MNEMONIC_JMP Mnemonic = 311 - MNEMONIC_JNB Mnemonic = 312 - MNEMONIC_JNBE Mnemonic = 313 - MNEMONIC_JNL Mnemonic = 314 - MNEMONIC_JNLE Mnemonic = 315 - MNEMONIC_JNO Mnemonic = 316 - MNEMONIC_JNP Mnemonic = 317 - MNEMONIC_JNS Mnemonic = 318 - MNEMONIC_JNZ Mnemonic = 319 - MNEMONIC_JO Mnemonic = 320 - MNEMONIC_JP Mnemonic = 321 - MNEMONIC_JRCXZ Mnemonic = 322 - MNEMONIC_JS Mnemonic = 323 - MNEMONIC_JZ Mnemonic = 324 - MNEMONIC_KADDB Mnemonic = 325 - MNEMONIC_KADDD Mnemonic = 326 - MNEMONIC_KADDQ Mnemonic = 327 - MNEMONIC_KADDW Mnemonic = 328 - MNEMONIC_KAND Mnemonic = 329 - MNEMONIC_KANDB Mnemonic = 330 - MNEMONIC_KANDD Mnemonic = 331 - MNEMONIC_KANDN Mnemonic = 332 - MNEMONIC_KANDNB Mnemonic = 333 - MNEMONIC_KANDND Mnemonic = 334 - MNEMONIC_KANDNQ Mnemonic = 335 - MNEMONIC_KANDNR Mnemonic = 336 - MNEMONIC_KANDNW Mnemonic = 337 - MNEMONIC_KANDQ Mnemonic = 338 - MNEMONIC_KANDW Mnemonic = 339 - MNEMONIC_KCONCATH Mnemonic = 340 - MNEMONIC_KCONCATL Mnemonic = 341 - MNEMONIC_KEXTRACT Mnemonic = 342 - MNEMONIC_KMERGE2L1H Mnemonic = 343 - MNEMONIC_KMERGE2L1L Mnemonic = 344 - MNEMONIC_KMOV Mnemonic = 345 - MNEMONIC_KMOVB Mnemonic = 346 - MNEMONIC_KMOVD Mnemonic = 347 - MNEMONIC_KMOVQ Mnemonic = 348 - MNEMONIC_KMOVW Mnemonic = 349 - MNEMONIC_KNOT Mnemonic = 350 - MNEMONIC_KNOTB Mnemonic = 351 - MNEMONIC_KNOTD Mnemonic = 352 - MNEMONIC_KNOTQ Mnemonic = 353 - MNEMONIC_KNOTW Mnemonic = 354 - MNEMONIC_KOR Mnemonic = 355 - MNEMONIC_KORB Mnemonic = 356 - MNEMONIC_KORD Mnemonic = 357 - MNEMONIC_KORQ Mnemonic = 358 - MNEMONIC_KORTEST Mnemonic = 359 - MNEMONIC_KORTESTB Mnemonic = 360 - MNEMONIC_KORTESTD Mnemonic = 361 - MNEMONIC_KORTESTQ Mnemonic = 362 - MNEMONIC_KORTESTW Mnemonic = 363 - MNEMONIC_KORW Mnemonic = 364 - MNEMONIC_KSHIFTLB Mnemonic = 365 - MNEMONIC_KSHIFTLD Mnemonic = 366 - MNEMONIC_KSHIFTLQ Mnemonic = 367 - MNEMONIC_KSHIFTLW Mnemonic = 368 - MNEMONIC_KSHIFTRB Mnemonic = 369 - MNEMONIC_KSHIFTRD Mnemonic = 370 - MNEMONIC_KSHIFTRQ Mnemonic = 371 - MNEMONIC_KSHIFTRW Mnemonic = 372 - MNEMONIC_KTESTB Mnemonic = 373 - MNEMONIC_KTESTD Mnemonic = 374 - MNEMONIC_KTESTQ Mnemonic = 375 - MNEMONIC_KTESTW Mnemonic = 376 - MNEMONIC_KUNPCKBW Mnemonic = 377 - MNEMONIC_KUNPCKDQ Mnemonic = 378 - MNEMONIC_KUNPCKWD Mnemonic = 379 - MNEMONIC_KXNOR Mnemonic = 380 - MNEMONIC_KXNORB Mnemonic = 381 - MNEMONIC_KXNORD Mnemonic = 382 - MNEMONIC_KXNORQ Mnemonic = 383 - MNEMONIC_KXNORW Mnemonic = 384 - MNEMONIC_KXOR Mnemonic = 385 - MNEMONIC_KXORB Mnemonic = 386 - MNEMONIC_KXORD Mnemonic = 387 - MNEMONIC_KXORQ Mnemonic = 388 - MNEMONIC_KXORW Mnemonic = 389 - MNEMONIC_LAHF Mnemonic = 390 - MNEMONIC_LAR Mnemonic = 391 - MNEMONIC_LDDQU Mnemonic = 392 - MNEMONIC_LDMXCSR Mnemonic = 393 - MNEMONIC_LDS Mnemonic = 394 - MNEMONIC_LDTILECFG Mnemonic = 395 - MNEMONIC_LEA Mnemonic = 396 - MNEMONIC_LEAVE Mnemonic = 397 - MNEMONIC_LES Mnemonic = 398 - MNEMONIC_LFENCE Mnemonic = 399 - MNEMONIC_LFS Mnemonic = 400 - MNEMONIC_LGDT Mnemonic = 401 - MNEMONIC_LGS Mnemonic = 402 - MNEMONIC_LIDT Mnemonic = 403 - MNEMONIC_LLDT Mnemonic = 404 - MNEMONIC_LLWPCB Mnemonic = 405 - MNEMONIC_LMSW Mnemonic = 406 - MNEMONIC_LOADIWKEY Mnemonic = 407 - MNEMONIC_LODSB Mnemonic = 408 - MNEMONIC_LODSD Mnemonic = 409 - MNEMONIC_LODSQ Mnemonic = 410 - MNEMONIC_LODSW Mnemonic = 411 - MNEMONIC_LOOP Mnemonic = 412 - MNEMONIC_LOOPE Mnemonic = 413 - MNEMONIC_LOOPNE Mnemonic = 414 - MNEMONIC_LSL Mnemonic = 415 - MNEMONIC_LSS Mnemonic = 416 - MNEMONIC_LTR Mnemonic = 417 - MNEMONIC_LWPINS Mnemonic = 418 - MNEMONIC_LWPVAL Mnemonic = 419 - MNEMONIC_LZCNT Mnemonic = 420 - MNEMONIC_MASKMOVDQU Mnemonic = 421 - MNEMONIC_MASKMOVQ Mnemonic = 422 - MNEMONIC_MAXPD Mnemonic = 423 - MNEMONIC_MAXPS Mnemonic = 424 - MNEMONIC_MAXSD Mnemonic = 425 - MNEMONIC_MAXSS Mnemonic = 426 - MNEMONIC_MCOMMIT Mnemonic = 427 - MNEMONIC_MFENCE Mnemonic = 428 - MNEMONIC_MINPD Mnemonic = 429 - MNEMONIC_MINPS Mnemonic = 430 - MNEMONIC_MINSD Mnemonic = 431 - MNEMONIC_MINSS Mnemonic = 432 - MNEMONIC_MONITOR Mnemonic = 433 - MNEMONIC_MONITORX Mnemonic = 434 - MNEMONIC_MONTMUL Mnemonic = 435 - MNEMONIC_MOV Mnemonic = 436 - MNEMONIC_MOVAPD Mnemonic = 437 - MNEMONIC_MOVAPS Mnemonic = 438 - MNEMONIC_MOVBE Mnemonic = 439 - MNEMONIC_MOVD Mnemonic = 440 - MNEMONIC_MOVDDUP Mnemonic = 441 - MNEMONIC_MOVDIR64B Mnemonic = 442 - MNEMONIC_MOVDIRI Mnemonic = 443 - MNEMONIC_MOVDQ2Q Mnemonic = 444 - MNEMONIC_MOVDQA Mnemonic = 445 - MNEMONIC_MOVDQU Mnemonic = 446 - MNEMONIC_MOVHLPS Mnemonic = 447 - MNEMONIC_MOVHPD Mnemonic = 448 - MNEMONIC_MOVHPS Mnemonic = 449 - MNEMONIC_MOVLHPS Mnemonic = 450 - MNEMONIC_MOVLPD Mnemonic = 451 - MNEMONIC_MOVLPS Mnemonic = 452 - MNEMONIC_MOVMSKPD Mnemonic = 453 - MNEMONIC_MOVMSKPS Mnemonic = 454 - MNEMONIC_MOVNTDQ Mnemonic = 455 - MNEMONIC_MOVNTDQA Mnemonic = 456 - MNEMONIC_MOVNTI Mnemonic = 457 - MNEMONIC_MOVNTPD Mnemonic = 458 - MNEMONIC_MOVNTPS Mnemonic = 459 - MNEMONIC_MOVNTQ Mnemonic = 460 - MNEMONIC_MOVNTSD Mnemonic = 461 - MNEMONIC_MOVNTSS Mnemonic = 462 - MNEMONIC_MOVQ Mnemonic = 463 - MNEMONIC_MOVQ2DQ Mnemonic = 464 - MNEMONIC_MOVSB Mnemonic = 465 - MNEMONIC_MOVSD Mnemonic = 466 - MNEMONIC_MOVSHDUP Mnemonic = 467 - MNEMONIC_MOVSLDUP Mnemonic = 468 - MNEMONIC_MOVSQ Mnemonic = 469 - MNEMONIC_MOVSS Mnemonic = 470 - MNEMONIC_MOVSW Mnemonic = 471 - MNEMONIC_MOVSX Mnemonic = 472 - MNEMONIC_MOVSXD Mnemonic = 473 - MNEMONIC_MOVUPD Mnemonic = 474 - MNEMONIC_MOVUPS Mnemonic = 475 - MNEMONIC_MOVZX Mnemonic = 476 - MNEMONIC_MPSADBW Mnemonic = 477 - MNEMONIC_MUL Mnemonic = 478 - MNEMONIC_MULPD Mnemonic = 479 - MNEMONIC_MULPS Mnemonic = 480 - MNEMONIC_MULSD Mnemonic = 481 - MNEMONIC_MULSS Mnemonic = 482 - MNEMONIC_MULX Mnemonic = 483 - MNEMONIC_MWAIT Mnemonic = 484 - MNEMONIC_MWAITX Mnemonic = 485 - MNEMONIC_NEG Mnemonic = 486 - MNEMONIC_NOP Mnemonic = 487 - MNEMONIC_NOT Mnemonic = 488 - MNEMONIC_OR Mnemonic = 489 - MNEMONIC_ORPD Mnemonic = 490 - MNEMONIC_ORPS Mnemonic = 491 - MNEMONIC_OUT Mnemonic = 492 - MNEMONIC_OUTSB Mnemonic = 493 - MNEMONIC_OUTSD Mnemonic = 494 - MNEMONIC_OUTSW Mnemonic = 495 - MNEMONIC_PABSB Mnemonic = 496 - MNEMONIC_PABSD Mnemonic = 497 - MNEMONIC_PABSW Mnemonic = 498 - MNEMONIC_PACKSSDW Mnemonic = 499 - MNEMONIC_PACKSSWB Mnemonic = 500 - MNEMONIC_PACKUSDW Mnemonic = 501 - MNEMONIC_PACKUSWB Mnemonic = 502 - MNEMONIC_PADDB Mnemonic = 503 - MNEMONIC_PADDD Mnemonic = 504 - MNEMONIC_PADDQ Mnemonic = 505 - MNEMONIC_PADDSB Mnemonic = 506 - MNEMONIC_PADDSW Mnemonic = 507 - MNEMONIC_PADDUSB Mnemonic = 508 - MNEMONIC_PADDUSW Mnemonic = 509 - MNEMONIC_PADDW Mnemonic = 510 - MNEMONIC_PALIGNR Mnemonic = 511 - MNEMONIC_PAND Mnemonic = 512 - MNEMONIC_PANDN Mnemonic = 513 - MNEMONIC_PAUSE Mnemonic = 514 - MNEMONIC_PAVGB Mnemonic = 515 - MNEMONIC_PAVGUSB Mnemonic = 516 - MNEMONIC_PAVGW Mnemonic = 517 - MNEMONIC_PBLENDVB Mnemonic = 518 - MNEMONIC_PBLENDW Mnemonic = 519 - MNEMONIC_PBNDKB Mnemonic = 520 - MNEMONIC_PCLMULQDQ Mnemonic = 521 - MNEMONIC_PCMPEQB Mnemonic = 522 - MNEMONIC_PCMPEQD Mnemonic = 523 - MNEMONIC_PCMPEQQ Mnemonic = 524 - MNEMONIC_PCMPEQW Mnemonic = 525 - MNEMONIC_PCMPESTRI Mnemonic = 526 - MNEMONIC_PCMPESTRM Mnemonic = 527 - MNEMONIC_PCMPGTB Mnemonic = 528 - MNEMONIC_PCMPGTD Mnemonic = 529 - MNEMONIC_PCMPGTQ Mnemonic = 530 - MNEMONIC_PCMPGTW Mnemonic = 531 - MNEMONIC_PCMPISTRI Mnemonic = 532 - MNEMONIC_PCMPISTRM Mnemonic = 533 - MNEMONIC_PCOMMIT Mnemonic = 534 - MNEMONIC_PCONFIG Mnemonic = 535 - MNEMONIC_PDEP Mnemonic = 536 - MNEMONIC_PEXT Mnemonic = 537 - MNEMONIC_PEXTRB Mnemonic = 538 - MNEMONIC_PEXTRD Mnemonic = 539 - MNEMONIC_PEXTRQ Mnemonic = 540 - MNEMONIC_PEXTRW Mnemonic = 541 - MNEMONIC_PF2ID Mnemonic = 542 - MNEMONIC_PF2IW Mnemonic = 543 - MNEMONIC_PFACC Mnemonic = 544 - MNEMONIC_PFADD Mnemonic = 545 - MNEMONIC_PFCMPEQ Mnemonic = 546 - MNEMONIC_PFCMPGE Mnemonic = 547 - MNEMONIC_PFCMPGT Mnemonic = 548 - MNEMONIC_PFCPIT1 Mnemonic = 549 - MNEMONIC_PFMAX Mnemonic = 550 - MNEMONIC_PFMIN Mnemonic = 551 - MNEMONIC_PFMUL Mnemonic = 552 - MNEMONIC_PFNACC Mnemonic = 553 - MNEMONIC_PFPNACC Mnemonic = 554 - MNEMONIC_PFRCP Mnemonic = 555 - MNEMONIC_PFRCPIT2 Mnemonic = 556 - MNEMONIC_PFRSQIT1 Mnemonic = 557 - MNEMONIC_PFSQRT Mnemonic = 558 - MNEMONIC_PFSUB Mnemonic = 559 - MNEMONIC_PFSUBR Mnemonic = 560 - MNEMONIC_PHADDD Mnemonic = 561 - MNEMONIC_PHADDSW Mnemonic = 562 - MNEMONIC_PHADDW Mnemonic = 563 - MNEMONIC_PHMINPOSUW Mnemonic = 564 - MNEMONIC_PHSUBD Mnemonic = 565 - MNEMONIC_PHSUBSW Mnemonic = 566 - MNEMONIC_PHSUBW Mnemonic = 567 - MNEMONIC_PI2FD Mnemonic = 568 - MNEMONIC_PI2FW Mnemonic = 569 - MNEMONIC_PINSRB Mnemonic = 570 - MNEMONIC_PINSRD Mnemonic = 571 - MNEMONIC_PINSRQ Mnemonic = 572 - MNEMONIC_PINSRW Mnemonic = 573 - MNEMONIC_PMADDUBSW Mnemonic = 574 - MNEMONIC_PMADDWD Mnemonic = 575 - MNEMONIC_PMAXSB Mnemonic = 576 - MNEMONIC_PMAXSD Mnemonic = 577 - MNEMONIC_PMAXSW Mnemonic = 578 - MNEMONIC_PMAXUB Mnemonic = 579 - MNEMONIC_PMAXUD Mnemonic = 580 - MNEMONIC_PMAXUW Mnemonic = 581 - MNEMONIC_PMINSB Mnemonic = 582 - MNEMONIC_PMINSD Mnemonic = 583 - MNEMONIC_PMINSW Mnemonic = 584 - MNEMONIC_PMINUB Mnemonic = 585 - MNEMONIC_PMINUD Mnemonic = 586 - MNEMONIC_PMINUW Mnemonic = 587 - MNEMONIC_PMOVMSKB Mnemonic = 588 - MNEMONIC_PMOVSXBD Mnemonic = 589 - MNEMONIC_PMOVSXBQ Mnemonic = 590 - MNEMONIC_PMOVSXBW Mnemonic = 591 - MNEMONIC_PMOVSXDQ Mnemonic = 592 - MNEMONIC_PMOVSXWD Mnemonic = 593 - MNEMONIC_PMOVSXWQ Mnemonic = 594 - MNEMONIC_PMOVZXBD Mnemonic = 595 - MNEMONIC_PMOVZXBQ Mnemonic = 596 - MNEMONIC_PMOVZXBW Mnemonic = 597 - MNEMONIC_PMOVZXDQ Mnemonic = 598 - MNEMONIC_PMOVZXWD Mnemonic = 599 - MNEMONIC_PMOVZXWQ Mnemonic = 600 - MNEMONIC_PMULDQ Mnemonic = 601 - MNEMONIC_PMULHRSW Mnemonic = 602 - MNEMONIC_PMULHRW Mnemonic = 603 - MNEMONIC_PMULHUW Mnemonic = 604 - MNEMONIC_PMULHW Mnemonic = 605 - MNEMONIC_PMULLD Mnemonic = 606 - MNEMONIC_PMULLW Mnemonic = 607 - MNEMONIC_PMULUDQ Mnemonic = 608 - MNEMONIC_POP Mnemonic = 609 - MNEMONIC_POPA Mnemonic = 610 - MNEMONIC_POPAD Mnemonic = 611 - MNEMONIC_POPCNT Mnemonic = 612 - MNEMONIC_POPF Mnemonic = 613 - MNEMONIC_POPFD Mnemonic = 614 - MNEMONIC_POPFQ Mnemonic = 615 - MNEMONIC_POR Mnemonic = 616 - MNEMONIC_PREFETCH Mnemonic = 617 - MNEMONIC_PREFETCHIT0 Mnemonic = 618 - MNEMONIC_PREFETCHIT1 Mnemonic = 619 - MNEMONIC_PREFETCHNTA Mnemonic = 620 - MNEMONIC_PREFETCHT0 Mnemonic = 621 - MNEMONIC_PREFETCHT1 Mnemonic = 622 - MNEMONIC_PREFETCHT2 Mnemonic = 623 - MNEMONIC_PREFETCHW Mnemonic = 624 - MNEMONIC_PREFETCHWT1 Mnemonic = 625 - MNEMONIC_PSADBW Mnemonic = 626 - MNEMONIC_PSHUFB Mnemonic = 627 - MNEMONIC_PSHUFD Mnemonic = 628 - MNEMONIC_PSHUFHW Mnemonic = 629 - MNEMONIC_PSHUFLW Mnemonic = 630 - MNEMONIC_PSHUFW Mnemonic = 631 - MNEMONIC_PSIGNB Mnemonic = 632 - MNEMONIC_PSIGND Mnemonic = 633 - MNEMONIC_PSIGNW Mnemonic = 634 - MNEMONIC_PSLLD Mnemonic = 635 - MNEMONIC_PSLLDQ Mnemonic = 636 - MNEMONIC_PSLLQ Mnemonic = 637 - MNEMONIC_PSLLW Mnemonic = 638 - MNEMONIC_PSMASH Mnemonic = 639 - MNEMONIC_PSRAD Mnemonic = 640 - MNEMONIC_PSRAW Mnemonic = 641 - MNEMONIC_PSRLD Mnemonic = 642 - MNEMONIC_PSRLDQ Mnemonic = 643 - MNEMONIC_PSRLQ Mnemonic = 644 - MNEMONIC_PSRLW Mnemonic = 645 - MNEMONIC_PSUBB Mnemonic = 646 - MNEMONIC_PSUBD Mnemonic = 647 - MNEMONIC_PSUBQ Mnemonic = 648 - MNEMONIC_PSUBSB Mnemonic = 649 - MNEMONIC_PSUBSW Mnemonic = 650 - MNEMONIC_PSUBUSB Mnemonic = 651 - MNEMONIC_PSUBUSW Mnemonic = 652 - MNEMONIC_PSUBW Mnemonic = 653 - MNEMONIC_PSWAPD Mnemonic = 654 - MNEMONIC_PTEST Mnemonic = 655 - MNEMONIC_PTWRITE Mnemonic = 656 - MNEMONIC_PUNPCKHBW Mnemonic = 657 - MNEMONIC_PUNPCKHDQ Mnemonic = 658 - MNEMONIC_PUNPCKHQDQ Mnemonic = 659 - MNEMONIC_PUNPCKHWD Mnemonic = 660 - MNEMONIC_PUNPCKLBW Mnemonic = 661 - MNEMONIC_PUNPCKLDQ Mnemonic = 662 - MNEMONIC_PUNPCKLQDQ Mnemonic = 663 - MNEMONIC_PUNPCKLWD Mnemonic = 664 - MNEMONIC_PUSH Mnemonic = 665 - MNEMONIC_PUSHA Mnemonic = 666 - MNEMONIC_PUSHAD Mnemonic = 667 - MNEMONIC_PUSHF Mnemonic = 668 - MNEMONIC_PUSHFD Mnemonic = 669 - MNEMONIC_PUSHFQ Mnemonic = 670 - MNEMONIC_PVALIDATE Mnemonic = 671 - MNEMONIC_PXOR Mnemonic = 672 - MNEMONIC_RCL Mnemonic = 673 - MNEMONIC_RCPPS Mnemonic = 674 - MNEMONIC_RCPSS Mnemonic = 675 - MNEMONIC_RCR Mnemonic = 676 - MNEMONIC_RDFSBASE Mnemonic = 677 - MNEMONIC_RDGSBASE Mnemonic = 678 - MNEMONIC_RDMSR Mnemonic = 679 - MNEMONIC_RDMSRLIST Mnemonic = 680 - MNEMONIC_RDPID Mnemonic = 681 - MNEMONIC_RDPKRU Mnemonic = 682 - MNEMONIC_RDPMC Mnemonic = 683 - MNEMONIC_RDPRU Mnemonic = 684 - MNEMONIC_RDRAND Mnemonic = 685 - MNEMONIC_RDSEED Mnemonic = 686 - MNEMONIC_RDSSPD Mnemonic = 687 - MNEMONIC_RDSSPQ Mnemonic = 688 - MNEMONIC_RDTSC Mnemonic = 689 - MNEMONIC_RDTSCP Mnemonic = 690 - MNEMONIC_RET Mnemonic = 691 - MNEMONIC_RMPADJUST Mnemonic = 692 - MNEMONIC_RMPUPDATE Mnemonic = 693 - MNEMONIC_ROL Mnemonic = 694 - MNEMONIC_ROR Mnemonic = 695 - MNEMONIC_RORX Mnemonic = 696 - MNEMONIC_ROUNDPD Mnemonic = 697 - MNEMONIC_ROUNDPS Mnemonic = 698 - MNEMONIC_ROUNDSD Mnemonic = 699 - MNEMONIC_ROUNDSS Mnemonic = 700 - MNEMONIC_RSM Mnemonic = 701 - MNEMONIC_RSQRTPS Mnemonic = 702 - MNEMONIC_RSQRTSS Mnemonic = 703 - MNEMONIC_RSTORSSP Mnemonic = 704 - MNEMONIC_SAHF Mnemonic = 705 - MNEMONIC_SALC Mnemonic = 706 - MNEMONIC_SAR Mnemonic = 707 - MNEMONIC_SARX Mnemonic = 708 - MNEMONIC_SAVEPREVSSP Mnemonic = 709 - MNEMONIC_SBB Mnemonic = 710 - MNEMONIC_SCASB Mnemonic = 711 - MNEMONIC_SCASD Mnemonic = 712 - MNEMONIC_SCASQ Mnemonic = 713 - MNEMONIC_SCASW Mnemonic = 714 - MNEMONIC_SEAMCALL Mnemonic = 715 - MNEMONIC_SEAMOPS Mnemonic = 716 - MNEMONIC_SEAMRET Mnemonic = 717 - MNEMONIC_SENDUIPI Mnemonic = 718 - MNEMONIC_SERIALIZE Mnemonic = 719 - MNEMONIC_SETB Mnemonic = 720 - MNEMONIC_SETBE Mnemonic = 721 - MNEMONIC_SETL Mnemonic = 722 - MNEMONIC_SETLE Mnemonic = 723 - MNEMONIC_SETNB Mnemonic = 724 - MNEMONIC_SETNBE Mnemonic = 725 - MNEMONIC_SETNL Mnemonic = 726 - MNEMONIC_SETNLE Mnemonic = 727 - MNEMONIC_SETNO Mnemonic = 728 - MNEMONIC_SETNP Mnemonic = 729 - MNEMONIC_SETNS Mnemonic = 730 - MNEMONIC_SETNZ Mnemonic = 731 - MNEMONIC_SETO Mnemonic = 732 - MNEMONIC_SETP Mnemonic = 733 - MNEMONIC_SETS Mnemonic = 734 - MNEMONIC_SETSSBSY Mnemonic = 735 - MNEMONIC_SETZ Mnemonic = 736 - MNEMONIC_SFENCE Mnemonic = 737 - MNEMONIC_SGDT Mnemonic = 738 - MNEMONIC_SHA1MSG1 Mnemonic = 739 - MNEMONIC_SHA1MSG2 Mnemonic = 740 - MNEMONIC_SHA1NEXTE Mnemonic = 741 - MNEMONIC_SHA1RNDS4 Mnemonic = 742 - MNEMONIC_SHA256MSG1 Mnemonic = 743 - MNEMONIC_SHA256MSG2 Mnemonic = 744 - MNEMONIC_SHA256RNDS2 Mnemonic = 745 - MNEMONIC_SHL Mnemonic = 746 - MNEMONIC_SHLD Mnemonic = 747 - MNEMONIC_SHLX Mnemonic = 748 - MNEMONIC_SHR Mnemonic = 749 - MNEMONIC_SHRD Mnemonic = 750 - MNEMONIC_SHRX Mnemonic = 751 - MNEMONIC_SHUFPD Mnemonic = 752 - MNEMONIC_SHUFPS Mnemonic = 753 - MNEMONIC_SIDT Mnemonic = 754 - MNEMONIC_SKINIT Mnemonic = 755 - MNEMONIC_SLDT Mnemonic = 756 - MNEMONIC_SLWPCB Mnemonic = 757 - MNEMONIC_SMSW Mnemonic = 758 - MNEMONIC_SPFLT Mnemonic = 759 - MNEMONIC_SQRTPD Mnemonic = 760 - MNEMONIC_SQRTPS Mnemonic = 761 - MNEMONIC_SQRTSD Mnemonic = 762 - MNEMONIC_SQRTSS Mnemonic = 763 - MNEMONIC_STAC Mnemonic = 764 - MNEMONIC_STC Mnemonic = 765 - MNEMONIC_STD Mnemonic = 766 - MNEMONIC_STGI Mnemonic = 767 - MNEMONIC_STI Mnemonic = 768 - MNEMONIC_STMXCSR Mnemonic = 769 - MNEMONIC_STOSB Mnemonic = 770 - MNEMONIC_STOSD Mnemonic = 771 - MNEMONIC_STOSQ Mnemonic = 772 - MNEMONIC_STOSW Mnemonic = 773 - MNEMONIC_STR Mnemonic = 774 - MNEMONIC_STTILECFG Mnemonic = 775 - MNEMONIC_STUI Mnemonic = 776 - MNEMONIC_SUB Mnemonic = 777 - MNEMONIC_SUBPD Mnemonic = 778 - MNEMONIC_SUBPS Mnemonic = 779 - MNEMONIC_SUBSD Mnemonic = 780 - MNEMONIC_SUBSS Mnemonic = 781 - MNEMONIC_SWAPGS Mnemonic = 782 - MNEMONIC_SYSCALL Mnemonic = 783 - MNEMONIC_SYSENTER Mnemonic = 784 - MNEMONIC_SYSEXIT Mnemonic = 785 - MNEMONIC_SYSRET Mnemonic = 786 - MNEMONIC_T1MSKC Mnemonic = 787 - MNEMONIC_TDCALL Mnemonic = 788 - MNEMONIC_TDPBF16PS Mnemonic = 789 - MNEMONIC_TDPBSSD Mnemonic = 790 - MNEMONIC_TDPBSUD Mnemonic = 791 - MNEMONIC_TDPBUSD Mnemonic = 792 - MNEMONIC_TDPBUUD Mnemonic = 793 - MNEMONIC_TDPFP16PS Mnemonic = 794 - MNEMONIC_TEST Mnemonic = 795 - MNEMONIC_TESTUI Mnemonic = 796 - MNEMONIC_TILELOADD Mnemonic = 797 - MNEMONIC_TILELOADDT1 Mnemonic = 798 - MNEMONIC_TILERELEASE Mnemonic = 799 - MNEMONIC_TILESTORED Mnemonic = 800 - MNEMONIC_TILEZERO Mnemonic = 801 - MNEMONIC_TLBSYNC Mnemonic = 802 - MNEMONIC_TPAUSE Mnemonic = 803 - MNEMONIC_TZCNT Mnemonic = 804 - MNEMONIC_TZCNTI Mnemonic = 805 - MNEMONIC_TZMSK Mnemonic = 806 - MNEMONIC_UCOMISD Mnemonic = 807 - MNEMONIC_UCOMISS Mnemonic = 808 - MNEMONIC_UD0 Mnemonic = 809 - MNEMONIC_UD1 Mnemonic = 810 - MNEMONIC_UD2 Mnemonic = 811 - MNEMONIC_UIRET Mnemonic = 812 - MNEMONIC_UMONITOR Mnemonic = 813 - MNEMONIC_UMWAIT Mnemonic = 814 - MNEMONIC_UNPCKHPD Mnemonic = 815 - MNEMONIC_UNPCKHPS Mnemonic = 816 - MNEMONIC_UNPCKLPD Mnemonic = 817 - MNEMONIC_UNPCKLPS Mnemonic = 818 - MNEMONIC_V4FMADDPS Mnemonic = 819 - MNEMONIC_V4FMADDSS Mnemonic = 820 - MNEMONIC_V4FNMADDPS Mnemonic = 821 - MNEMONIC_V4FNMADDSS Mnemonic = 822 - MNEMONIC_VADDNPD Mnemonic = 823 - MNEMONIC_VADDNPS Mnemonic = 824 - MNEMONIC_VADDPD Mnemonic = 825 - MNEMONIC_VADDPH Mnemonic = 826 - MNEMONIC_VADDPS Mnemonic = 827 - MNEMONIC_VADDSD Mnemonic = 828 - MNEMONIC_VADDSETSPS Mnemonic = 829 - MNEMONIC_VADDSH Mnemonic = 830 - MNEMONIC_VADDSS Mnemonic = 831 - MNEMONIC_VADDSUBPD Mnemonic = 832 - MNEMONIC_VADDSUBPS Mnemonic = 833 - MNEMONIC_VAESDEC Mnemonic = 834 - MNEMONIC_VAESDECLAST Mnemonic = 835 - MNEMONIC_VAESENC Mnemonic = 836 - MNEMONIC_VAESENCLAST Mnemonic = 837 - MNEMONIC_VAESIMC Mnemonic = 838 - MNEMONIC_VAESKEYGENASSIST Mnemonic = 839 - MNEMONIC_VALIGND Mnemonic = 840 - MNEMONIC_VALIGNQ Mnemonic = 841 - MNEMONIC_VANDNPD Mnemonic = 842 - MNEMONIC_VANDNPS Mnemonic = 843 - MNEMONIC_VANDPD Mnemonic = 844 - MNEMONIC_VANDPS Mnemonic = 845 - MNEMONIC_VBCSTNEBF162PS Mnemonic = 846 - MNEMONIC_VBCSTNESH2PS Mnemonic = 847 - MNEMONIC_VBLENDMPD Mnemonic = 848 - MNEMONIC_VBLENDMPS Mnemonic = 849 - MNEMONIC_VBLENDPD Mnemonic = 850 - MNEMONIC_VBLENDPS Mnemonic = 851 - MNEMONIC_VBLENDVPD Mnemonic = 852 - MNEMONIC_VBLENDVPS Mnemonic = 853 - MNEMONIC_VBROADCASTF128 Mnemonic = 854 - MNEMONIC_VBROADCASTF32X2 Mnemonic = 855 - MNEMONIC_VBROADCASTF32X4 Mnemonic = 856 - MNEMONIC_VBROADCASTF32X8 Mnemonic = 857 - MNEMONIC_VBROADCASTF64X2 Mnemonic = 858 - MNEMONIC_VBROADCASTF64X4 Mnemonic = 859 - MNEMONIC_VBROADCASTI128 Mnemonic = 860 - MNEMONIC_VBROADCASTI32X2 Mnemonic = 861 - MNEMONIC_VBROADCASTI32X4 Mnemonic = 862 - MNEMONIC_VBROADCASTI32X8 Mnemonic = 863 - MNEMONIC_VBROADCASTI64X2 Mnemonic = 864 - MNEMONIC_VBROADCASTI64X4 Mnemonic = 865 - MNEMONIC_VBROADCASTSD Mnemonic = 866 - MNEMONIC_VBROADCASTSS Mnemonic = 867 - MNEMONIC_VCMPPD Mnemonic = 868 - MNEMONIC_VCMPPH Mnemonic = 869 - MNEMONIC_VCMPPS Mnemonic = 870 - MNEMONIC_VCMPSD Mnemonic = 871 - MNEMONIC_VCMPSH Mnemonic = 872 - MNEMONIC_VCMPSS Mnemonic = 873 - MNEMONIC_VCOMISD Mnemonic = 874 - MNEMONIC_VCOMISH Mnemonic = 875 - MNEMONIC_VCOMISS Mnemonic = 876 - MNEMONIC_VCOMPRESSPD Mnemonic = 877 - MNEMONIC_VCOMPRESSPS Mnemonic = 878 - MNEMONIC_VCVTDQ2PD Mnemonic = 879 - MNEMONIC_VCVTDQ2PH Mnemonic = 880 - MNEMONIC_VCVTDQ2PS Mnemonic = 881 - MNEMONIC_VCVTFXPNTDQ2PS Mnemonic = 882 - MNEMONIC_VCVTFXPNTPD2DQ Mnemonic = 883 - MNEMONIC_VCVTFXPNTPD2UDQ Mnemonic = 884 - MNEMONIC_VCVTFXPNTPS2DQ Mnemonic = 885 - MNEMONIC_VCVTFXPNTPS2UDQ Mnemonic = 886 - MNEMONIC_VCVTFXPNTUDQ2PS Mnemonic = 887 - MNEMONIC_VCVTNE2PS2BF16 Mnemonic = 888 - MNEMONIC_VCVTNEEBF162PS Mnemonic = 889 - MNEMONIC_VCVTNEEPH2PS Mnemonic = 890 - MNEMONIC_VCVTNEOBF162PS Mnemonic = 891 - MNEMONIC_VCVTNEOPH2PS Mnemonic = 892 - MNEMONIC_VCVTNEPS2BF16 Mnemonic = 893 - MNEMONIC_VCVTPD2DQ Mnemonic = 894 - MNEMONIC_VCVTPD2PH Mnemonic = 895 - MNEMONIC_VCVTPD2PS Mnemonic = 896 - MNEMONIC_VCVTPD2QQ Mnemonic = 897 - MNEMONIC_VCVTPD2UDQ Mnemonic = 898 - MNEMONIC_VCVTPD2UQQ Mnemonic = 899 - MNEMONIC_VCVTPH2DQ Mnemonic = 900 - MNEMONIC_VCVTPH2PD Mnemonic = 901 - MNEMONIC_VCVTPH2PS Mnemonic = 902 - MNEMONIC_VCVTPH2PSX Mnemonic = 903 - MNEMONIC_VCVTPH2QQ Mnemonic = 904 - MNEMONIC_VCVTPH2UDQ Mnemonic = 905 - MNEMONIC_VCVTPH2UQQ Mnemonic = 906 - MNEMONIC_VCVTPH2UW Mnemonic = 907 - MNEMONIC_VCVTPH2W Mnemonic = 908 - MNEMONIC_VCVTPS2DQ Mnemonic = 909 - MNEMONIC_VCVTPS2PD Mnemonic = 910 - MNEMONIC_VCVTPS2PH Mnemonic = 911 - MNEMONIC_VCVTPS2PHX Mnemonic = 912 - MNEMONIC_VCVTPS2QQ Mnemonic = 913 - MNEMONIC_VCVTPS2UDQ Mnemonic = 914 - MNEMONIC_VCVTPS2UQQ Mnemonic = 915 - MNEMONIC_VCVTQQ2PD Mnemonic = 916 - MNEMONIC_VCVTQQ2PH Mnemonic = 917 - MNEMONIC_VCVTQQ2PS Mnemonic = 918 - MNEMONIC_VCVTSD2SH Mnemonic = 919 - MNEMONIC_VCVTSD2SI Mnemonic = 920 - MNEMONIC_VCVTSD2SS Mnemonic = 921 - MNEMONIC_VCVTSD2USI Mnemonic = 922 - MNEMONIC_VCVTSH2SD Mnemonic = 923 - MNEMONIC_VCVTSH2SI Mnemonic = 924 - MNEMONIC_VCVTSH2SS Mnemonic = 925 - MNEMONIC_VCVTSH2USI Mnemonic = 926 - MNEMONIC_VCVTSI2SD Mnemonic = 927 - MNEMONIC_VCVTSI2SH Mnemonic = 928 - MNEMONIC_VCVTSI2SS Mnemonic = 929 - MNEMONIC_VCVTSS2SD Mnemonic = 930 - MNEMONIC_VCVTSS2SH Mnemonic = 931 - MNEMONIC_VCVTSS2SI Mnemonic = 932 - MNEMONIC_VCVTSS2USI Mnemonic = 933 - MNEMONIC_VCVTTPD2DQ Mnemonic = 934 - MNEMONIC_VCVTTPD2QQ Mnemonic = 935 - MNEMONIC_VCVTTPD2UDQ Mnemonic = 936 - MNEMONIC_VCVTTPD2UQQ Mnemonic = 937 - MNEMONIC_VCVTTPH2DQ Mnemonic = 938 - MNEMONIC_VCVTTPH2QQ Mnemonic = 939 - MNEMONIC_VCVTTPH2UDQ Mnemonic = 940 - MNEMONIC_VCVTTPH2UQQ Mnemonic = 941 - MNEMONIC_VCVTTPH2UW Mnemonic = 942 - MNEMONIC_VCVTTPH2W Mnemonic = 943 - MNEMONIC_VCVTTPS2DQ Mnemonic = 944 - MNEMONIC_VCVTTPS2QQ Mnemonic = 945 - MNEMONIC_VCVTTPS2UDQ Mnemonic = 946 - MNEMONIC_VCVTTPS2UQQ Mnemonic = 947 - MNEMONIC_VCVTTSD2SI Mnemonic = 948 - MNEMONIC_VCVTTSD2USI Mnemonic = 949 - MNEMONIC_VCVTTSH2SI Mnemonic = 950 - MNEMONIC_VCVTTSH2USI Mnemonic = 951 - MNEMONIC_VCVTTSS2SI Mnemonic = 952 - MNEMONIC_VCVTTSS2USI Mnemonic = 953 - MNEMONIC_VCVTUDQ2PD Mnemonic = 954 - MNEMONIC_VCVTUDQ2PH Mnemonic = 955 - MNEMONIC_VCVTUDQ2PS Mnemonic = 956 - MNEMONIC_VCVTUQQ2PD Mnemonic = 957 - MNEMONIC_VCVTUQQ2PH Mnemonic = 958 - MNEMONIC_VCVTUQQ2PS Mnemonic = 959 - MNEMONIC_VCVTUSI2SD Mnemonic = 960 - MNEMONIC_VCVTUSI2SH Mnemonic = 961 - MNEMONIC_VCVTUSI2SS Mnemonic = 962 - MNEMONIC_VCVTUW2PH Mnemonic = 963 - MNEMONIC_VCVTW2PH Mnemonic = 964 - MNEMONIC_VDBPSADBW Mnemonic = 965 - MNEMONIC_VDIVPD Mnemonic = 966 - MNEMONIC_VDIVPH Mnemonic = 967 - MNEMONIC_VDIVPS Mnemonic = 968 - MNEMONIC_VDIVSD Mnemonic = 969 - MNEMONIC_VDIVSH Mnemonic = 970 - MNEMONIC_VDIVSS Mnemonic = 971 - MNEMONIC_VDPBF16PS Mnemonic = 972 - MNEMONIC_VDPPD Mnemonic = 973 - MNEMONIC_VDPPS Mnemonic = 974 - MNEMONIC_VERR Mnemonic = 975 - MNEMONIC_VERW Mnemonic = 976 - MNEMONIC_VEXP223PS Mnemonic = 977 - MNEMONIC_VEXP2PD Mnemonic = 978 - MNEMONIC_VEXP2PS Mnemonic = 979 - MNEMONIC_VEXPANDPD Mnemonic = 980 - MNEMONIC_VEXPANDPS Mnemonic = 981 - MNEMONIC_VEXTRACTF128 Mnemonic = 982 - MNEMONIC_VEXTRACTF32X4 Mnemonic = 983 - MNEMONIC_VEXTRACTF32X8 Mnemonic = 984 - MNEMONIC_VEXTRACTF64X2 Mnemonic = 985 - MNEMONIC_VEXTRACTF64X4 Mnemonic = 986 - MNEMONIC_VEXTRACTI128 Mnemonic = 987 - MNEMONIC_VEXTRACTI32X4 Mnemonic = 988 - MNEMONIC_VEXTRACTI32X8 Mnemonic = 989 - MNEMONIC_VEXTRACTI64X2 Mnemonic = 990 - MNEMONIC_VEXTRACTI64X4 Mnemonic = 991 - MNEMONIC_VEXTRACTPS Mnemonic = 992 - MNEMONIC_VFCMADDCPH Mnemonic = 993 - MNEMONIC_VFCMADDCSH Mnemonic = 994 - MNEMONIC_VFCMULCPH Mnemonic = 995 - MNEMONIC_VFCMULCSH Mnemonic = 996 - MNEMONIC_VFIXUPIMMPD Mnemonic = 997 - MNEMONIC_VFIXUPIMMPS Mnemonic = 998 - MNEMONIC_VFIXUPIMMSD Mnemonic = 999 - MNEMONIC_VFIXUPIMMSS Mnemonic = 1000 - MNEMONIC_VFIXUPNANPD Mnemonic = 1001 - MNEMONIC_VFIXUPNANPS Mnemonic = 1002 - MNEMONIC_VFMADD132PD Mnemonic = 1003 - MNEMONIC_VFMADD132PH Mnemonic = 1004 - MNEMONIC_VFMADD132PS Mnemonic = 1005 - MNEMONIC_VFMADD132SD Mnemonic = 1006 - MNEMONIC_VFMADD132SH Mnemonic = 1007 - MNEMONIC_VFMADD132SS Mnemonic = 1008 - MNEMONIC_VFMADD213PD Mnemonic = 1009 - MNEMONIC_VFMADD213PH Mnemonic = 1010 - MNEMONIC_VFMADD213PS Mnemonic = 1011 - MNEMONIC_VFMADD213SD Mnemonic = 1012 - MNEMONIC_VFMADD213SH Mnemonic = 1013 - MNEMONIC_VFMADD213SS Mnemonic = 1014 - MNEMONIC_VFMADD231PD Mnemonic = 1015 - MNEMONIC_VFMADD231PH Mnemonic = 1016 - MNEMONIC_VFMADD231PS Mnemonic = 1017 - MNEMONIC_VFMADD231SD Mnemonic = 1018 - MNEMONIC_VFMADD231SH Mnemonic = 1019 - MNEMONIC_VFMADD231SS Mnemonic = 1020 - MNEMONIC_VFMADD233PS Mnemonic = 1021 - MNEMONIC_VFMADDCPH Mnemonic = 1022 - MNEMONIC_VFMADDCSH Mnemonic = 1023 - MNEMONIC_VFMADDPD Mnemonic = 1024 - MNEMONIC_VFMADDPS Mnemonic = 1025 - MNEMONIC_VFMADDSD Mnemonic = 1026 - MNEMONIC_VFMADDSS Mnemonic = 1027 - MNEMONIC_VFMADDSUB132PD Mnemonic = 1028 - MNEMONIC_VFMADDSUB132PH Mnemonic = 1029 - MNEMONIC_VFMADDSUB132PS Mnemonic = 1030 - MNEMONIC_VFMADDSUB213PD Mnemonic = 1031 - MNEMONIC_VFMADDSUB213PH Mnemonic = 1032 - MNEMONIC_VFMADDSUB213PS Mnemonic = 1033 - MNEMONIC_VFMADDSUB231PD Mnemonic = 1034 - MNEMONIC_VFMADDSUB231PH Mnemonic = 1035 - MNEMONIC_VFMADDSUB231PS Mnemonic = 1036 - MNEMONIC_VFMADDSUBPD Mnemonic = 1037 - MNEMONIC_VFMADDSUBPS Mnemonic = 1038 - MNEMONIC_VFMSUB132PD Mnemonic = 1039 - MNEMONIC_VFMSUB132PH Mnemonic = 1040 - MNEMONIC_VFMSUB132PS Mnemonic = 1041 - MNEMONIC_VFMSUB132SD Mnemonic = 1042 - MNEMONIC_VFMSUB132SH Mnemonic = 1043 - MNEMONIC_VFMSUB132SS Mnemonic = 1044 - MNEMONIC_VFMSUB213PD Mnemonic = 1045 - MNEMONIC_VFMSUB213PH Mnemonic = 1046 - MNEMONIC_VFMSUB213PS Mnemonic = 1047 - MNEMONIC_VFMSUB213SD Mnemonic = 1048 - MNEMONIC_VFMSUB213SH Mnemonic = 1049 - MNEMONIC_VFMSUB213SS Mnemonic = 1050 - MNEMONIC_VFMSUB231PD Mnemonic = 1051 - MNEMONIC_VFMSUB231PH Mnemonic = 1052 - MNEMONIC_VFMSUB231PS Mnemonic = 1053 - MNEMONIC_VFMSUB231SD Mnemonic = 1054 - MNEMONIC_VFMSUB231SH Mnemonic = 1055 - MNEMONIC_VFMSUB231SS Mnemonic = 1056 - MNEMONIC_VFMSUBADD132PD Mnemonic = 1057 - MNEMONIC_VFMSUBADD132PH Mnemonic = 1058 - MNEMONIC_VFMSUBADD132PS Mnemonic = 1059 - MNEMONIC_VFMSUBADD213PD Mnemonic = 1060 - MNEMONIC_VFMSUBADD213PH Mnemonic = 1061 - MNEMONIC_VFMSUBADD213PS Mnemonic = 1062 - MNEMONIC_VFMSUBADD231PD Mnemonic = 1063 - MNEMONIC_VFMSUBADD231PH Mnemonic = 1064 - MNEMONIC_VFMSUBADD231PS Mnemonic = 1065 - MNEMONIC_VFMSUBADDPD Mnemonic = 1066 - MNEMONIC_VFMSUBADDPS Mnemonic = 1067 - MNEMONIC_VFMSUBPD Mnemonic = 1068 - MNEMONIC_VFMSUBPS Mnemonic = 1069 - MNEMONIC_VFMSUBSD Mnemonic = 1070 - MNEMONIC_VFMSUBSS Mnemonic = 1071 - MNEMONIC_VFMULCPH Mnemonic = 1072 - MNEMONIC_VFMULCSH Mnemonic = 1073 - MNEMONIC_VFNMADD132PD Mnemonic = 1074 - MNEMONIC_VFNMADD132PH Mnemonic = 1075 - MNEMONIC_VFNMADD132PS Mnemonic = 1076 - MNEMONIC_VFNMADD132SD Mnemonic = 1077 - MNEMONIC_VFNMADD132SH Mnemonic = 1078 - MNEMONIC_VFNMADD132SS Mnemonic = 1079 - MNEMONIC_VFNMADD213PD Mnemonic = 1080 - MNEMONIC_VFNMADD213PH Mnemonic = 1081 - MNEMONIC_VFNMADD213PS Mnemonic = 1082 - MNEMONIC_VFNMADD213SD Mnemonic = 1083 - MNEMONIC_VFNMADD213SH Mnemonic = 1084 - MNEMONIC_VFNMADD213SS Mnemonic = 1085 - MNEMONIC_VFNMADD231PD Mnemonic = 1086 - MNEMONIC_VFNMADD231PH Mnemonic = 1087 - MNEMONIC_VFNMADD231PS Mnemonic = 1088 - MNEMONIC_VFNMADD231SD Mnemonic = 1089 - MNEMONIC_VFNMADD231SH Mnemonic = 1090 - MNEMONIC_VFNMADD231SS Mnemonic = 1091 - MNEMONIC_VFNMADDPD Mnemonic = 1092 - MNEMONIC_VFNMADDPS Mnemonic = 1093 - MNEMONIC_VFNMADDSD Mnemonic = 1094 - MNEMONIC_VFNMADDSS Mnemonic = 1095 - MNEMONIC_VFNMSUB132PD Mnemonic = 1096 - MNEMONIC_VFNMSUB132PH Mnemonic = 1097 - MNEMONIC_VFNMSUB132PS Mnemonic = 1098 - MNEMONIC_VFNMSUB132SD Mnemonic = 1099 - MNEMONIC_VFNMSUB132SH Mnemonic = 1100 - MNEMONIC_VFNMSUB132SS Mnemonic = 1101 - MNEMONIC_VFNMSUB213PD Mnemonic = 1102 - MNEMONIC_VFNMSUB213PH Mnemonic = 1103 - MNEMONIC_VFNMSUB213PS Mnemonic = 1104 - MNEMONIC_VFNMSUB213SD Mnemonic = 1105 - MNEMONIC_VFNMSUB213SH Mnemonic = 1106 - MNEMONIC_VFNMSUB213SS Mnemonic = 1107 - MNEMONIC_VFNMSUB231PD Mnemonic = 1108 - MNEMONIC_VFNMSUB231PH Mnemonic = 1109 - MNEMONIC_VFNMSUB231PS Mnemonic = 1110 - MNEMONIC_VFNMSUB231SD Mnemonic = 1111 - MNEMONIC_VFNMSUB231SH Mnemonic = 1112 - MNEMONIC_VFNMSUB231SS Mnemonic = 1113 - MNEMONIC_VFNMSUBPD Mnemonic = 1114 - MNEMONIC_VFNMSUBPS Mnemonic = 1115 - MNEMONIC_VFNMSUBSD Mnemonic = 1116 - MNEMONIC_VFNMSUBSS Mnemonic = 1117 - MNEMONIC_VFPCLASSPD Mnemonic = 1118 - MNEMONIC_VFPCLASSPH Mnemonic = 1119 - MNEMONIC_VFPCLASSPS Mnemonic = 1120 - MNEMONIC_VFPCLASSSD Mnemonic = 1121 - MNEMONIC_VFPCLASSSH Mnemonic = 1122 - MNEMONIC_VFPCLASSSS Mnemonic = 1123 - MNEMONIC_VFRCZPD Mnemonic = 1124 - MNEMONIC_VFRCZPS Mnemonic = 1125 - MNEMONIC_VFRCZSD Mnemonic = 1126 - MNEMONIC_VFRCZSS Mnemonic = 1127 - MNEMONIC_VGATHERDPD Mnemonic = 1128 - MNEMONIC_VGATHERDPS Mnemonic = 1129 - MNEMONIC_VGATHERPF0DPD Mnemonic = 1130 - MNEMONIC_VGATHERPF0DPS Mnemonic = 1131 - MNEMONIC_VGATHERPF0HINTDPD Mnemonic = 1132 - MNEMONIC_VGATHERPF0HINTDPS Mnemonic = 1133 - MNEMONIC_VGATHERPF0QPD Mnemonic = 1134 - MNEMONIC_VGATHERPF0QPS Mnemonic = 1135 - MNEMONIC_VGATHERPF1DPD Mnemonic = 1136 - MNEMONIC_VGATHERPF1DPS Mnemonic = 1137 - MNEMONIC_VGATHERPF1QPD Mnemonic = 1138 - MNEMONIC_VGATHERPF1QPS Mnemonic = 1139 - MNEMONIC_VGATHERQPD Mnemonic = 1140 - MNEMONIC_VGATHERQPS Mnemonic = 1141 - MNEMONIC_VGETEXPPD Mnemonic = 1142 - MNEMONIC_VGETEXPPH Mnemonic = 1143 - MNEMONIC_VGETEXPPS Mnemonic = 1144 - MNEMONIC_VGETEXPSD Mnemonic = 1145 - MNEMONIC_VGETEXPSH Mnemonic = 1146 - MNEMONIC_VGETEXPSS Mnemonic = 1147 - MNEMONIC_VGETMANTPD Mnemonic = 1148 - MNEMONIC_VGETMANTPH Mnemonic = 1149 - MNEMONIC_VGETMANTPS Mnemonic = 1150 - MNEMONIC_VGETMANTSD Mnemonic = 1151 - MNEMONIC_VGETMANTSH Mnemonic = 1152 - MNEMONIC_VGETMANTSS Mnemonic = 1153 - MNEMONIC_VGF2P8AFFINEINVQB Mnemonic = 1154 - MNEMONIC_VGF2P8AFFINEQB Mnemonic = 1155 - MNEMONIC_VGF2P8MULB Mnemonic = 1156 - MNEMONIC_VGMAXABSPS Mnemonic = 1157 - MNEMONIC_VGMAXPD Mnemonic = 1158 - MNEMONIC_VGMAXPS Mnemonic = 1159 - MNEMONIC_VGMINPD Mnemonic = 1160 - MNEMONIC_VGMINPS Mnemonic = 1161 - MNEMONIC_VHADDPD Mnemonic = 1162 - MNEMONIC_VHADDPS Mnemonic = 1163 - MNEMONIC_VHSUBPD Mnemonic = 1164 - MNEMONIC_VHSUBPS Mnemonic = 1165 - MNEMONIC_VINSERTF128 Mnemonic = 1166 - MNEMONIC_VINSERTF32X4 Mnemonic = 1167 - MNEMONIC_VINSERTF32X8 Mnemonic = 1168 - MNEMONIC_VINSERTF64X2 Mnemonic = 1169 - MNEMONIC_VINSERTF64X4 Mnemonic = 1170 - MNEMONIC_VINSERTI128 Mnemonic = 1171 - MNEMONIC_VINSERTI32X4 Mnemonic = 1172 - MNEMONIC_VINSERTI32X8 Mnemonic = 1173 - MNEMONIC_VINSERTI64X2 Mnemonic = 1174 - MNEMONIC_VINSERTI64X4 Mnemonic = 1175 - MNEMONIC_VINSERTPS Mnemonic = 1176 - MNEMONIC_VLDDQU Mnemonic = 1177 - MNEMONIC_VLDMXCSR Mnemonic = 1178 - MNEMONIC_VLOADUNPACKHD Mnemonic = 1179 - MNEMONIC_VLOADUNPACKHPD Mnemonic = 1180 - MNEMONIC_VLOADUNPACKHPS Mnemonic = 1181 - MNEMONIC_VLOADUNPACKHQ Mnemonic = 1182 - MNEMONIC_VLOADUNPACKLD Mnemonic = 1183 - MNEMONIC_VLOADUNPACKLPD Mnemonic = 1184 - MNEMONIC_VLOADUNPACKLPS Mnemonic = 1185 - MNEMONIC_VLOADUNPACKLQ Mnemonic = 1186 - MNEMONIC_VLOG2PS Mnemonic = 1187 - MNEMONIC_VMASKMOVDQU Mnemonic = 1188 - MNEMONIC_VMASKMOVPD Mnemonic = 1189 - MNEMONIC_VMASKMOVPS Mnemonic = 1190 - MNEMONIC_VMAXPD Mnemonic = 1191 - MNEMONIC_VMAXPH Mnemonic = 1192 - MNEMONIC_VMAXPS Mnemonic = 1193 - MNEMONIC_VMAXSD Mnemonic = 1194 - MNEMONIC_VMAXSH Mnemonic = 1195 - MNEMONIC_VMAXSS Mnemonic = 1196 - MNEMONIC_VMCALL Mnemonic = 1197 - MNEMONIC_VMCLEAR Mnemonic = 1198 - MNEMONIC_VMFUNC Mnemonic = 1199 - MNEMONIC_VMINPD Mnemonic = 1200 - MNEMONIC_VMINPH Mnemonic = 1201 - MNEMONIC_VMINPS Mnemonic = 1202 - MNEMONIC_VMINSD Mnemonic = 1203 - MNEMONIC_VMINSH Mnemonic = 1204 - MNEMONIC_VMINSS Mnemonic = 1205 - MNEMONIC_VMLAUNCH Mnemonic = 1206 - MNEMONIC_VMLOAD Mnemonic = 1207 - MNEMONIC_VMMCALL Mnemonic = 1208 - MNEMONIC_VMOVAPD Mnemonic = 1209 - MNEMONIC_VMOVAPS Mnemonic = 1210 - MNEMONIC_VMOVD Mnemonic = 1211 - MNEMONIC_VMOVDDUP Mnemonic = 1212 - MNEMONIC_VMOVDQA Mnemonic = 1213 - MNEMONIC_VMOVDQA32 Mnemonic = 1214 - MNEMONIC_VMOVDQA64 Mnemonic = 1215 - MNEMONIC_VMOVDQU Mnemonic = 1216 - MNEMONIC_VMOVDQU16 Mnemonic = 1217 - MNEMONIC_VMOVDQU32 Mnemonic = 1218 - MNEMONIC_VMOVDQU64 Mnemonic = 1219 - MNEMONIC_VMOVDQU8 Mnemonic = 1220 - MNEMONIC_VMOVHLPS Mnemonic = 1221 - MNEMONIC_VMOVHPD Mnemonic = 1222 - MNEMONIC_VMOVHPS Mnemonic = 1223 - MNEMONIC_VMOVLHPS Mnemonic = 1224 - MNEMONIC_VMOVLPD Mnemonic = 1225 - MNEMONIC_VMOVLPS Mnemonic = 1226 - MNEMONIC_VMOVMSKPD Mnemonic = 1227 - MNEMONIC_VMOVMSKPS Mnemonic = 1228 - MNEMONIC_VMOVNRAPD Mnemonic = 1229 - MNEMONIC_VMOVNRAPS Mnemonic = 1230 - MNEMONIC_VMOVNRNGOAPD Mnemonic = 1231 - MNEMONIC_VMOVNRNGOAPS Mnemonic = 1232 - MNEMONIC_VMOVNTDQ Mnemonic = 1233 - MNEMONIC_VMOVNTDQA Mnemonic = 1234 - MNEMONIC_VMOVNTPD Mnemonic = 1235 - MNEMONIC_VMOVNTPS Mnemonic = 1236 - MNEMONIC_VMOVQ Mnemonic = 1237 - MNEMONIC_VMOVSD Mnemonic = 1238 - MNEMONIC_VMOVSH Mnemonic = 1239 - MNEMONIC_VMOVSHDUP Mnemonic = 1240 - MNEMONIC_VMOVSLDUP Mnemonic = 1241 - MNEMONIC_VMOVSS Mnemonic = 1242 - MNEMONIC_VMOVUPD Mnemonic = 1243 - MNEMONIC_VMOVUPS Mnemonic = 1244 - MNEMONIC_VMOVW Mnemonic = 1245 - MNEMONIC_VMPSADBW Mnemonic = 1246 - MNEMONIC_VMPTRLD Mnemonic = 1247 - MNEMONIC_VMPTRST Mnemonic = 1248 - MNEMONIC_VMREAD Mnemonic = 1249 - MNEMONIC_VMRESUME Mnemonic = 1250 - MNEMONIC_VMRUN Mnemonic = 1251 - MNEMONIC_VMSAVE Mnemonic = 1252 - MNEMONIC_VMULPD Mnemonic = 1253 - MNEMONIC_VMULPH Mnemonic = 1254 - MNEMONIC_VMULPS Mnemonic = 1255 - MNEMONIC_VMULSD Mnemonic = 1256 - MNEMONIC_VMULSH Mnemonic = 1257 - MNEMONIC_VMULSS Mnemonic = 1258 - MNEMONIC_VMWRITE Mnemonic = 1259 - MNEMONIC_VMXOFF Mnemonic = 1260 - MNEMONIC_VMXON Mnemonic = 1261 - MNEMONIC_VORPD Mnemonic = 1262 - MNEMONIC_VORPS Mnemonic = 1263 - MNEMONIC_VP2INTERSECTD Mnemonic = 1264 - MNEMONIC_VP2INTERSECTQ Mnemonic = 1265 - MNEMONIC_VP4DPWSSD Mnemonic = 1266 - MNEMONIC_VP4DPWSSDS Mnemonic = 1267 - MNEMONIC_VPABSB Mnemonic = 1268 - MNEMONIC_VPABSD Mnemonic = 1269 - MNEMONIC_VPABSQ Mnemonic = 1270 - MNEMONIC_VPABSW Mnemonic = 1271 - MNEMONIC_VPACKSSDW Mnemonic = 1272 - MNEMONIC_VPACKSSWB Mnemonic = 1273 - MNEMONIC_VPACKSTOREHD Mnemonic = 1274 - MNEMONIC_VPACKSTOREHPD Mnemonic = 1275 - MNEMONIC_VPACKSTOREHPS Mnemonic = 1276 - MNEMONIC_VPACKSTOREHQ Mnemonic = 1277 - MNEMONIC_VPACKSTORELD Mnemonic = 1278 - MNEMONIC_VPACKSTORELPD Mnemonic = 1279 - MNEMONIC_VPACKSTORELPS Mnemonic = 1280 - MNEMONIC_VPACKSTORELQ Mnemonic = 1281 - MNEMONIC_VPACKUSDW Mnemonic = 1282 - MNEMONIC_VPACKUSWB Mnemonic = 1283 - MNEMONIC_VPADCD Mnemonic = 1284 - MNEMONIC_VPADDB Mnemonic = 1285 - MNEMONIC_VPADDD Mnemonic = 1286 - MNEMONIC_VPADDQ Mnemonic = 1287 - MNEMONIC_VPADDSB Mnemonic = 1288 - MNEMONIC_VPADDSETCD Mnemonic = 1289 - MNEMONIC_VPADDSETSD Mnemonic = 1290 - MNEMONIC_VPADDSW Mnemonic = 1291 - MNEMONIC_VPADDUSB Mnemonic = 1292 - MNEMONIC_VPADDUSW Mnemonic = 1293 - MNEMONIC_VPADDW Mnemonic = 1294 - MNEMONIC_VPALIGNR Mnemonic = 1295 - MNEMONIC_VPAND Mnemonic = 1296 - MNEMONIC_VPANDD Mnemonic = 1297 - MNEMONIC_VPANDN Mnemonic = 1298 - MNEMONIC_VPANDND Mnemonic = 1299 - MNEMONIC_VPANDNQ Mnemonic = 1300 - MNEMONIC_VPANDQ Mnemonic = 1301 - MNEMONIC_VPAVGB Mnemonic = 1302 - MNEMONIC_VPAVGW Mnemonic = 1303 - MNEMONIC_VPBLENDD Mnemonic = 1304 - MNEMONIC_VPBLENDMB Mnemonic = 1305 - MNEMONIC_VPBLENDMD Mnemonic = 1306 - MNEMONIC_VPBLENDMQ Mnemonic = 1307 - MNEMONIC_VPBLENDMW Mnemonic = 1308 - MNEMONIC_VPBLENDVB Mnemonic = 1309 - MNEMONIC_VPBLENDW Mnemonic = 1310 - MNEMONIC_VPBROADCASTB Mnemonic = 1311 - MNEMONIC_VPBROADCASTD Mnemonic = 1312 - MNEMONIC_VPBROADCASTMB2Q Mnemonic = 1313 - MNEMONIC_VPBROADCASTMW2D Mnemonic = 1314 - MNEMONIC_VPBROADCASTQ Mnemonic = 1315 - MNEMONIC_VPBROADCASTW Mnemonic = 1316 - MNEMONIC_VPCLMULQDQ Mnemonic = 1317 - MNEMONIC_VPCMOV Mnemonic = 1318 - MNEMONIC_VPCMPB Mnemonic = 1319 - MNEMONIC_VPCMPD Mnemonic = 1320 - MNEMONIC_VPCMPEQB Mnemonic = 1321 - MNEMONIC_VPCMPEQD Mnemonic = 1322 - MNEMONIC_VPCMPEQQ Mnemonic = 1323 - MNEMONIC_VPCMPEQW Mnemonic = 1324 - MNEMONIC_VPCMPESTRI Mnemonic = 1325 - MNEMONIC_VPCMPESTRM Mnemonic = 1326 - MNEMONIC_VPCMPGTB Mnemonic = 1327 - MNEMONIC_VPCMPGTD Mnemonic = 1328 - MNEMONIC_VPCMPGTQ Mnemonic = 1329 - MNEMONIC_VPCMPGTW Mnemonic = 1330 - MNEMONIC_VPCMPISTRI Mnemonic = 1331 - MNEMONIC_VPCMPISTRM Mnemonic = 1332 - MNEMONIC_VPCMPLTD Mnemonic = 1333 - MNEMONIC_VPCMPQ Mnemonic = 1334 - MNEMONIC_VPCMPUB Mnemonic = 1335 - MNEMONIC_VPCMPUD Mnemonic = 1336 - MNEMONIC_VPCMPUQ Mnemonic = 1337 - MNEMONIC_VPCMPUW Mnemonic = 1338 - MNEMONIC_VPCMPW Mnemonic = 1339 - MNEMONIC_VPCOMB Mnemonic = 1340 - MNEMONIC_VPCOMD Mnemonic = 1341 - MNEMONIC_VPCOMPRESSB Mnemonic = 1342 - MNEMONIC_VPCOMPRESSD Mnemonic = 1343 - MNEMONIC_VPCOMPRESSQ Mnemonic = 1344 - MNEMONIC_VPCOMPRESSW Mnemonic = 1345 - MNEMONIC_VPCOMQ Mnemonic = 1346 - MNEMONIC_VPCOMUB Mnemonic = 1347 - MNEMONIC_VPCOMUD Mnemonic = 1348 - MNEMONIC_VPCOMUQ Mnemonic = 1349 - MNEMONIC_VPCOMUW Mnemonic = 1350 - MNEMONIC_VPCOMW Mnemonic = 1351 - MNEMONIC_VPCONFLICTD Mnemonic = 1352 - MNEMONIC_VPCONFLICTQ Mnemonic = 1353 - MNEMONIC_VPDPBSSD Mnemonic = 1354 - MNEMONIC_VPDPBSSDS Mnemonic = 1355 - MNEMONIC_VPDPBSUD Mnemonic = 1356 - MNEMONIC_VPDPBSUDS Mnemonic = 1357 - MNEMONIC_VPDPBUSD Mnemonic = 1358 - MNEMONIC_VPDPBUSDS Mnemonic = 1359 - MNEMONIC_VPDPBUUD Mnemonic = 1360 - MNEMONIC_VPDPBUUDS Mnemonic = 1361 - MNEMONIC_VPDPWSSD Mnemonic = 1362 - MNEMONIC_VPDPWSSDS Mnemonic = 1363 - MNEMONIC_VPDPWSUD Mnemonic = 1364 - MNEMONIC_VPDPWSUDS Mnemonic = 1365 - MNEMONIC_VPDPWUSD Mnemonic = 1366 - MNEMONIC_VPDPWUSDS Mnemonic = 1367 - MNEMONIC_VPDPWUUD Mnemonic = 1368 - MNEMONIC_VPDPWUUDS Mnemonic = 1369 - MNEMONIC_VPERM2F128 Mnemonic = 1370 - MNEMONIC_VPERM2I128 Mnemonic = 1371 - MNEMONIC_VPERMB Mnemonic = 1372 - MNEMONIC_VPERMD Mnemonic = 1373 - MNEMONIC_VPERMF32X4 Mnemonic = 1374 - MNEMONIC_VPERMI2B Mnemonic = 1375 - MNEMONIC_VPERMI2D Mnemonic = 1376 - MNEMONIC_VPERMI2PD Mnemonic = 1377 - MNEMONIC_VPERMI2PS Mnemonic = 1378 - MNEMONIC_VPERMI2Q Mnemonic = 1379 - MNEMONIC_VPERMI2W Mnemonic = 1380 - MNEMONIC_VPERMIL2PD Mnemonic = 1381 - MNEMONIC_VPERMIL2PS Mnemonic = 1382 - MNEMONIC_VPERMILPD Mnemonic = 1383 - MNEMONIC_VPERMILPS Mnemonic = 1384 - MNEMONIC_VPERMPD Mnemonic = 1385 - MNEMONIC_VPERMPS Mnemonic = 1386 - MNEMONIC_VPERMQ Mnemonic = 1387 - MNEMONIC_VPERMT2B Mnemonic = 1388 - MNEMONIC_VPERMT2D Mnemonic = 1389 - MNEMONIC_VPERMT2PD Mnemonic = 1390 - MNEMONIC_VPERMT2PS Mnemonic = 1391 - MNEMONIC_VPERMT2Q Mnemonic = 1392 - MNEMONIC_VPERMT2W Mnemonic = 1393 - MNEMONIC_VPERMW Mnemonic = 1394 - MNEMONIC_VPEXPANDB Mnemonic = 1395 - MNEMONIC_VPEXPANDD Mnemonic = 1396 - MNEMONIC_VPEXPANDQ Mnemonic = 1397 - MNEMONIC_VPEXPANDW Mnemonic = 1398 - MNEMONIC_VPEXTRB Mnemonic = 1399 - MNEMONIC_VPEXTRD Mnemonic = 1400 - MNEMONIC_VPEXTRQ Mnemonic = 1401 - MNEMONIC_VPEXTRW Mnemonic = 1402 - MNEMONIC_VPGATHERDD Mnemonic = 1403 - MNEMONIC_VPGATHERDQ Mnemonic = 1404 - MNEMONIC_VPGATHERQD Mnemonic = 1405 - MNEMONIC_VPGATHERQQ Mnemonic = 1406 - MNEMONIC_VPHADDBD Mnemonic = 1407 - MNEMONIC_VPHADDBQ Mnemonic = 1408 - MNEMONIC_VPHADDBW Mnemonic = 1409 - MNEMONIC_VPHADDD Mnemonic = 1410 - MNEMONIC_VPHADDDQ Mnemonic = 1411 - MNEMONIC_VPHADDSW Mnemonic = 1412 - MNEMONIC_VPHADDUBD Mnemonic = 1413 - MNEMONIC_VPHADDUBQ Mnemonic = 1414 - MNEMONIC_VPHADDUBW Mnemonic = 1415 - MNEMONIC_VPHADDUDQ Mnemonic = 1416 - MNEMONIC_VPHADDUWD Mnemonic = 1417 - MNEMONIC_VPHADDUWQ Mnemonic = 1418 - MNEMONIC_VPHADDW Mnemonic = 1419 - MNEMONIC_VPHADDWD Mnemonic = 1420 - MNEMONIC_VPHADDWQ Mnemonic = 1421 - MNEMONIC_VPHMINPOSUW Mnemonic = 1422 - MNEMONIC_VPHSUBBW Mnemonic = 1423 - MNEMONIC_VPHSUBD Mnemonic = 1424 - MNEMONIC_VPHSUBDQ Mnemonic = 1425 - MNEMONIC_VPHSUBSW Mnemonic = 1426 - MNEMONIC_VPHSUBW Mnemonic = 1427 - MNEMONIC_VPHSUBWD Mnemonic = 1428 - MNEMONIC_VPINSRB Mnemonic = 1429 - MNEMONIC_VPINSRD Mnemonic = 1430 - MNEMONIC_VPINSRQ Mnemonic = 1431 - MNEMONIC_VPINSRW Mnemonic = 1432 - MNEMONIC_VPLZCNTD Mnemonic = 1433 - MNEMONIC_VPLZCNTQ Mnemonic = 1434 - MNEMONIC_VPMACSDD Mnemonic = 1435 - MNEMONIC_VPMACSDQH Mnemonic = 1436 - MNEMONIC_VPMACSDQL Mnemonic = 1437 - MNEMONIC_VPMACSSDD Mnemonic = 1438 - MNEMONIC_VPMACSSDQH Mnemonic = 1439 - MNEMONIC_VPMACSSDQL Mnemonic = 1440 - MNEMONIC_VPMACSSWD Mnemonic = 1441 - MNEMONIC_VPMACSSWW Mnemonic = 1442 - MNEMONIC_VPMACSWD Mnemonic = 1443 - MNEMONIC_VPMACSWW Mnemonic = 1444 - MNEMONIC_VPMADCSSWD Mnemonic = 1445 - MNEMONIC_VPMADCSWD Mnemonic = 1446 - MNEMONIC_VPMADD231D Mnemonic = 1447 - MNEMONIC_VPMADD233D Mnemonic = 1448 - MNEMONIC_VPMADD52HUQ Mnemonic = 1449 - MNEMONIC_VPMADD52LUQ Mnemonic = 1450 - MNEMONIC_VPMADDUBSW Mnemonic = 1451 - MNEMONIC_VPMADDWD Mnemonic = 1452 - MNEMONIC_VPMASKMOVD Mnemonic = 1453 - MNEMONIC_VPMASKMOVQ Mnemonic = 1454 - MNEMONIC_VPMAXSB Mnemonic = 1455 - MNEMONIC_VPMAXSD Mnemonic = 1456 - MNEMONIC_VPMAXSQ Mnemonic = 1457 - MNEMONIC_VPMAXSW Mnemonic = 1458 - MNEMONIC_VPMAXUB Mnemonic = 1459 - MNEMONIC_VPMAXUD Mnemonic = 1460 - MNEMONIC_VPMAXUQ Mnemonic = 1461 - MNEMONIC_VPMAXUW Mnemonic = 1462 - MNEMONIC_VPMINSB Mnemonic = 1463 - MNEMONIC_VPMINSD Mnemonic = 1464 - MNEMONIC_VPMINSQ Mnemonic = 1465 - MNEMONIC_VPMINSW Mnemonic = 1466 - MNEMONIC_VPMINUB Mnemonic = 1467 - MNEMONIC_VPMINUD Mnemonic = 1468 - MNEMONIC_VPMINUQ Mnemonic = 1469 - MNEMONIC_VPMINUW Mnemonic = 1470 - MNEMONIC_VPMOVB2M Mnemonic = 1471 - MNEMONIC_VPMOVD2M Mnemonic = 1472 - MNEMONIC_VPMOVDB Mnemonic = 1473 - MNEMONIC_VPMOVDW Mnemonic = 1474 - MNEMONIC_VPMOVM2B Mnemonic = 1475 - MNEMONIC_VPMOVM2D Mnemonic = 1476 - MNEMONIC_VPMOVM2Q Mnemonic = 1477 - MNEMONIC_VPMOVM2W Mnemonic = 1478 - MNEMONIC_VPMOVMSKB Mnemonic = 1479 - MNEMONIC_VPMOVQ2M Mnemonic = 1480 - MNEMONIC_VPMOVQB Mnemonic = 1481 - MNEMONIC_VPMOVQD Mnemonic = 1482 - MNEMONIC_VPMOVQW Mnemonic = 1483 - MNEMONIC_VPMOVSDB Mnemonic = 1484 - MNEMONIC_VPMOVSDW Mnemonic = 1485 - MNEMONIC_VPMOVSQB Mnemonic = 1486 - MNEMONIC_VPMOVSQD Mnemonic = 1487 - MNEMONIC_VPMOVSQW Mnemonic = 1488 - MNEMONIC_VPMOVSWB Mnemonic = 1489 - MNEMONIC_VPMOVSXBD Mnemonic = 1490 - MNEMONIC_VPMOVSXBQ Mnemonic = 1491 - MNEMONIC_VPMOVSXBW Mnemonic = 1492 - MNEMONIC_VPMOVSXDQ Mnemonic = 1493 - MNEMONIC_VPMOVSXWD Mnemonic = 1494 - MNEMONIC_VPMOVSXWQ Mnemonic = 1495 - MNEMONIC_VPMOVUSDB Mnemonic = 1496 - MNEMONIC_VPMOVUSDW Mnemonic = 1497 - MNEMONIC_VPMOVUSQB Mnemonic = 1498 - MNEMONIC_VPMOVUSQD Mnemonic = 1499 - MNEMONIC_VPMOVUSQW Mnemonic = 1500 - MNEMONIC_VPMOVUSWB Mnemonic = 1501 - MNEMONIC_VPMOVW2M Mnemonic = 1502 - MNEMONIC_VPMOVWB Mnemonic = 1503 - MNEMONIC_VPMOVZXBD Mnemonic = 1504 - MNEMONIC_VPMOVZXBQ Mnemonic = 1505 - MNEMONIC_VPMOVZXBW Mnemonic = 1506 - MNEMONIC_VPMOVZXDQ Mnemonic = 1507 - MNEMONIC_VPMOVZXWD Mnemonic = 1508 - MNEMONIC_VPMOVZXWQ Mnemonic = 1509 - MNEMONIC_VPMULDQ Mnemonic = 1510 - MNEMONIC_VPMULHD Mnemonic = 1511 - MNEMONIC_VPMULHRSW Mnemonic = 1512 - MNEMONIC_VPMULHUD Mnemonic = 1513 - MNEMONIC_VPMULHUW Mnemonic = 1514 - MNEMONIC_VPMULHW Mnemonic = 1515 - MNEMONIC_VPMULLD Mnemonic = 1516 - MNEMONIC_VPMULLQ Mnemonic = 1517 - MNEMONIC_VPMULLW Mnemonic = 1518 - MNEMONIC_VPMULTISHIFTQB Mnemonic = 1519 - MNEMONIC_VPMULUDQ Mnemonic = 1520 - MNEMONIC_VPOPCNTB Mnemonic = 1521 - MNEMONIC_VPOPCNTD Mnemonic = 1522 - MNEMONIC_VPOPCNTQ Mnemonic = 1523 - MNEMONIC_VPOPCNTW Mnemonic = 1524 - MNEMONIC_VPOR Mnemonic = 1525 - MNEMONIC_VPORD Mnemonic = 1526 - MNEMONIC_VPORQ Mnemonic = 1527 - MNEMONIC_VPPERM Mnemonic = 1528 - MNEMONIC_VPREFETCH0 Mnemonic = 1529 - MNEMONIC_VPREFETCH1 Mnemonic = 1530 - MNEMONIC_VPREFETCH2 Mnemonic = 1531 - MNEMONIC_VPREFETCHE0 Mnemonic = 1532 - MNEMONIC_VPREFETCHE1 Mnemonic = 1533 - MNEMONIC_VPREFETCHE2 Mnemonic = 1534 - MNEMONIC_VPREFETCHENTA Mnemonic = 1535 - MNEMONIC_VPREFETCHNTA Mnemonic = 1536 - MNEMONIC_VPROLD Mnemonic = 1537 - MNEMONIC_VPROLQ Mnemonic = 1538 - MNEMONIC_VPROLVD Mnemonic = 1539 - MNEMONIC_VPROLVQ Mnemonic = 1540 - MNEMONIC_VPRORD Mnemonic = 1541 - MNEMONIC_VPRORQ Mnemonic = 1542 - MNEMONIC_VPRORVD Mnemonic = 1543 - MNEMONIC_VPRORVQ Mnemonic = 1544 - MNEMONIC_VPROTB Mnemonic = 1545 - MNEMONIC_VPROTD Mnemonic = 1546 - MNEMONIC_VPROTQ Mnemonic = 1547 - MNEMONIC_VPROTW Mnemonic = 1548 - MNEMONIC_VPSADBW Mnemonic = 1549 - MNEMONIC_VPSBBD Mnemonic = 1550 - MNEMONIC_VPSBBRD Mnemonic = 1551 - MNEMONIC_VPSCATTERDD Mnemonic = 1552 - MNEMONIC_VPSCATTERDQ Mnemonic = 1553 - MNEMONIC_VPSCATTERQD Mnemonic = 1554 - MNEMONIC_VPSCATTERQQ Mnemonic = 1555 - MNEMONIC_VPSHAB Mnemonic = 1556 - MNEMONIC_VPSHAD Mnemonic = 1557 - MNEMONIC_VPSHAQ Mnemonic = 1558 - MNEMONIC_VPSHAW Mnemonic = 1559 - MNEMONIC_VPSHLB Mnemonic = 1560 - MNEMONIC_VPSHLD Mnemonic = 1561 - MNEMONIC_VPSHLDD Mnemonic = 1562 - MNEMONIC_VPSHLDQ Mnemonic = 1563 - MNEMONIC_VPSHLDVD Mnemonic = 1564 - MNEMONIC_VPSHLDVQ Mnemonic = 1565 - MNEMONIC_VPSHLDVW Mnemonic = 1566 - MNEMONIC_VPSHLDW Mnemonic = 1567 - MNEMONIC_VPSHLQ Mnemonic = 1568 - MNEMONIC_VPSHLW Mnemonic = 1569 - MNEMONIC_VPSHRDD Mnemonic = 1570 - MNEMONIC_VPSHRDQ Mnemonic = 1571 - MNEMONIC_VPSHRDVD Mnemonic = 1572 - MNEMONIC_VPSHRDVQ Mnemonic = 1573 - MNEMONIC_VPSHRDVW Mnemonic = 1574 - MNEMONIC_VPSHRDW Mnemonic = 1575 - MNEMONIC_VPSHUFB Mnemonic = 1576 - MNEMONIC_VPSHUFBITQMB Mnemonic = 1577 - MNEMONIC_VPSHUFD Mnemonic = 1578 - MNEMONIC_VPSHUFHW Mnemonic = 1579 - MNEMONIC_VPSHUFLW Mnemonic = 1580 - MNEMONIC_VPSIGNB Mnemonic = 1581 - MNEMONIC_VPSIGND Mnemonic = 1582 - MNEMONIC_VPSIGNW Mnemonic = 1583 - MNEMONIC_VPSLLD Mnemonic = 1584 - MNEMONIC_VPSLLDQ Mnemonic = 1585 - MNEMONIC_VPSLLQ Mnemonic = 1586 - MNEMONIC_VPSLLVD Mnemonic = 1587 - MNEMONIC_VPSLLVQ Mnemonic = 1588 - MNEMONIC_VPSLLVW Mnemonic = 1589 - MNEMONIC_VPSLLW Mnemonic = 1590 - MNEMONIC_VPSRAD Mnemonic = 1591 - MNEMONIC_VPSRAQ Mnemonic = 1592 - MNEMONIC_VPSRAVD Mnemonic = 1593 - MNEMONIC_VPSRAVQ Mnemonic = 1594 - MNEMONIC_VPSRAVW Mnemonic = 1595 - MNEMONIC_VPSRAW Mnemonic = 1596 - MNEMONIC_VPSRLD Mnemonic = 1597 - MNEMONIC_VPSRLDQ Mnemonic = 1598 - MNEMONIC_VPSRLQ Mnemonic = 1599 - MNEMONIC_VPSRLVD Mnemonic = 1600 - MNEMONIC_VPSRLVQ Mnemonic = 1601 - MNEMONIC_VPSRLVW Mnemonic = 1602 - MNEMONIC_VPSRLW Mnemonic = 1603 - MNEMONIC_VPSUBB Mnemonic = 1604 - MNEMONIC_VPSUBD Mnemonic = 1605 - MNEMONIC_VPSUBQ Mnemonic = 1606 - MNEMONIC_VPSUBRD Mnemonic = 1607 - MNEMONIC_VPSUBRSETBD Mnemonic = 1608 - MNEMONIC_VPSUBSB Mnemonic = 1609 - MNEMONIC_VPSUBSETBD Mnemonic = 1610 - MNEMONIC_VPSUBSW Mnemonic = 1611 - MNEMONIC_VPSUBUSB Mnemonic = 1612 - MNEMONIC_VPSUBUSW Mnemonic = 1613 - MNEMONIC_VPSUBW Mnemonic = 1614 - MNEMONIC_VPTERNLOGD Mnemonic = 1615 - MNEMONIC_VPTERNLOGQ Mnemonic = 1616 - MNEMONIC_VPTEST Mnemonic = 1617 - MNEMONIC_VPTESTMB Mnemonic = 1618 - MNEMONIC_VPTESTMD Mnemonic = 1619 - MNEMONIC_VPTESTMQ Mnemonic = 1620 - MNEMONIC_VPTESTMW Mnemonic = 1621 - MNEMONIC_VPTESTNMB Mnemonic = 1622 - MNEMONIC_VPTESTNMD Mnemonic = 1623 - MNEMONIC_VPTESTNMQ Mnemonic = 1624 - MNEMONIC_VPTESTNMW Mnemonic = 1625 - MNEMONIC_VPUNPCKHBW Mnemonic = 1626 - MNEMONIC_VPUNPCKHDQ Mnemonic = 1627 - MNEMONIC_VPUNPCKHQDQ Mnemonic = 1628 - MNEMONIC_VPUNPCKHWD Mnemonic = 1629 - MNEMONIC_VPUNPCKLBW Mnemonic = 1630 - MNEMONIC_VPUNPCKLDQ Mnemonic = 1631 - MNEMONIC_VPUNPCKLQDQ Mnemonic = 1632 - MNEMONIC_VPUNPCKLWD Mnemonic = 1633 - MNEMONIC_VPXOR Mnemonic = 1634 - MNEMONIC_VPXORD Mnemonic = 1635 - MNEMONIC_VPXORQ Mnemonic = 1636 - MNEMONIC_VRANGEPD Mnemonic = 1637 - MNEMONIC_VRANGEPS Mnemonic = 1638 - MNEMONIC_VRANGESD Mnemonic = 1639 - MNEMONIC_VRANGESS Mnemonic = 1640 - MNEMONIC_VRCP14PD Mnemonic = 1641 - MNEMONIC_VRCP14PS Mnemonic = 1642 - MNEMONIC_VRCP14SD Mnemonic = 1643 - MNEMONIC_VRCP14SS Mnemonic = 1644 - MNEMONIC_VRCP23PS Mnemonic = 1645 - MNEMONIC_VRCP28PD Mnemonic = 1646 - MNEMONIC_VRCP28PS Mnemonic = 1647 - MNEMONIC_VRCP28SD Mnemonic = 1648 - MNEMONIC_VRCP28SS Mnemonic = 1649 - MNEMONIC_VRCPPH Mnemonic = 1650 - MNEMONIC_VRCPPS Mnemonic = 1651 - MNEMONIC_VRCPSH Mnemonic = 1652 - MNEMONIC_VRCPSS Mnemonic = 1653 - MNEMONIC_VREDUCEPD Mnemonic = 1654 - MNEMONIC_VREDUCEPH Mnemonic = 1655 - MNEMONIC_VREDUCEPS Mnemonic = 1656 - MNEMONIC_VREDUCESD Mnemonic = 1657 - MNEMONIC_VREDUCESH Mnemonic = 1658 - MNEMONIC_VREDUCESS Mnemonic = 1659 - MNEMONIC_VRNDFXPNTPD Mnemonic = 1660 - MNEMONIC_VRNDFXPNTPS Mnemonic = 1661 - MNEMONIC_VRNDSCALEPD Mnemonic = 1662 - MNEMONIC_VRNDSCALEPH Mnemonic = 1663 - MNEMONIC_VRNDSCALEPS Mnemonic = 1664 - MNEMONIC_VRNDSCALESD Mnemonic = 1665 - MNEMONIC_VRNDSCALESH Mnemonic = 1666 - MNEMONIC_VRNDSCALESS Mnemonic = 1667 - MNEMONIC_VROUNDPD Mnemonic = 1668 - MNEMONIC_VROUNDPS Mnemonic = 1669 - MNEMONIC_VROUNDSD Mnemonic = 1670 - MNEMONIC_VROUNDSS Mnemonic = 1671 - MNEMONIC_VRSQRT14PD Mnemonic = 1672 - MNEMONIC_VRSQRT14PS Mnemonic = 1673 - MNEMONIC_VRSQRT14SD Mnemonic = 1674 - MNEMONIC_VRSQRT14SS Mnemonic = 1675 - MNEMONIC_VRSQRT23PS Mnemonic = 1676 - MNEMONIC_VRSQRT28PD Mnemonic = 1677 - MNEMONIC_VRSQRT28PS Mnemonic = 1678 - MNEMONIC_VRSQRT28SD Mnemonic = 1679 - MNEMONIC_VRSQRT28SS Mnemonic = 1680 - MNEMONIC_VRSQRTPH Mnemonic = 1681 - MNEMONIC_VRSQRTPS Mnemonic = 1682 - MNEMONIC_VRSQRTSH Mnemonic = 1683 - MNEMONIC_VRSQRTSS Mnemonic = 1684 - MNEMONIC_VSCALEFPD Mnemonic = 1685 - MNEMONIC_VSCALEFPH Mnemonic = 1686 - MNEMONIC_VSCALEFPS Mnemonic = 1687 - MNEMONIC_VSCALEFSD Mnemonic = 1688 - MNEMONIC_VSCALEFSH Mnemonic = 1689 - MNEMONIC_VSCALEFSS Mnemonic = 1690 - MNEMONIC_VSCALEPS Mnemonic = 1691 - MNEMONIC_VSCATTERDPD Mnemonic = 1692 - MNEMONIC_VSCATTERDPS Mnemonic = 1693 - MNEMONIC_VSCATTERPF0DPD Mnemonic = 1694 - MNEMONIC_VSCATTERPF0DPS Mnemonic = 1695 - MNEMONIC_VSCATTERPF0HINTDPD Mnemonic = 1696 - MNEMONIC_VSCATTERPF0HINTDPS Mnemonic = 1697 - MNEMONIC_VSCATTERPF0QPD Mnemonic = 1698 - MNEMONIC_VSCATTERPF0QPS Mnemonic = 1699 - MNEMONIC_VSCATTERPF1DPD Mnemonic = 1700 - MNEMONIC_VSCATTERPF1DPS Mnemonic = 1701 - MNEMONIC_VSCATTERPF1QPD Mnemonic = 1702 - MNEMONIC_VSCATTERPF1QPS Mnemonic = 1703 - MNEMONIC_VSCATTERQPD Mnemonic = 1704 - MNEMONIC_VSCATTERQPS Mnemonic = 1705 - MNEMONIC_VSHA512MSG1 Mnemonic = 1706 - MNEMONIC_VSHA512MSG2 Mnemonic = 1707 - MNEMONIC_VSHA512RNDS2 Mnemonic = 1708 - MNEMONIC_VSHUFF32X4 Mnemonic = 1709 - MNEMONIC_VSHUFF64X2 Mnemonic = 1710 - MNEMONIC_VSHUFI32X4 Mnemonic = 1711 - MNEMONIC_VSHUFI64X2 Mnemonic = 1712 - MNEMONIC_VSHUFPD Mnemonic = 1713 - MNEMONIC_VSHUFPS Mnemonic = 1714 - MNEMONIC_VSM3MSG1 Mnemonic = 1715 - MNEMONIC_VSM3MSG2 Mnemonic = 1716 - MNEMONIC_VSM3RNDS2 Mnemonic = 1717 - MNEMONIC_VSM4KEY4 Mnemonic = 1718 - MNEMONIC_VSM4RNDS4 Mnemonic = 1719 - MNEMONIC_VSQRTPD Mnemonic = 1720 - MNEMONIC_VSQRTPH Mnemonic = 1721 - MNEMONIC_VSQRTPS Mnemonic = 1722 - MNEMONIC_VSQRTSD Mnemonic = 1723 - MNEMONIC_VSQRTSH Mnemonic = 1724 - MNEMONIC_VSQRTSS Mnemonic = 1725 - MNEMONIC_VSTMXCSR Mnemonic = 1726 - MNEMONIC_VSUBPD Mnemonic = 1727 - MNEMONIC_VSUBPH Mnemonic = 1728 - MNEMONIC_VSUBPS Mnemonic = 1729 - MNEMONIC_VSUBRPD Mnemonic = 1730 - MNEMONIC_VSUBRPS Mnemonic = 1731 - MNEMONIC_VSUBSD Mnemonic = 1732 - MNEMONIC_VSUBSH Mnemonic = 1733 - MNEMONIC_VSUBSS Mnemonic = 1734 - MNEMONIC_VTESTPD Mnemonic = 1735 - MNEMONIC_VTESTPS Mnemonic = 1736 - MNEMONIC_VUCOMISD Mnemonic = 1737 - MNEMONIC_VUCOMISH Mnemonic = 1738 - MNEMONIC_VUCOMISS Mnemonic = 1739 - MNEMONIC_VUNPCKHPD Mnemonic = 1740 - MNEMONIC_VUNPCKHPS Mnemonic = 1741 - MNEMONIC_VUNPCKLPD Mnemonic = 1742 - MNEMONIC_VUNPCKLPS Mnemonic = 1743 - MNEMONIC_VXORPD Mnemonic = 1744 - MNEMONIC_VXORPS Mnemonic = 1745 - MNEMONIC_VZEROALL Mnemonic = 1746 - MNEMONIC_VZEROUPPER Mnemonic = 1747 - MNEMONIC_WBINVD Mnemonic = 1748 - MNEMONIC_WRFSBASE Mnemonic = 1749 - MNEMONIC_WRGSBASE Mnemonic = 1750 - MNEMONIC_WRMSR Mnemonic = 1751 - MNEMONIC_WRMSRLIST Mnemonic = 1752 - MNEMONIC_WRMSRNS Mnemonic = 1753 - MNEMONIC_WRPKRU Mnemonic = 1754 - MNEMONIC_WRSSD Mnemonic = 1755 - MNEMONIC_WRSSQ Mnemonic = 1756 - MNEMONIC_WRUSSD Mnemonic = 1757 - MNEMONIC_WRUSSQ Mnemonic = 1758 - MNEMONIC_XABORT Mnemonic = 1759 - MNEMONIC_XADD Mnemonic = 1760 - MNEMONIC_XBEGIN Mnemonic = 1761 - MNEMONIC_XCHG Mnemonic = 1762 - MNEMONIC_XCRYPT_CBC Mnemonic = 1763 - MNEMONIC_XCRYPT_CFB Mnemonic = 1764 - MNEMONIC_XCRYPT_CTR Mnemonic = 1765 - MNEMONIC_XCRYPT_ECB Mnemonic = 1766 - MNEMONIC_XCRYPT_OFB Mnemonic = 1767 - MNEMONIC_XEND Mnemonic = 1768 - MNEMONIC_XGETBV Mnemonic = 1769 - MNEMONIC_XLAT Mnemonic = 1770 - MNEMONIC_XOR Mnemonic = 1771 - MNEMONIC_XORPD Mnemonic = 1772 - MNEMONIC_XORPS Mnemonic = 1773 - MNEMONIC_XRESLDTRK Mnemonic = 1774 - MNEMONIC_XRSTOR Mnemonic = 1775 - MNEMONIC_XRSTOR64 Mnemonic = 1776 - MNEMONIC_XRSTORS Mnemonic = 1777 - MNEMONIC_XRSTORS64 Mnemonic = 1778 - MNEMONIC_XSAVE Mnemonic = 1779 - MNEMONIC_XSAVE64 Mnemonic = 1780 - MNEMONIC_XSAVEC Mnemonic = 1781 - MNEMONIC_XSAVEC64 Mnemonic = 1782 - MNEMONIC_XSAVEOPT Mnemonic = 1783 - MNEMONIC_XSAVEOPT64 Mnemonic = 1784 - MNEMONIC_XSAVES Mnemonic = 1785 - MNEMONIC_XSAVES64 Mnemonic = 1786 - MNEMONIC_XSETBV Mnemonic = 1787 - MNEMONIC_XSHA1 Mnemonic = 1788 - MNEMONIC_XSHA256 Mnemonic = 1789 - MNEMONIC_XSTORE Mnemonic = 1790 - MNEMONIC_XSUSLDTRK Mnemonic = 1791 - MNEMONIC_XTEST Mnemonic = 1792 - // Maximum value of this enum. - MNEMONIC_MAX_VALUE Mnemonic = 1792 - // The minimum number of bits required to represent all values of this enum. - MNEMONIC_REQUIRED_BITS Mnemonic = 11 -) - -// Defines the `ZydisMachineMode` enum. -type MachineMode int32 - -const ( - // 64 bit mode. - MACHINE_MODE_LONG_64 MachineMode = 0 - // 32 bit protected mode. - MACHINE_MODE_LONG_COMPAT_32 MachineMode = 1 - // 16 bit protected mode. - MACHINE_MODE_LONG_COMPAT_16 MachineMode = 2 - // 32 bit protected mode. - MACHINE_MODE_LEGACY_32 MachineMode = 3 - // 16 bit protected mode. - MACHINE_MODE_LEGACY_16 MachineMode = 4 - // 16 bit real mode. - MACHINE_MODE_REAL_16 MachineMode = 5 - // Maximum value of this enum. - MACHINE_MODE_MAX_VALUE MachineMode = 5 - // The minimum number of bits required to represent all values of this enum. - MACHINE_MODE_REQUIRED_BITS MachineMode = 3 -) - -// Defines the `ZydisStackWidth` enum. -type StackWidth int32 - -const ( - STACK_WIDTH_16 StackWidth = 0 - STACK_WIDTH_32 StackWidth = 1 - STACK_WIDTH_64 StackWidth = 2 - // Maximum value of this enum. - STACK_WIDTH_MAX_VALUE StackWidth = 2 - // The minimum number of bits required to represent all values of this enum. - STACK_WIDTH_REQUIRED_BITS StackWidth = 2 -) - -// Defines the `ZydisElementType` enum. -type ElementType int32 - -const ( - ELEMENT_TYPE_INVALID ElementType = 0 - // A struct type. - ELEMENT_TYPE_STRUCT ElementType = 1 - // Unsigned integer value. - ELEMENT_TYPE_UINT ElementType = 2 - // Signed integer value. - ELEMENT_TYPE_INT ElementType = 3 - // 16-bit floating point value (`half`). - ELEMENT_TYPE_FLOAT16 ElementType = 4 - // 32-bit floating point value (`single`). - ELEMENT_TYPE_FLOAT32 ElementType = 5 - // 64-bit floating point value (`double`). - ELEMENT_TYPE_FLOAT64 ElementType = 6 - // 80-bit floating point value (`extended`). - ELEMENT_TYPE_FLOAT80 ElementType = 7 - // 16-bit brain floating point value. - ELEMENT_TYPE_BFLOAT16 ElementType = 8 - // Binary coded decimal value. - ELEMENT_TYPE_LONGBCD ElementType = 9 - // A condition code (e.g. used by `CMPPD`, `VCMPPD`, ...). - ELEMENT_TYPE_CC ElementType = 10 - // Maximum value of this enum. - ELEMENT_TYPE_MAX_VALUE ElementType = 10 - // The minimum number of bits required to represent all values of this enum. - ELEMENT_TYPE_REQUIRED_BITS ElementType = 4 -) - -// Defines the `ZydisOperandType` enum. -type OperandType int32 - -const ( - // The operand is not used. - OPERAND_TYPE_UNUSED OperandType = 0 - // The operand is a register operand. - OPERAND_TYPE_REGISTER OperandType = 1 - // The operand is a memory operand. - OPERAND_TYPE_MEMORY OperandType = 2 - // The operand is a pointer operand with a segment:offset lvalue. - OPERAND_TYPE_POINTER OperandType = 3 - // The operand is an immediate operand. - OPERAND_TYPE_IMMEDIATE OperandType = 4 - // Maximum value of this enum. - OPERAND_TYPE_MAX_VALUE OperandType = 4 - // The minimum number of bits required to represent all values of this enum. - OPERAND_TYPE_REQUIRED_BITS OperandType = 3 -) - -// Defines the `ZydisOperandEncoding` enum. -type OperandEncoding int32 - -const ( - OPERAND_ENCODING_NONE OperandEncoding = 0 - OPERAND_ENCODING_MODRM_REG OperandEncoding = 1 - OPERAND_ENCODING_MODRM_RM OperandEncoding = 2 - OPERAND_ENCODING_OPCODE OperandEncoding = 3 - OPERAND_ENCODING_NDSNDD OperandEncoding = 4 - OPERAND_ENCODING_IS4 OperandEncoding = 5 - OPERAND_ENCODING_MASK OperandEncoding = 6 - OPERAND_ENCODING_DISP8 OperandEncoding = 7 - OPERAND_ENCODING_DISP16 OperandEncoding = 8 - OPERAND_ENCODING_DISP32 OperandEncoding = 9 - OPERAND_ENCODING_DISP64 OperandEncoding = 10 - OPERAND_ENCODING_DISP16_32_64 OperandEncoding = 11 - OPERAND_ENCODING_DISP32_32_64 OperandEncoding = 12 - OPERAND_ENCODING_DISP16_32_32 OperandEncoding = 13 - OPERAND_ENCODING_UIMM8 OperandEncoding = 14 - OPERAND_ENCODING_UIMM16 OperandEncoding = 15 - OPERAND_ENCODING_UIMM32 OperandEncoding = 16 - OPERAND_ENCODING_UIMM64 OperandEncoding = 17 - OPERAND_ENCODING_UIMM16_32_64 OperandEncoding = 18 - OPERAND_ENCODING_UIMM32_32_64 OperandEncoding = 19 - OPERAND_ENCODING_UIMM16_32_32 OperandEncoding = 20 - OPERAND_ENCODING_SIMM8 OperandEncoding = 21 - OPERAND_ENCODING_SIMM16 OperandEncoding = 22 - OPERAND_ENCODING_SIMM32 OperandEncoding = 23 - OPERAND_ENCODING_SIMM64 OperandEncoding = 24 - OPERAND_ENCODING_SIMM16_32_64 OperandEncoding = 25 - OPERAND_ENCODING_SIMM32_32_64 OperandEncoding = 26 - OPERAND_ENCODING_SIMM16_32_32 OperandEncoding = 27 - OPERAND_ENCODING_JIMM8 OperandEncoding = 28 - OPERAND_ENCODING_JIMM16 OperandEncoding = 29 - OPERAND_ENCODING_JIMM32 OperandEncoding = 30 - OPERAND_ENCODING_JIMM64 OperandEncoding = 31 - OPERAND_ENCODING_JIMM16_32_64 OperandEncoding = 32 - OPERAND_ENCODING_JIMM32_32_64 OperandEncoding = 33 - OPERAND_ENCODING_JIMM16_32_32 OperandEncoding = 34 - // Maximum value of this enum. - OPERAND_ENCODING_MAX_VALUE OperandEncoding = 34 - // The minimum number of bits required to represent all values of this enum. - OPERAND_ENCODING_REQUIRED_BITS OperandEncoding = 6 -) - -// Defines the `ZydisOperandVisibility` enum. -type OperandVisibility int32 - -const ( - OPERAND_VISIBILITY_INVALID OperandVisibility = 0 - // The operand is explicitly encoded in the instruction. - OPERAND_VISIBILITY_EXPLICIT OperandVisibility = 1 - // The operand is part of the opcode, but listed as an operand. - OPERAND_VISIBILITY_IMPLICIT OperandVisibility = 2 - // The operand is part of the opcode, and not typically listed as an operand. - OPERAND_VISIBILITY_HIDDEN OperandVisibility = 3 - // Maximum value of this enum. - OPERAND_VISIBILITY_MAX_VALUE OperandVisibility = 3 - // The minimum number of bits required to represent all values of this enum. - OPERAND_VISIBILITY_REQUIRED_BITS OperandVisibility = 2 -) - -// Defines the `ZydisOperandAction` enum. -type OperandAction int32 - -const ( - // The operand is read by the instruction. - OPERAND_ACTION_READ OperandAction = 1 - // The operand is written by the instruction (must write). - OPERAND_ACTION_WRITE OperandAction = 2 - // The operand is conditionally read by the instruction. - OPERAND_ACTION_CONDREAD OperandAction = 4 - // The operand is conditionally written by the instruction (may write). - OPERAND_ACTION_CONDWRITE OperandAction = 8 - // The operand is read (must read) and written by the instruction (must write). - OPERAND_ACTION_READWRITE OperandAction = 3 - // The operand is conditionally read (may read) and conditionally written by - // the instruction (may write). - OPERAND_ACTION_CONDREAD_CONDWRITE OperandAction = 12 - // The operand is read (must read) and conditionally written by the - // instruction (may write). - OPERAND_ACTION_READ_CONDWRITE OperandAction = 9 - // The operand is written (must write) and conditionally read by the - // instruction (may read). - OPERAND_ACTION_CONDREAD_WRITE OperandAction = 6 - // Mask combining all reading access flags. - OPERAND_ACTION_MASK_READ OperandAction = 5 - // Mask combining all writing access flags. - OPERAND_ACTION_MASK_WRITE OperandAction = 10 - // The minimum number of bits required to represent all values of this bitset. - OPERAND_ACTION_REQUIRED_BITS OperandAction = 4 -) - -// Defines the `ZydisInstructionEncoding` enum. -type InstructionEncoding int32 - -const ( - // The instruction uses the legacy encoding. - INSTRUCTION_ENCODING_LEGACY InstructionEncoding = 0 - // The instruction uses the AMD 3DNow-encoding. - INSTRUCTION_ENCODING_3DNOW InstructionEncoding = 1 - // The instruction uses the AMD XOP-encoding. - INSTRUCTION_ENCODING_XOP InstructionEncoding = 2 - // The instruction uses the VEX-encoding. - INSTRUCTION_ENCODING_VEX InstructionEncoding = 3 - // The instruction uses the EVEX-encoding. - INSTRUCTION_ENCODING_EVEX InstructionEncoding = 4 - // The instruction uses the MVEX-encoding. - INSTRUCTION_ENCODING_MVEX InstructionEncoding = 5 - // Maximum value of this enum. - INSTRUCTION_ENCODING_MAX_VALUE InstructionEncoding = 5 - // The minimum number of bits required to represent all values of this enum. - INSTRUCTION_ENCODING_REQUIRED_BITS InstructionEncoding = 3 -) - -// Defines the `ZydisOpcodeMap` enum. -type OpcodeMap int32 - -const ( - OPCODE_MAP_DEFAULT OpcodeMap = 0 - OPCODE_MAP_0F OpcodeMap = 1 - OPCODE_MAP_0F38 OpcodeMap = 2 - OPCODE_MAP_0F3A OpcodeMap = 3 - OPCODE_MAP_MAP4 OpcodeMap = 4 - OPCODE_MAP_MAP5 OpcodeMap = 5 - OPCODE_MAP_MAP6 OpcodeMap = 6 - OPCODE_MAP_MAP7 OpcodeMap = 7 - OPCODE_MAP_0F0F OpcodeMap = 8 - OPCODE_MAP_XOP8 OpcodeMap = 9 - OPCODE_MAP_XOP9 OpcodeMap = 10 - OPCODE_MAP_XOPA OpcodeMap = 11 - // Maximum value of this enum. - OPCODE_MAP_MAX_VALUE OpcodeMap = 11 - // The minimum number of bits required to represent all values of this enum. - OPCODE_MAP_REQUIRED_BITS OpcodeMap = 4 -) - -// Defines the `ZydisRegister` enum. -type Register int32 - -const ( - REGISTER_NONE Register = 0 - REGISTER_AL Register = 1 - REGISTER_CL Register = 2 - REGISTER_DL Register = 3 - REGISTER_BL Register = 4 - REGISTER_AH Register = 5 - REGISTER_CH Register = 6 - REGISTER_DH Register = 7 - REGISTER_BH Register = 8 - REGISTER_SPL Register = 9 - REGISTER_BPL Register = 10 - REGISTER_SIL Register = 11 - REGISTER_DIL Register = 12 - REGISTER_R8B Register = 13 - REGISTER_R9B Register = 14 - REGISTER_R10B Register = 15 - REGISTER_R11B Register = 16 - REGISTER_R12B Register = 17 - REGISTER_R13B Register = 18 - REGISTER_R14B Register = 19 - REGISTER_R15B Register = 20 - REGISTER_AX Register = 21 - REGISTER_CX Register = 22 - REGISTER_DX Register = 23 - REGISTER_BX Register = 24 - REGISTER_SP Register = 25 - REGISTER_BP Register = 26 - REGISTER_SI Register = 27 - REGISTER_DI Register = 28 - REGISTER_R8W Register = 29 - REGISTER_R9W Register = 30 - REGISTER_R10W Register = 31 - REGISTER_R11W Register = 32 - REGISTER_R12W Register = 33 - REGISTER_R13W Register = 34 - REGISTER_R14W Register = 35 - REGISTER_R15W Register = 36 - REGISTER_EAX Register = 37 - REGISTER_ECX Register = 38 - REGISTER_EDX Register = 39 - REGISTER_EBX Register = 40 - REGISTER_ESP Register = 41 - REGISTER_EBP Register = 42 - REGISTER_ESI Register = 43 - REGISTER_EDI Register = 44 - REGISTER_R8D Register = 45 - REGISTER_R9D Register = 46 - REGISTER_R10D Register = 47 - REGISTER_R11D Register = 48 - REGISTER_R12D Register = 49 - REGISTER_R13D Register = 50 - REGISTER_R14D Register = 51 - REGISTER_R15D Register = 52 - REGISTER_RAX Register = 53 - REGISTER_RCX Register = 54 - REGISTER_RDX Register = 55 - REGISTER_RBX Register = 56 - REGISTER_RSP Register = 57 - REGISTER_RBP Register = 58 - REGISTER_RSI Register = 59 - REGISTER_RDI Register = 60 - REGISTER_R8 Register = 61 - REGISTER_R9 Register = 62 - REGISTER_R10 Register = 63 - REGISTER_R11 Register = 64 - REGISTER_R12 Register = 65 - REGISTER_R13 Register = 66 - REGISTER_R14 Register = 67 - REGISTER_R15 Register = 68 - REGISTER_ST0 Register = 69 - REGISTER_ST1 Register = 70 - REGISTER_ST2 Register = 71 - REGISTER_ST3 Register = 72 - REGISTER_ST4 Register = 73 - REGISTER_ST5 Register = 74 - REGISTER_ST6 Register = 75 - REGISTER_ST7 Register = 76 - REGISTER_X87CONTROL Register = 77 - REGISTER_X87STATUS Register = 78 - REGISTER_X87TAG Register = 79 - REGISTER_MM0 Register = 80 - REGISTER_MM1 Register = 81 - REGISTER_MM2 Register = 82 - REGISTER_MM3 Register = 83 - REGISTER_MM4 Register = 84 - REGISTER_MM5 Register = 85 - REGISTER_MM6 Register = 86 - REGISTER_MM7 Register = 87 - REGISTER_XMM0 Register = 88 - REGISTER_XMM1 Register = 89 - REGISTER_XMM2 Register = 90 - REGISTER_XMM3 Register = 91 - REGISTER_XMM4 Register = 92 - REGISTER_XMM5 Register = 93 - REGISTER_XMM6 Register = 94 - REGISTER_XMM7 Register = 95 - REGISTER_XMM8 Register = 96 - REGISTER_XMM9 Register = 97 - REGISTER_XMM10 Register = 98 - REGISTER_XMM11 Register = 99 - REGISTER_XMM12 Register = 100 - REGISTER_XMM13 Register = 101 - REGISTER_XMM14 Register = 102 - REGISTER_XMM15 Register = 103 - REGISTER_XMM16 Register = 104 - REGISTER_XMM17 Register = 105 - REGISTER_XMM18 Register = 106 - REGISTER_XMM19 Register = 107 - REGISTER_XMM20 Register = 108 - REGISTER_XMM21 Register = 109 - REGISTER_XMM22 Register = 110 - REGISTER_XMM23 Register = 111 - REGISTER_XMM24 Register = 112 - REGISTER_XMM25 Register = 113 - REGISTER_XMM26 Register = 114 - REGISTER_XMM27 Register = 115 - REGISTER_XMM28 Register = 116 - REGISTER_XMM29 Register = 117 - REGISTER_XMM30 Register = 118 - REGISTER_XMM31 Register = 119 - REGISTER_YMM0 Register = 120 - REGISTER_YMM1 Register = 121 - REGISTER_YMM2 Register = 122 - REGISTER_YMM3 Register = 123 - REGISTER_YMM4 Register = 124 - REGISTER_YMM5 Register = 125 - REGISTER_YMM6 Register = 126 - REGISTER_YMM7 Register = 127 - REGISTER_YMM8 Register = 128 - REGISTER_YMM9 Register = 129 - REGISTER_YMM10 Register = 130 - REGISTER_YMM11 Register = 131 - REGISTER_YMM12 Register = 132 - REGISTER_YMM13 Register = 133 - REGISTER_YMM14 Register = 134 - REGISTER_YMM15 Register = 135 - REGISTER_YMM16 Register = 136 - REGISTER_YMM17 Register = 137 - REGISTER_YMM18 Register = 138 - REGISTER_YMM19 Register = 139 - REGISTER_YMM20 Register = 140 - REGISTER_YMM21 Register = 141 - REGISTER_YMM22 Register = 142 - REGISTER_YMM23 Register = 143 - REGISTER_YMM24 Register = 144 - REGISTER_YMM25 Register = 145 - REGISTER_YMM26 Register = 146 - REGISTER_YMM27 Register = 147 - REGISTER_YMM28 Register = 148 - REGISTER_YMM29 Register = 149 - REGISTER_YMM30 Register = 150 - REGISTER_YMM31 Register = 151 - REGISTER_ZMM0 Register = 152 - REGISTER_ZMM1 Register = 153 - REGISTER_ZMM2 Register = 154 - REGISTER_ZMM3 Register = 155 - REGISTER_ZMM4 Register = 156 - REGISTER_ZMM5 Register = 157 - REGISTER_ZMM6 Register = 158 - REGISTER_ZMM7 Register = 159 - REGISTER_ZMM8 Register = 160 - REGISTER_ZMM9 Register = 161 - REGISTER_ZMM10 Register = 162 - REGISTER_ZMM11 Register = 163 - REGISTER_ZMM12 Register = 164 - REGISTER_ZMM13 Register = 165 - REGISTER_ZMM14 Register = 166 - REGISTER_ZMM15 Register = 167 - REGISTER_ZMM16 Register = 168 - REGISTER_ZMM17 Register = 169 - REGISTER_ZMM18 Register = 170 - REGISTER_ZMM19 Register = 171 - REGISTER_ZMM20 Register = 172 - REGISTER_ZMM21 Register = 173 - REGISTER_ZMM22 Register = 174 - REGISTER_ZMM23 Register = 175 - REGISTER_ZMM24 Register = 176 - REGISTER_ZMM25 Register = 177 - REGISTER_ZMM26 Register = 178 - REGISTER_ZMM27 Register = 179 - REGISTER_ZMM28 Register = 180 - REGISTER_ZMM29 Register = 181 - REGISTER_ZMM30 Register = 182 - REGISTER_ZMM31 Register = 183 - REGISTER_TMM0 Register = 184 - REGISTER_TMM1 Register = 185 - REGISTER_TMM2 Register = 186 - REGISTER_TMM3 Register = 187 - REGISTER_TMM4 Register = 188 - REGISTER_TMM5 Register = 189 - REGISTER_TMM6 Register = 190 - REGISTER_TMM7 Register = 191 - REGISTER_FLAGS Register = 192 - REGISTER_EFLAGS Register = 193 - REGISTER_RFLAGS Register = 194 - REGISTER_IP Register = 195 - REGISTER_EIP Register = 196 - REGISTER_RIP Register = 197 - REGISTER_ES Register = 198 - REGISTER_CS Register = 199 - REGISTER_SS Register = 200 - REGISTER_DS Register = 201 - REGISTER_FS Register = 202 - REGISTER_GS Register = 203 - REGISTER_GDTR Register = 204 - REGISTER_LDTR Register = 205 - REGISTER_IDTR Register = 206 - REGISTER_TR Register = 207 - REGISTER_TR0 Register = 208 - REGISTER_TR1 Register = 209 - REGISTER_TR2 Register = 210 - REGISTER_TR3 Register = 211 - REGISTER_TR4 Register = 212 - REGISTER_TR5 Register = 213 - REGISTER_TR6 Register = 214 - REGISTER_TR7 Register = 215 - REGISTER_CR0 Register = 216 - REGISTER_CR1 Register = 217 - REGISTER_CR2 Register = 218 - REGISTER_CR3 Register = 219 - REGISTER_CR4 Register = 220 - REGISTER_CR5 Register = 221 - REGISTER_CR6 Register = 222 - REGISTER_CR7 Register = 223 - REGISTER_CR8 Register = 224 - REGISTER_CR9 Register = 225 - REGISTER_CR10 Register = 226 - REGISTER_CR11 Register = 227 - REGISTER_CR12 Register = 228 - REGISTER_CR13 Register = 229 - REGISTER_CR14 Register = 230 - REGISTER_CR15 Register = 231 - REGISTER_DR0 Register = 232 - REGISTER_DR1 Register = 233 - REGISTER_DR2 Register = 234 - REGISTER_DR3 Register = 235 - REGISTER_DR4 Register = 236 - REGISTER_DR5 Register = 237 - REGISTER_DR6 Register = 238 - REGISTER_DR7 Register = 239 - REGISTER_DR8 Register = 240 - REGISTER_DR9 Register = 241 - REGISTER_DR10 Register = 242 - REGISTER_DR11 Register = 243 - REGISTER_DR12 Register = 244 - REGISTER_DR13 Register = 245 - REGISTER_DR14 Register = 246 - REGISTER_DR15 Register = 247 - REGISTER_K0 Register = 248 - REGISTER_K1 Register = 249 - REGISTER_K2 Register = 250 - REGISTER_K3 Register = 251 - REGISTER_K4 Register = 252 - REGISTER_K5 Register = 253 - REGISTER_K6 Register = 254 - REGISTER_K7 Register = 255 - REGISTER_BND0 Register = 256 - REGISTER_BND1 Register = 257 - REGISTER_BND2 Register = 258 - REGISTER_BND3 Register = 259 - REGISTER_BNDCFG Register = 260 - REGISTER_BNDSTATUS Register = 261 - REGISTER_MXCSR Register = 262 - REGISTER_PKRU Register = 263 - REGISTER_XCR0 Register = 264 - REGISTER_UIF Register = 265 - // Maximum value of this enum. - REGISTER_MAX_VALUE Register = 265 - // The minimum number of bits required to represent all values of this enum. - REGISTER_REQUIRED_BITS Register = 9 -) - -// Defines the `ZydisRegisterKind` enum. -// Please note that this enum does not contain a matching entry for all values of the -// `ZydisRegister` enum, but only for those registers where it makes sense to logically group them -// for decoding/encoding purposes. -// These are mainly the registers that can be identified by an id within their corresponding -// register-class. -type RegisterKind int32 - -const ( - REGKIND_INVALID RegisterKind = 0 - REGKIND_GPR RegisterKind = 1 - REGKIND_X87 RegisterKind = 2 - REGKIND_MMX RegisterKind = 3 - REGKIND_VR RegisterKind = 4 - REGKIND_TMM RegisterKind = 5 - REGKIND_SEGMENT RegisterKind = 6 - REGKIND_TEST RegisterKind = 7 - REGKIND_CONTROL RegisterKind = 8 - REGKIND_DEBUG RegisterKind = 9 - REGKIND_MASK RegisterKind = 10 - REGKIND_BOUND RegisterKind = 11 - // Maximum value of this enum. - REGKIND_MAX_VALUE RegisterKind = 11 - // The minimum number of bits required to represent all values of this enum. - REGKIND_REQUIRED_BITS RegisterKind = 4 -) - -// Defines the `ZydisRegisterClass` enum. -// Please note that this enum does not contain a matching entry for all values of the -// `ZydisRegister` enum, but only for those registers where it makes sense to logically group them -// for decoding/encoding purposes. -// These are mainly the registers that can be identified by an id within their corresponding -// register-class. The `IP` and `FLAGS` values are exceptions to this rule. -type RegisterClass int32 - -const ( - REGCLASS_INVALID RegisterClass = 0 - // 8-bit general-purpose registers. - REGCLASS_GPR8 RegisterClass = 1 - // 16-bit general-purpose registers. - REGCLASS_GPR16 RegisterClass = 2 - // 32-bit general-purpose registers. - REGCLASS_GPR32 RegisterClass = 3 - // 64-bit general-purpose registers. - REGCLASS_GPR64 RegisterClass = 4 - // Floating point legacy registers. - REGCLASS_X87 RegisterClass = 5 - // Floating point multimedia registers. - REGCLASS_MMX RegisterClass = 6 - // 128-bit vector registers. - REGCLASS_XMM RegisterClass = 7 - // 256-bit vector registers. - REGCLASS_YMM RegisterClass = 8 - // 512-bit vector registers. - REGCLASS_ZMM RegisterClass = 9 - // Matrix registers. - REGCLASS_TMM RegisterClass = 10 - // Matrix registers. - REGCLASS_FLAGS RegisterClass = 11 - // Instruction-pointer registers. - REGCLASS_IP RegisterClass = 12 - // Segment registers. - REGCLASS_SEGMENT RegisterClass = 13 - // Table registers. - REGCLASS_TABLE RegisterClass = 14 - // Test registers. - REGCLASS_TEST RegisterClass = 15 - // Control registers. - REGCLASS_CONTROL RegisterClass = 16 - // Debug registers. - REGCLASS_DEBUG RegisterClass = 17 - // Mask registers. - REGCLASS_MASK RegisterClass = 18 - // Bound registers. - REGCLASS_BOUND RegisterClass = 19 - // Maximum value of this enum. - REGCLASS_MAX_VALUE RegisterClass = 19 - // The minimum number of bits required to represent all values of this enum. - REGCLASS_REQUIRED_BITS RegisterClass = 5 -) - -// Defines the `ZydisMemoryOperandType` enum. -type MemoryOperandType int32 - -const ( - MEMOP_TYPE_INVALID MemoryOperandType = 0 - // Normal memory operand. - MEMOP_TYPE_MEM MemoryOperandType = 1 - // The memory operand is only used for address-generation. No real memory-access is - // caused. - MEMOP_TYPE_AGEN MemoryOperandType = 2 - // A memory operand using `SIB` addressing form, where the index register is not used - // in address calculation and scale is ignored. No real memory-access is caused. - MEMOP_TYPE_MIB MemoryOperandType = 3 - // A vector `SIB` memory addressing operand (`VSIB`). - MEMOP_TYPE_VSIB MemoryOperandType = 4 - // Maximum value of this enum. - MEMOP_TYPE_MAX_VALUE MemoryOperandType = 4 - // The minimum number of bits required to represent all values of this enum. - MEMOP_TYPE_REQUIRED_BITS MemoryOperandType = 3 -) - -// Defines the `ZydisBranchType` enum. -type BranchType int32 - -const ( - // The instruction is not a branch instruction. - BRANCH_TYPE_NONE BranchType = 0 - // The instruction is a short (8-bit) branch instruction. - BRANCH_TYPE_SHORT BranchType = 1 - // The instruction is a near (16-bit or 32-bit) branch instruction. - BRANCH_TYPE_NEAR BranchType = 2 - // The instruction is a far (inter-segment) branch instruction. - BRANCH_TYPE_FAR BranchType = 3 - // Maximum value of this enum. - BRANCH_TYPE_MAX_VALUE BranchType = 3 - // The minimum number of bits required to represent all values of this enum. - BRANCH_TYPE_REQUIRED_BITS BranchType = 2 -) - -// Defines the `ZydisExceptionClass` enum. -type ExceptionClass int32 - -const ( - EXCEPTION_CLASS_NONE ExceptionClass = 0 - EXCEPTION_CLASS_SSE1 ExceptionClass = 1 - EXCEPTION_CLASS_SSE2 ExceptionClass = 2 - EXCEPTION_CLASS_SSE3 ExceptionClass = 3 - EXCEPTION_CLASS_SSE4 ExceptionClass = 4 - EXCEPTION_CLASS_SSE5 ExceptionClass = 5 - EXCEPTION_CLASS_SSE7 ExceptionClass = 6 - EXCEPTION_CLASS_AVX1 ExceptionClass = 7 - EXCEPTION_CLASS_AVX2 ExceptionClass = 8 - EXCEPTION_CLASS_AVX3 ExceptionClass = 9 - EXCEPTION_CLASS_AVX4 ExceptionClass = 10 - EXCEPTION_CLASS_AVX5 ExceptionClass = 11 - EXCEPTION_CLASS_AVX6 ExceptionClass = 12 - EXCEPTION_CLASS_AVX7 ExceptionClass = 13 - EXCEPTION_CLASS_AVX8 ExceptionClass = 14 - EXCEPTION_CLASS_AVX11 ExceptionClass = 15 - EXCEPTION_CLASS_AVX12 ExceptionClass = 16 - EXCEPTION_CLASS_E1 ExceptionClass = 17 - EXCEPTION_CLASS_E1NF ExceptionClass = 18 - EXCEPTION_CLASS_E2 ExceptionClass = 19 - EXCEPTION_CLASS_E2NF ExceptionClass = 20 - EXCEPTION_CLASS_E3 ExceptionClass = 21 - EXCEPTION_CLASS_E3NF ExceptionClass = 22 - EXCEPTION_CLASS_E4 ExceptionClass = 23 - EXCEPTION_CLASS_E4NF ExceptionClass = 24 - EXCEPTION_CLASS_E5 ExceptionClass = 25 - EXCEPTION_CLASS_E5NF ExceptionClass = 26 - EXCEPTION_CLASS_E6 ExceptionClass = 27 - EXCEPTION_CLASS_E6NF ExceptionClass = 28 - EXCEPTION_CLASS_E7NM ExceptionClass = 29 - EXCEPTION_CLASS_E7NM128 ExceptionClass = 30 - EXCEPTION_CLASS_E9NF ExceptionClass = 31 - EXCEPTION_CLASS_E10 ExceptionClass = 32 - EXCEPTION_CLASS_E10NF ExceptionClass = 33 - EXCEPTION_CLASS_E11 ExceptionClass = 34 - EXCEPTION_CLASS_E11NF ExceptionClass = 35 - EXCEPTION_CLASS_E12 ExceptionClass = 36 - EXCEPTION_CLASS_E12NP ExceptionClass = 37 - EXCEPTION_CLASS_K20 ExceptionClass = 38 - EXCEPTION_CLASS_K21 ExceptionClass = 39 - EXCEPTION_CLASS_AMXE1 ExceptionClass = 40 - EXCEPTION_CLASS_AMXE2 ExceptionClass = 41 - EXCEPTION_CLASS_AMXE3 ExceptionClass = 42 - EXCEPTION_CLASS_AMXE4 ExceptionClass = 43 - EXCEPTION_CLASS_AMXE5 ExceptionClass = 44 - EXCEPTION_CLASS_AMXE6 ExceptionClass = 45 - // Maximum value of this enum. - EXCEPTION_CLASS_MAX_VALUE ExceptionClass = 45 - // The minimum number of bits required to represent all values of this enum. - EXCEPTION_CLASS_REQUIRED_BITS ExceptionClass = 6 -) - -// Defines the `ZydisMaskMode` enum. -type MaskMode int32 - -const ( - MASK_MODE_INVALID MaskMode = 0 - // Masking is disabled for the current instruction (`K0` register is used). - MASK_MODE_DISABLED MaskMode = 1 - // The embedded mask register is used as a merge-mask. - MASK_MODE_MERGING MaskMode = 2 - // The embedded mask register is used as a zero-mask. - MASK_MODE_ZEROING MaskMode = 3 - // The embedded mask register is used as a control-mask (element selector). - MASK_MODE_CONTROL MaskMode = 4 - // The embedded mask register is used as a zeroing control-mask (element selector). - MASK_MODE_CONTROL_ZEROING MaskMode = 5 - // Maximum value of this enum. - MASK_MODE_MAX_VALUE MaskMode = 5 - // The minimum number of bits required to represent all values of this enum. - MASK_MODE_REQUIRED_BITS MaskMode = 3 -) - -// Defines the `ZydisBroadcastMode` enum. -type BroadcastMode int32 - -const ( - BROADCAST_MODE_INVALID BroadcastMode = 0 - BROADCAST_MODE_1_TO_2 BroadcastMode = 1 - BROADCAST_MODE_1_TO_4 BroadcastMode = 2 - BROADCAST_MODE_1_TO_8 BroadcastMode = 3 - BROADCAST_MODE_1_TO_16 BroadcastMode = 4 - BROADCAST_MODE_1_TO_32 BroadcastMode = 5 - BROADCAST_MODE_1_TO_64 BroadcastMode = 6 - BROADCAST_MODE_2_TO_4 BroadcastMode = 7 - BROADCAST_MODE_2_TO_8 BroadcastMode = 8 - BROADCAST_MODE_2_TO_16 BroadcastMode = 9 - BROADCAST_MODE_4_TO_8 BroadcastMode = 10 - BROADCAST_MODE_4_TO_16 BroadcastMode = 11 - BROADCAST_MODE_8_TO_16 BroadcastMode = 12 - // Maximum value of this enum. - BROADCAST_MODE_MAX_VALUE BroadcastMode = 12 - // The minimum number of bits required to represent all values of this enum. - BROADCAST_MODE_REQUIRED_BITS BroadcastMode = 4 -) - -// Defines the `ZydisRoundingMode` enum. -type RoundingMode int32 - -const ( - ROUNDING_MODE_INVALID RoundingMode = 0 - // Round to nearest. - ROUNDING_MODE_RN RoundingMode = 1 - // Round down. - ROUNDING_MODE_RD RoundingMode = 2 - // Round up. - ROUNDING_MODE_RU RoundingMode = 3 - // Round towards zero. - ROUNDING_MODE_RZ RoundingMode = 4 - // Maximum value of this enum. - ROUNDING_MODE_MAX_VALUE RoundingMode = 4 - // The minimum number of bits required to represent all values of this enum. - ROUNDING_MODE_REQUIRED_BITS RoundingMode = 3 -) - -// Defines the `ZydisSwizzleMode` enum. -type SwizzleMode int32 - -const ( - SWIZZLE_MODE_INVALID SwizzleMode = 0 - SWIZZLE_MODE_DCBA SwizzleMode = 1 - SWIZZLE_MODE_CDAB SwizzleMode = 2 - SWIZZLE_MODE_BADC SwizzleMode = 3 - SWIZZLE_MODE_DACB SwizzleMode = 4 - SWIZZLE_MODE_AAAA SwizzleMode = 5 - SWIZZLE_MODE_BBBB SwizzleMode = 6 - SWIZZLE_MODE_CCCC SwizzleMode = 7 - SWIZZLE_MODE_DDDD SwizzleMode = 8 - // Maximum value of this enum. - SWIZZLE_MODE_MAX_VALUE SwizzleMode = 8 - // The minimum number of bits required to represent all values of this enum. - SWIZZLE_MODE_REQUIRED_BITS SwizzleMode = 4 -) - -// Defines the `ZydisConversionMode` enum. -type ConversionMode int32 - -const ( - CONVERSION_MODE_INVALID ConversionMode = 0 - CONVERSION_MODE_FLOAT16 ConversionMode = 1 - CONVERSION_MODE_SINT8 ConversionMode = 2 - CONVERSION_MODE_UINT8 ConversionMode = 3 - CONVERSION_MODE_SINT16 ConversionMode = 4 - CONVERSION_MODE_UINT16 ConversionMode = 5 - // Maximum value of this enum. - CONVERSION_MODE_MAX_VALUE ConversionMode = 5 - // The minimum number of bits required to represent all values of this enum. - CONVERSION_MODE_REQUIRED_BITS ConversionMode = 3 -) - -// Defines the `ZydisPrefixType` enum. -type PrefixType int32 - -const ( - // The prefix is ignored by the instruction. - // This applies to all prefixes that are not accepted by the instruction in general or the - // ones that are overwritten by a prefix of the same group closer to the instruction opcode. - PREFIX_TYPE_IGNORED PrefixType = 0 - // The prefix is effectively used by the instruction. - PREFIX_TYPE_EFFECTIVE PrefixType = 1 - // The prefix is used as a mandatory prefix. - // A mandatory prefix is interpreted as an opcode extension and has no further effect on the - // instruction. - PREFIX_TYPE_MANDATORY PrefixType = 2 - // Maximum value of this enum. - PREFIX_TYPE_MAX_VALUE PrefixType = 2 - // The minimum number of bits required to represent all values of this enum. - PREFIX_TYPE_REQUIRED_BITS PrefixType = 2 -) - -// Defines the `ZydisDecoderMode` enum. -type DecoderMode int32 - -const ( - // Enables minimal instruction decoding without semantic analysis. - // This mode provides access to the mnemonic, the instruction-length, the effective - // operand-size, the effective address-width, some attributes (e.g. `ZYDIS_ATTRIB_IS_RELATIVE`) - // and all of the information in the `raw` field of the `ZydisDecodedInstruction` struct. - // Operands, most attributes and other specific information (like `AVX` info) are not - // accessible in this mode. - // This mode is NOT enabled by default. - DECODER_MODE_MINIMAL DecoderMode = 0 - // Enables the `AMD`-branch mode. - // Intel ignores the operand-size override-prefix (`0x66`) for all branches with 32-bit - // immediates and forces the operand-size of the instruction to 64-bit in 64-bit mode. - // In `AMD`-branch mode `0x66` is not ignored and changes the operand-size and the size of the - // immediate to 16-bit. - // This mode is NOT enabled by default. - DECODER_MODE_AMD_BRANCHES DecoderMode = 1 - // Enables `KNC` compatibility-mode. - // `KNC` and `KNL+` chips are sharing opcodes and encodings for some mask-related instructions. - // Enable this mode to use the old `KNC` specifications (different mnemonics, operands, ..). - // This mode is NOT enabled by default. - DECODER_MODE_KNC DecoderMode = 2 - // Enables the `MPX` mode. - // The `MPX` isa-extension reuses (overrides) some of the widenop instruction opcodes. - // This mode is enabled by default. - DECODER_MODE_MPX DecoderMode = 3 - // Enables the `CET` mode. - // The `CET` isa-extension reuses (overrides) some of the widenop instruction opcodes. - // This mode is enabled by default. - DECODER_MODE_CET DecoderMode = 4 - // Enables the `LZCNT` mode. - // The `LZCNT` isa-extension reuses (overrides) some of the widenop instruction opcodes. - // This mode is enabled by default. - DECODER_MODE_LZCNT DecoderMode = 5 - // Enables the `TZCNT` mode. - // The `TZCNT` isa-extension reuses (overrides) some of the widenop instruction opcodes. - // This mode is enabled by default. - DECODER_MODE_TZCNT DecoderMode = 6 - // Enables the `WBNOINVD` mode. - // The `WBINVD` instruction is interpreted as `WBNOINVD` on ICL chips, if a `F3` prefix is - // used. - // This mode is disabled by default. - DECODER_MODE_WBNOINVD DecoderMode = 7 - // Enables the `CLDEMOTE` mode. - // The `CLDEMOTE` isa-extension reuses (overrides) some of the widenop instruction opcodes. - // This mode is enabled by default. - DECODER_MODE_CLDEMOTE DecoderMode = 8 - // Enables the `IPREFETCH` mode. - // The `IPREFETCH` isa-extension reuses (overrides) some of the widenop instruction opcodes. - // This mode is enabled by default. - DECODER_MODE_IPREFETCH DecoderMode = 9 - // Enables the `UD0` compatibility mode. - // Some processors decode the `UD0` instruction without a ModR/M byte. Enable this decoder mode - // to mimic this behavior. - // This mode is disabled by default. - DECODER_MODE_UD0_COMPAT DecoderMode = 10 - // Maximum value of this enum. - DECODER_MODE_MAX_VALUE DecoderMode = 10 - // The minimum number of bits required to represent all values of this enum. - DECODER_MODE_REQUIRED_BITS DecoderMode = 4 -) - -// Defines possible physical instruction encodings as bit flags, so multiple acceptable encodings -// can be specified simultaneously. -type EncodableEncoding int32 - -const ( - ENCODABLE_ENCODING_DEFAULT EncodableEncoding = 0 - ENCODABLE_ENCODING_LEGACY EncodableEncoding = 1 - ENCODABLE_ENCODING_3DNOW EncodableEncoding = 2 - ENCODABLE_ENCODING_XOP EncodableEncoding = 4 - ENCODABLE_ENCODING_VEX EncodableEncoding = 8 - ENCODABLE_ENCODING_EVEX EncodableEncoding = 16 - ENCODABLE_ENCODING_MVEX EncodableEncoding = 32 - // Maximum value of this enum. - ENCODABLE_ENCODING_MAX_VALUE EncodableEncoding = 63 - // The minimum number of bits required to represent all values of this enum. - ENCODABLE_ENCODING_REQUIRED_BITS EncodableEncoding = 6 -) - -// Defines encodable physical/effective sizes of relative immediate operands. See -// `ZydisEncoderRequest.branch_width` for more details. -type BranchWidth int32 - -const ( - BRANCH_WIDTH_NONE BranchWidth = 0 - BRANCH_WIDTH_8 BranchWidth = 1 - BRANCH_WIDTH_16 BranchWidth = 2 - BRANCH_WIDTH_32 BranchWidth = 3 - BRANCH_WIDTH_64 BranchWidth = 4 - // Maximum value of this enum. - BRANCH_WIDTH_MAX_VALUE BranchWidth = 4 - // The minimum number of bits required to represent all values of this enum. - BRANCH_WIDTH_REQUIRED_BITS BranchWidth = 3 -) - -// Defines possible values for address size hints. See `ZydisEncoderRequest` for more information -// about address size hints. -type AddressSizeHint int32 - -const ( - ADDRESS_SIZE_HINT_NONE AddressSizeHint = 0 - ADDRESS_SIZE_HINT_16 AddressSizeHint = 1 - ADDRESS_SIZE_HINT_32 AddressSizeHint = 2 - ADDRESS_SIZE_HINT_64 AddressSizeHint = 3 - // Maximum value of this enum. - ADDRESS_SIZE_HINT_MAX_VALUE AddressSizeHint = 3 - // The minimum number of bits required to represent all values of this enum. - ADDRESS_SIZE_HINT_REQUIRED_BITS AddressSizeHint = 2 -) - -// Defines possible values for operand size hints. See `ZydisEncoderRequest` for more information -// about operand size hints. -type OperandSizeHint int32 - -const ( - OPERAND_SIZE_HINT_NONE OperandSizeHint = 0 - OPERAND_SIZE_HINT_8 OperandSizeHint = 1 - OPERAND_SIZE_HINT_16 OperandSizeHint = 2 - OPERAND_SIZE_HINT_32 OperandSizeHint = 3 - OPERAND_SIZE_HINT_64 OperandSizeHint = 4 - // Maximum value of this enum. - OPERAND_SIZE_HINT_MAX_VALUE OperandSizeHint = 4 - // The minimum number of bits required to represent all values of this enum. - OPERAND_SIZE_HINT_REQUIRED_BITS OperandSizeHint = 3 -) - -// Enum selecting the syntax to format the disassembly in. -type FormatterStyle int32 - -const ( - // Generates `AT - // &T - // `-style disassembly. - FORMATTER_STYLE_ATT FormatterStyle = 0 - // Generates `Intel`-style disassembly. - FORMATTER_STYLE_INTEL FormatterStyle = 1 - // Generates `MASM`-style disassembly that is directly accepted as input for - // the `MASM` assembler. - // The runtime-address is ignored in this mode. - FORMATTER_STYLE_INTEL_MASM FormatterStyle = 2 - // Maximum value of this enum. - FORMATTER_STYLE_MAX_VALUE FormatterStyle = 2 - // The minimum number of bits required to represent all values of this enum. - FORMATTER_STYLE_REQUIRED_BITS FormatterStyle = 2 -) - -// Enum selecting a property of the formatter. -type FormatterProperty int32 - -const ( - // Controls the printing of effective operand-size suffixes (`AT - // &T - // `) or operand-sizes - // of memory operands (`INTEL`). - // Pass `ZYAN_TRUE` as value to force the formatter to always print the size, or `ZYAN_FALSE` - // to only print it if needed. - FORMATTER_PROP_FORCE_SIZE FormatterProperty = 0 - // Controls the printing of segment prefixes. - // Pass `ZYAN_TRUE` as value to force the formatter to always print the segment register of - // memory-operands or `ZYAN_FALSE` to omit implicit `DS`/`SS` segments. - FORMATTER_PROP_FORCE_SEGMENT FormatterProperty = 1 - // Controls the printing of the scale-factor component for memory operands. - // Pass `ZYAN_TRUE` as value to force the formatter to always print the scale-factor component - // of memory operands or `ZYAN_FALSE` to omit the scale factor for values of `1`. - FORMATTER_PROP_FORCE_SCALE_ONE FormatterProperty = 2 - // Controls the printing of branch addresses. - // Pass `ZYAN_TRUE` as value to force the formatter to always print relative branch addresses - // or `ZYAN_FALSE` to use absolute addresses, if a runtime-address different to - // `ZYDIS_RUNTIME_ADDRESS_NONE` was passed. - FORMATTER_PROP_FORCE_RELATIVE_BRANCHES FormatterProperty = 3 - // Controls the printing of `EIP`/`RIP`-relative addresses. - // Pass `ZYAN_TRUE` as value to force the formatter to always print relative addresses for - // `EIP`/`RIP`-relative operands or `ZYAN_FALSE` to use absolute addresses, if a runtime- - // address different to `ZYDIS_RUNTIME_ADDRESS_NONE` was passed. - FORMATTER_PROP_FORCE_RELATIVE_RIPREL FormatterProperty = 4 - // Controls the printing of branch-instructions sizes. - // Pass `ZYAN_TRUE` as value to print the size (`short`, `near`) of branch - // instructions or `ZYAN_FALSE` to hide it. - // Note that the `far`/`l` modifier is always printed. - FORMATTER_PROP_PRINT_BRANCH_SIZE FormatterProperty = 5 - // Controls the printing of instruction prefixes. - // Pass `ZYAN_TRUE` as value to print all instruction-prefixes (even ignored or duplicate - // ones) or `ZYAN_FALSE` to only print prefixes that are effectively used by the instruction. - FORMATTER_PROP_DETAILED_PREFIXES FormatterProperty = 6 - // Controls the base of address values. - FORMATTER_PROP_ADDR_BASE FormatterProperty = 7 - // Controls the signedness of relative addresses. Absolute addresses are - // always unsigned. - FORMATTER_PROP_ADDR_SIGNEDNESS FormatterProperty = 8 - // Controls the padding of absolute address values. - // Pass `ZYDIS_PADDING_DISABLED` to disable padding, `ZYDIS_PADDING_AUTO` to pad all - // addresses to the current address width (hexadecimal only), or any other integer value for - // custom padding. - FORMATTER_PROP_ADDR_PADDING_ABSOLUTE FormatterProperty = 9 - // Controls the padding of relative address values. - // Pass `ZYDIS_PADDING_DISABLED` to disable padding, `ZYDIS_PADDING_AUTO` to pad all - // addresses to the current address width (hexadecimal only), or any other integer value for - // custom padding. - FORMATTER_PROP_ADDR_PADDING_RELATIVE FormatterProperty = 10 - // Controls the base of displacement values. - FORMATTER_PROP_DISP_BASE FormatterProperty = 11 - // Controls the signedness of displacement values. - FORMATTER_PROP_DISP_SIGNEDNESS FormatterProperty = 12 - // Controls the padding of displacement values. - // Pass `ZYDIS_PADDING_DISABLED` to disable padding, or any other integer value for custom - // padding. - FORMATTER_PROP_DISP_PADDING FormatterProperty = 13 - // Controls the base of immediate values. - FORMATTER_PROP_IMM_BASE FormatterProperty = 14 - // Controls the signedness of immediate values. - // Pass `ZYDIS_SIGNEDNESS_AUTO` to automatically choose the most suitable mode based on the - // operands `ZydisDecodedOperand.imm.is_signed` attribute. - FORMATTER_PROP_IMM_SIGNEDNESS FormatterProperty = 15 - // Controls the padding of immediate values. - // Pass `ZYDIS_PADDING_DISABLED` to disable padding, `ZYDIS_PADDING_AUTO` to padd all - // immediates to the operand-width (hexadecimal only), or any other integer value for custom - // padding. - FORMATTER_PROP_IMM_PADDING FormatterProperty = 16 - // Controls the letter-case for prefixes. - // Pass `ZYAN_TRUE` as value to format in uppercase or `ZYAN_FALSE` to format in lowercase. - FORMATTER_PROP_UPPERCASE_PREFIXES FormatterProperty = 17 - // Controls the letter-case for the mnemonic. - // Pass `ZYAN_TRUE` as value to format in uppercase or `ZYAN_FALSE` to format in lowercase. - FORMATTER_PROP_UPPERCASE_MNEMONIC FormatterProperty = 18 - // Controls the letter-case for registers. - // Pass `ZYAN_TRUE` as value to format in uppercase or `ZYAN_FALSE` to format in lowercase. - FORMATTER_PROP_UPPERCASE_REGISTERS FormatterProperty = 19 - // Controls the letter-case for typecasts. - // Pass `ZYAN_TRUE` as value to format in uppercase or `ZYAN_FALSE` to format in lowercase. - FORMATTER_PROP_UPPERCASE_TYPECASTS FormatterProperty = 20 - // Controls the letter-case for decorators. - // Pass `ZYAN_TRUE` as value to format in uppercase or `ZYAN_FALSE` to format in lowercase. - // WARNING: this is currently not implemented (ignored). - FORMATTER_PROP_UPPERCASE_DECORATORS FormatterProperty = 21 - // Controls the prefix for decimal values. - // Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters - // to set a custom prefix, or `ZYAN_NULL` to disable it. - // The string is deep-copied into an internal buffer. - FORMATTER_PROP_DEC_PREFIX FormatterProperty = 22 - // Controls the suffix for decimal values. - // Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters - // to set a custom suffix, or `ZYAN_NULL` to disable it. - // The string is deep-copied into an internal buffer. - FORMATTER_PROP_DEC_SUFFIX FormatterProperty = 23 - // Controls the letter-case of hexadecimal values. - // Pass `ZYAN_TRUE` as value to format in uppercase and `ZYAN_FALSE` to format in lowercase. - // The default value is `ZYAN_TRUE`. - FORMATTER_PROP_HEX_UPPERCASE FormatterProperty = 24 - // Controls whether to prepend hexadecimal values with a leading zero if the first character - // is non-numeric. - // Pass `ZYAN_TRUE` to prepend a leading zero if the first character is non-numeric or - // `ZYAN_FALSE` to disable this functionality. - // The default value is `ZYAN_FALSE`. - FORMATTER_PROP_HEX_FORCE_LEADING_NUMBER FormatterProperty = 25 - // Controls the prefix for hexadecimal values. - // Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters - // to set a custom prefix, or `ZYAN_NULL` to disable it. - // The string is deep-copied into an internal buffer. - FORMATTER_PROP_HEX_PREFIX FormatterProperty = 26 - // Controls the suffix for hexadecimal values. - // Pass a pointer to a null-terminated C-style string with a maximum length of 10 characters - // to set a custom suffix, or `ZYAN_NULL` to disable it. - // The string is deep-copied into an internal buffer. - FORMATTER_PROP_HEX_SUFFIX FormatterProperty = 27 - // Maximum value of this enum. - FORMATTER_PROP_MAX_VALUE FormatterProperty = 27 - // The minimum number of bits required to represent all values of this enum. - FORMATTER_PROP_REQUIRED_BITS FormatterProperty = 5 -) - -// Enum defining different mantissae to be used during formatting. -type NumericBase int32 - -const ( - // Decimal system. - NUMERIC_BASE_DEC NumericBase = 0 - // Hexadecimal system. - NUMERIC_BASE_HEX NumericBase = 1 - // Maximum value of this enum. - NUMERIC_BASE_MAX_VALUE NumericBase = 1 - // The minimum number of bits required to represent all values of this enum. - NUMERIC_BASE_REQUIRED_BITS NumericBase = 1 -) - -// Enum defining the signeness of integers to be used during formatting. -type Signedness int32 - -const ( - // Automatically choose the most suitable mode based on the operands - // ZydisDecodedOperand.imm.is_signed` attribute. - SIGNEDNESS_AUTO Signedness = 0 - // Force signed values. - SIGNEDNESS_SIGNED Signedness = 1 - // Force unsigned values. - SIGNEDNESS_UNSIGNED Signedness = 2 - // Maximum value of this enum. - SIGNEDNESS_MAX_VALUE Signedness = 2 - // The minimum number of bits required to represent all values of this enum. - SIGNEDNESS_REQUIRED_BITS Signedness = 2 -) - -// Enum definining magic values that receive special treatment when used as padding properties -// of the formatter. -type Padding int32 - -const ( - // Disables padding. - PADDING_DISABLED Padding = 0 - // Padds the value to the current stack-width for addresses, or to the - // operand-width for immediate values (hexadecimal only). - PADDING_AUTO Padding = -1 - // Maximum value of this enum. - PADDING_MAX_VALUE Padding = -1 - // The minimum number of bits required to represent all values of this enum. - PADDING_REQUIRED_BITS Padding = 32 -) - -// Enum selecting a formatter function to be replaced with hooks. -// Do NOT change the order of the values this enum or the function fields inside the -// `ZydisFormatter` struct. -type FormatterFunction int32 - -const ( - // This function is invoked before the formatter formats an instruction. - FORMATTER_FUNC_PRE_INSTRUCTION FormatterFunction = 0 - // This function is invoked after the formatter formatted an instruction. - FORMATTER_FUNC_POST_INSTRUCTION FormatterFunction = 1 - // This function refers to the main formatting function. - // Replacing this function allows for complete custom formatting, but indirectly disables all - // other hooks except for `ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION` and - // `ZYDIS_FORMATTER_FUNC_POST_INSTRUCTION`. - FORMATTER_FUNC_FORMAT_INSTRUCTION FormatterFunction = 2 - // This function is invoked before the formatter formats an operand. - FORMATTER_FUNC_PRE_OPERAND FormatterFunction = 3 - // This function is invoked after the formatter formatted an operand. - FORMATTER_FUNC_POST_OPERAND FormatterFunction = 4 - // This function is invoked to format a register operand. - FORMATTER_FUNC_FORMAT_OPERAND_REG FormatterFunction = 5 - // This function is invoked to format a memory operand. - // Replacing this function might indirectly disable some specific calls to the - // `ZYDIS_FORMATTER_FUNC_PRINT_TYPECAST`, `ZYDIS_FORMATTER_FUNC_PRINT_SEGMENT`, - // `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` and `ZYDIS_FORMATTER_FUNC_PRINT_DISP` functions. - FORMATTER_FUNC_FORMAT_OPERAND_MEM FormatterFunction = 6 - // This function is invoked to format a pointer operand. - FORMATTER_FUNC_FORMAT_OPERAND_PTR FormatterFunction = 7 - // This function is invoked to format an immediate operand. - // Replacing this function might indirectly disable some specific calls to the - // `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS`, `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL` and - // `ZYDIS_FORMATTER_FUNC_PRINT_IMM` functions. - FORMATTER_FUNC_FORMAT_OPERAND_IMM FormatterFunction = 8 - // This function is invoked to print the instruction mnemonic. - FORMATTER_FUNC_PRINT_MNEMONIC FormatterFunction = 9 - // This function is invoked to print a register. - FORMATTER_FUNC_PRINT_REGISTER FormatterFunction = 10 - // This function is invoked to print absolute addresses. - // Conditionally invoked, if a runtime-address different to `ZYDIS_RUNTIME_ADDRESS_NONE` was - // passed: - // - `IMM` operands with relative address (e.g. `JMP`, `CALL`, ...) - // - `MEM` operands with `EIP`/`RIP`-relative address (e.g. `MOV RAX, [RIP+0x12345678]`) - // Always invoked for: - // - `MEM` operands with absolute address (e.g. `MOV RAX, [0x12345678]`) - FORMATTER_FUNC_PRINT_ADDRESS_ABS FormatterFunction = 11 - // This function is invoked to print relative addresses. - // Conditionally invoked, if `ZYDIS_RUNTIME_ADDRESS_NONE` was passed as runtime-address: - // - `IMM` operands with relative address (e.g. `JMP`, `CALL`, ...) - FORMATTER_FUNC_PRINT_ADDRESS_REL FormatterFunction = 12 - // This function is invoked to print a memory displacement value. - // If the memory displacement contains an address and a runtime-address different to - // `ZYDIS_RUNTIME_ADDRESS_NONE` was passed, `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` is called - // instead. - FORMATTER_FUNC_PRINT_DISP FormatterFunction = 13 - // This function is invoked to print an immediate value. - // If the immediate contains an address and a runtime-address different to - // `ZYDIS_RUNTIME_ADDRESS_NONE` was passed, `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` is called - // instead. - // If the immediate contains an address and `ZYDIS_RUNTIME_ADDRESS_NONE` was passed as - // runtime-address, `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL` is called instead. - FORMATTER_FUNC_PRINT_IMM FormatterFunction = 14 - // This function is invoked to print the size of a memory operand (`INTEL` only). - FORMATTER_FUNC_PRINT_TYPECAST FormatterFunction = 15 - // This function is invoked to print the segment-register of a memory operand. - FORMATTER_FUNC_PRINT_SEGMENT FormatterFunction = 16 - // This function is invoked to print the instruction prefixes. - FORMATTER_FUNC_PRINT_PREFIXES FormatterFunction = 17 - // This function is invoked after formatting an operand to print a `EVEX`/`MVEX` - // decorator. - FORMATTER_FUNC_PRINT_DECORATOR FormatterFunction = 18 - // Maximum value of this enum. - FORMATTER_FUNC_MAX_VALUE FormatterFunction = 18 - // The minimum number of bits required to represent all values of this enum. - FORMATTER_FUNC_REQUIRED_BITS FormatterFunction = 5 -) - -// Enum of all decorator types. -type Decorator int32 - -const ( - DECORATOR_INVALID Decorator = 0 - // The embedded-mask decorator. - DECORATOR_MASK Decorator = 1 - // The broadcast decorator. - DECORATOR_BC Decorator = 2 - // The rounding-control decorator. - DECORATOR_RC Decorator = 3 - // The suppress-all-exceptions decorator. - DECORATOR_SAE Decorator = 4 - // The register-swizzle decorator. - DECORATOR_SWIZZLE Decorator = 5 - // The conversion decorator. - DECORATOR_CONVERSION Decorator = 6 - // The eviction-hint decorator. - DECORATOR_EH Decorator = 7 - // Maximum value of this enum. - DECORATOR_MAX_VALUE Decorator = 7 - // The minimum number of bits required to represent all values of this enum. - DECORATOR_REQUIRED_BITS Decorator = 3 -) - -// Defines the `ZydisInstructionSegment` struct. -type InstructionSegment int32 - -const ( - INSTR_SEGMENT_NONE InstructionSegment = 0 - // The legacy prefixes (including ignored `REX` prefixes). - INSTR_SEGMENT_PREFIXES InstructionSegment = 1 - // The effective `REX` prefix byte. - INSTR_SEGMENT_REX InstructionSegment = 2 - // The `XOP` prefix bytes. - INSTR_SEGMENT_XOP InstructionSegment = 3 - // The `VEX` prefix bytes. - INSTR_SEGMENT_VEX InstructionSegment = 4 - // The `EVEX` prefix bytes. - INSTR_SEGMENT_EVEX InstructionSegment = 5 - // The `MVEX` prefix bytes. - INSTR_SEGMENT_MVEX InstructionSegment = 6 - // The opcode bytes. - INSTR_SEGMENT_OPCODE InstructionSegment = 7 - // The `ModRM` byte. - INSTR_SEGMENT_MODRM InstructionSegment = 8 - // The `SIB` byte. - INSTR_SEGMENT_SIB InstructionSegment = 9 - // The displacement bytes. - INSTR_SEGMENT_DISPLACEMENT InstructionSegment = 10 - // The immediate bytes. - INSTR_SEGMENT_IMMEDIATE InstructionSegment = 11 - // Maximum value of this enum. - INSTR_SEGMENT_MAX_VALUE InstructionSegment = 11 - // The minimum number of bits required to represent all values of this enum. - INSTR_SEGMENT_REQUIRED_BITS InstructionSegment = 4 -) - -// Defines the `ZydisFeature` enum. -type Feature int32 - -const ( - FEATURE_DECODER Feature = 0 - FEATURE_ENCODER Feature = 1 - FEATURE_FORMATTER Feature = 2 - FEATURE_AVX512 Feature = 3 - FEATURE_KNC Feature = 4 - FEATURE_SEGMENT Feature = 5 - // Maximum value of this enum. - FEATURE_MAX_VALUE Feature = 5 - // The minimum number of bits required to represent all values of this enum. - FEATURE_REQUIRED_BITS Feature = 3 -) - -type ShortString struct { - Raw [9]byte -} -type RegisterContext struct { - // The values stored in the register context. - Values [266]U64 -} -type DecodedOperandReg struct { - // The register value. - Value Register -} -type DecodedOperandMem struct { - // The type of the memory operand. - Type MemoryOperandType - // The segment register. - Segment Register - // The base register. - Base Register - // The index register. - Index Register - // The scale factor. - Scale U8 - Disp DecodedOperandMemDisp_ -} -type DecodedOperandMemDisp_ struct { - // Signals, if the displacement value is used. - HasDisplacement Bool - // The displacement value - Value I64 -} -type DecodedOperandPtr struct { - Segment U16 - Offset U32 -} -type DecodedOperandImm struct { - // Signals, if the immediate value is signed. - IsSigned Bool - // Signals, if the immediate value contains a relative offset. You can use - // `ZydisCalcAbsoluteAddress` to determine the absolute address value. - IsRelative Bool - Value DecodedOperandImmValue_ -} -type DecodedOperandImmValue_ struct { - Raw [1]int64 -} -type DecodedOperand struct { - // The operand-id. - Id U8 - // The visibility of the operand. - Visibility OperandVisibility - // The operand-actions. - Actions OperandActions - // The operand-encoding. - Encoding OperandEncoding - // The logical size of the operand (in bits). - Size U16 - // The element-type. - ElementType ElementType - // The size of a single element. - ElementSize ElementSize - // The number of elements. - ElementCount U16 - Attributes OperandAttributes - // The type of the operand. - Type OperandType - Anon5338_5 -} -type Anon5338_5 struct { - Raw [5]int64 -} -type AccessedFlags struct { - Tested AccessedFlagsMask - Modified AccessedFlagsMask - Set0 AccessedFlagsMask - Set1 AccessedFlagsMask - Undefined AccessedFlagsMask -} -type DecodedInstructionRawRex struct { - // 64-bit operand-size promotion. - W U8 - // Extension of the `ModRM.reg` field. - R U8 - // Extension of the `SIB.index` field. - X U8 - // Extension of the `ModRM.rm`, `SIB.base`, or `opcode.reg` field. - B U8 - // The offset of the effective `REX` byte, relative to the beginning of the - // instruction, in bytes. - // This offset always points to the "effective" `REX` prefix (the one closest to the - // instruction opcode), if multiple `REX` prefixes are present. - // Note that the `REX` byte can be the first byte of the instruction, which would lead - // to an offset of `0`. Please refer to the instruction attributes to check for the - // presence of the `REX` prefix. - Offset U8 -} -type DecodedInstructionRawXop struct { - // Extension of the `ModRM.reg` field (inverted). - R U8 - // Extension of the `SIB.index` field (inverted). - X U8 - // Extension of the `ModRM.rm`, `SIB.base`, or `opcode.reg` field (inverted). - B U8 - // Opcode-map specifier. - MMmmm U8 - // 64-bit operand-size promotion or opcode-extension. - W U8 - // `NDS`/`NDD` (non-destructive-source/destination) register - // specifier (inverted). - Vvvv U8 - // Vector-length specifier. - L U8 - // Compressed legacy prefix. - Pp U8 - // The offset of the first xop byte, relative to the beginning of - // the instruction, in bytes. - Offset U8 -} -type DecodedInstructionRawVex struct { - // Extension of the `ModRM.reg` field (inverted). - R U8 - // Extension of the `SIB.index` field (inverted). - X U8 - // Extension of the `ModRM.rm`, `SIB.base`, or `opcode.reg` field (inverted). - B U8 - // Opcode-map specifier. - MMmmm U8 - // 64-bit operand-size promotion or opcode-extension. - W U8 - // `NDS`/`NDD` (non-destructive-source/destination) register specifier - // (inverted). - Vvvv U8 - // Vector-length specifier. - L U8 - // Compressed legacy prefix. - Pp U8 - // The offset of the first `VEX` byte, relative to the beginning of the instruction, in - // bytes. - Offset U8 - // The size of the `VEX` prefix, in bytes. - Size U8 -} -type DecodedInstructionRawEvex struct { - // Extension of the `ModRM.reg` field (inverted). - R U8 - // Extension of the `SIB.index/vidx` field (inverted). - X U8 - // Extension of the `ModRM.rm` or `SIB.base` field (inverted). - B U8 - // High-16 register specifier modifier (inverted). - R2 U8 - // Opcode-map specifier. - Mmm U8 - // 64-bit operand-size promotion or opcode-extension. - W U8 - // `NDS`/`NDD` (non-destructive-source/destination) register specifier - // (inverted). - Vvvv U8 - // Compressed legacy prefix. - Pp U8 - // Zeroing/Merging. - Z U8 - // Vector-length specifier or rounding-control (most significant bit). - L2 U8 - // Vector-length specifier or rounding-control (least significant bit). - L U8 - // Broadcast/RC/SAE context. - // B U8 - // High-16 `NDS`/`VIDX` register specifier. - V2 U8 - // Embedded opmask register specifier. - Aaa U8 - // The offset of the first evex byte, relative to the beginning of the - // instruction, in bytes. - Offset U8 -} -type DecodedInstructionRawMvex struct { - // Extension of the `ModRM.reg` field (inverted). - R U8 - // Extension of the `SIB.index/vidx` field (inverted). - X U8 - // Extension of the `ModRM.rm` or `SIB.base` field (inverted). - B U8 - // High-16 register specifier modifier (inverted). - R2 U8 - // Opcode-map specifier. - Mmmm U8 - // 64-bit operand-size promotion or opcode-extension. - W U8 - // `NDS`/`NDD` (non-destructive-source/destination) register specifier - // (inverted). - Vvvv U8 - // Compressed legacy prefix. - Pp U8 - // Non-temporal/eviction hint. - E U8 - // Swizzle/broadcast/up-convert/down-convert/static-rounding controls. - Sss U8 - // High-16 `NDS`/`VIDX` register specifier. - V2 U8 - // Embedded opmask register specifier. - Kkk U8 - // The offset of the first mvex byte, relative to the beginning of the - // instruction, in bytes. - Offset U8 -} -type DecodedInstructionAvx struct { - // The `AVX` vector-length. - VectorLength U16 - Mask DecodedInstructionAvxMask_ - Broadcast DecodedInstructionAvxBroadcast_ - Rounding DecodedInstructionAvxRounding_ - Swizzle DecodedInstructionAvxSwizzle_ - Conversion DecodedInstructionAvxConversion_ - // Signals, if the `SAE` (suppress-all-exceptions) functionality is - // enabled for the instruction. - HasSae Bool - // Signals, if the instruction has a memory-eviction-hint (`KNC` only). - HasEvictionHint Bool -} -type DecodedInstructionAvxMask_ struct { - // The masking mode. - Mode MaskMode - // The mask register. - Reg Register -} -type DecodedInstructionAvxBroadcast_ struct { - // Signals, if the broadcast is a static broadcast. - // This is the case for instructions with inbuilt broadcast functionality, which is - // always active and not controlled by the `EVEX/MVEX.RC` bits. - IsStatic Bool - // The `AVX` broadcast-mode. - Mode BroadcastMode -} -type DecodedInstructionAvxRounding_ struct { - // The `AVX` rounding-mode. - Mode RoundingMode -} -type DecodedInstructionAvxSwizzle_ struct { - // The `AVX` register-swizzle mode. - Mode SwizzleMode -} -type DecodedInstructionAvxConversion_ struct { - // The `AVX` data-conversion mode. - Mode ConversionMode -} -type DecodedInstructionMeta struct { - // The instruction category. - Category InstructionCategory - // The ISA-set. - IsaSet ISASet - // The ISA-set extension. - IsaExt ISAExt - // The branch type. - BranchType BranchType - // The exception class. - ExceptionClass ExceptionClass -} -type DecodedInstructionRaw struct { - // The number of legacy prefixes. - PrefixCount U8 - Prefixes [15]DecodedInstructionRawPrefixes_ - Encoding2 InstructionEncoding - Anon6217_5 - Modrm DecodedInstructionModRm_ - Sib DecodedInstructionRawSib_ - Disp DecodedInstructionRawDisp_ - Imm [2]DecodedInstructionRawImm_ -} -type DecodedInstructionRawPrefixes_ struct { - // The prefix type. - Type PrefixType - // The prefix byte. - Value U8 -} -type Anon6217_5 struct { - Raw [15]byte -} -type DecodedInstructionModRm_ struct { - // The addressing mode. - Mod U8 - // Register specifier or opcode-extension. - Reg U8 - // Register specifier or opcode-extension. - Rm U8 - // The offset of the `ModRM` byte, relative to the beginning of the - // instruction, in bytes. - Offset U8 -} -type DecodedInstructionRawSib_ struct { - // The scale factor. - Scale U8 - // The index-register specifier. - Index U8 - // The base-register specifier. - Base U8 - // The offset of the `SIB` byte, relative to the beginning of the - // instruction, in bytes. - Offset U8 -} -type DecodedInstructionRawDisp_ struct { - // The displacement value - Value I64 - // The physical displacement size, in bits. - Size U8 - // The offset of the displacement data, relative to the beginning of the - // instruction, in bytes. - Offset U8 -} -type DecodedInstructionRawImm_ struct { - // Signals, if the immediate value is signed. - IsSigned Bool - // Signals, if the immediate value contains a relative offset. You can use - // `ZydisCalcAbsoluteAddress` to determine the absolute address value. - IsRelative Bool - Value DecodedInstructionRawImmValue_ - // The physical immediate size, in bits. - Size U8 - // The offset of the immediate data, relative to the beginning of the - // instruction, in bytes. - Offset U8 -} -type DecodedInstructionRawImmValue_ struct { - Raw [1]int64 -} -type DecodedInstruction struct { - // The machine mode used to decode this instruction. - MachineMode MachineMode - // The instruction-mnemonic. - Mnemonic Mnemonic - // The length of the decoded instruction. - Length U8 - // The instruction-encoding (`LEGACY`, `3DNOW`, `VEX`, `EVEX`, `XOP`). - Encoding InstructionEncoding - // The opcode-map. - OpcodeMap OpcodeMap - // The instruction-opcode. - Opcode U8 - // The stack width. - StackWidth U8 - // The effective operand width. - OperandWidth U8 - // The effective address width. - AddressWidth U8 - // The number of instruction-operands. - // Explicit and implicit operands are guaranteed to be in the front and ordered as they are - // printed by the formatter in `Intel` mode. No assumptions can be made about the order of - // hidden operands, except that they always located behind the explicit and implicit operands. - OperandCount U8 - // The number of explicit (visible) instruction-operands. - // Explicit and implicit operands are guaranteed to be in the front and ordered as they are - // printed by the formatter in `Intel` mode. - OperandCountVisible U8 - // See - // @ref instruction_attributes. - Attributes InstructionAttributes - // Information about CPU flags accessed by the instruction. - // The bits in the masks correspond to the actual bits in the `FLAGS/EFLAGS/RFLAGS` - // register. See - // @ref decoder_cpu_flags. - CpuFlags *AccessedFlags - // Information about FPU flags accessed by the instruction. - // See - // @ref decoder_fpu_flags. - FpuFlags *AccessedFlags - // Extended info for `AVX` instructions. - Avx DecodedInstructionAvx - // Meta info. - Meta DecodedInstructionMeta - // Detailed info about different instruction-parts like `ModRM`, `SIB` or - // encoding-prefixes. - Raw DecodedInstructionRaw -} -type DecoderContext struct { - // A pointer to the internal instruction definition. - Definition unsafe.Pointer - // Contains the effective operand-size index. - // 0 = 16 bit, 1 = 32 bit, 2 = 64 bit - EoszIndex U8 - // Contains the effective address-size index. - // 0 = 16 bit, 1 = 32 bit, 2 = 64 bit - EaszIndex U8 - VectorUnified Anon6451_5 - RegInfo Anon6467_5 - Evex Anon6504_5 - Mvex Anon6518_5 - // The scale factor for EVEX/MVEX compressed 8-bit displacement values. - Cd8Scale U8 -} -type Anon6451_5 struct { - W U8 - R U8 - X U8 - B U8 - L U8 - Ll U8 - R2 U8 - V2 U8 - Vvvv U8 - Mask U8 -} -type Anon6467_5 struct { - // Signals if the `modrm.mod == 3` or `reg` form is forced for the instruction. - IsModReg Bool - // The final register id for the `reg` encoded register. - IdReg U8 - // The final register id for the `rm` encoded register. - // This value is only set, if a register is encoded in `modrm.rm`. - IdRm U8 - // The final register id for the `ndsndd` (`.vvvv`) encoded register. - IdNdsndd U8 - // The final register id for the base register. - // This value is only set, if a memory operand is encoded in `modrm.rm`. - IdBase U8 - // The final register id for the index register. - // This value is only set, if a memory operand is encoded in `modrm.rm` and the `SIB` byte - // is present. - IdIndex U8 -} -type Anon6504_5 struct { - // The EVEX tuple-type. - TupleType U8 - // The EVEX element-size. - ElementSize U8 -} -type Anon6518_5 struct { - // The MVEX functionality. - Functionality U8 -} -type Decoder struct { - // The machine mode. - MachineMode MachineMode - // The stack width. - StackWidth StackWidth - // The decoder mode bitmap. - DecoderMode U32 -} -type EncoderOperand struct { - // The type of the operand. - Type OperandType - Reg EncoderOperandReg_ - Mem EncoderOperandMem_ - Ptr EncoderOperandPtr_ - Imm EncoderOperandImm_ -} -type EncoderOperandReg_ struct { - // The register value. - Value Register - // Is this 4th operand (`VEX`/`XOP`). Despite its name, `is4` encoding can sometimes be - // applied to 3rd operand instead of 4th. This field is used to resolve such ambiguities. - // For all other operands it should be set to `ZYAN_FALSE`. - Is4 Bool -} -type EncoderOperandMem_ struct { - // The base register. - Base Register - // The index register. - Index Register - // The scale factor. - Scale U8 - // The displacement value. This value is always treated as 64-bit signed integer, so it's - // important to take this into account when specifying absolute addresses. For example - // to specify a 16-bit address 0x8000 in 16-bit mode it should be sign extended to - // `0xFFFFFFFFFFFF8000`. See `address_size_hint` for more information about absolute - // addresses. - Displacement I64 - // Size of this operand in bytes. - Size U16 -} -type EncoderOperandPtr_ struct { - // The segment value. - Segment U16 - // The offset value. - Offset U32 -} -type EncoderOperandImm_ struct { - Raw [1]int64 -} -type EncoderRequest struct { - // The machine mode used to encode this instruction. - MachineMode MachineMode - // This optional field can be used to restrict allowed physical encodings for desired - // instruction. Some mnemonics can be supported by more than one encoding, so this field can - // resolve ambiguities e.g. you can disable `AVX-512` extensions by prohibiting usage of `EVEX` - // prefix and allow only `VEX` variants. - AllowedEncodings EncodableEncoding - // The instruction-mnemonic. - Mnemonic Mnemonic - // A combination of requested encodable prefixes (`ZYDIS_ATTRIB_HAS_*` flags) for desired - // instruction. See `ZYDIS_ENCODABLE_PREFIXES` for list of available prefixes. - Prefixes InstructionAttributes - // Branch type (required for branching instructions only). Use `ZYDIS_BRANCH_TYPE_NONE` to let - // encoder pick size-optimal branch type automatically (`short` and `near` are prioritized over - // `far`). - BranchType BranchType - // Specifies physical size for relative immediate operands. Use `ZYDIS_BRANCH_WIDTH_NONE` to - // let encoder pick size-optimal branch width automatically. For segment:offset `far` branches - // this field applies to physical size of the offset part. For branching instructions without - // relative operands this field affects effective operand size attribute. - BranchWidth BranchWidth - // Optional address size hint used to resolve ambiguities for some instructions. Generally - // encoder deduces address size from `ZydisEncoderOperand` structures that represent - // explicit and implicit operands. This hint resolves conflicts when instruction's hidden - // operands scale with address size attribute. - // This hint is also used for instructions with absolute memory addresses (memory operands with - // displacement and no registers). Since displacement field is a 64-bit signed integer it's not - // possible to determine actual size of the address value in all situations. This hint - // specifies size of the address value provided inside encoder request rather than desired - // address size attribute of encoded instruction. Use `ZYDIS_ADDRESS_SIZE_HINT_NONE` to assume - // address size default for specified machine mode. - AddressSizeHint AddressSizeHint - // Optional operand size hint used to resolve ambiguities for some instructions. Generally - // encoder deduces operand size from `ZydisEncoderOperand` structures that represent - // explicit and implicit operands. This hint resolves conflicts when instruction's hidden - // operands scale with operand size attribute. - OperandSizeHint OperandSizeHint - // The number of instruction-operands. - OperandCount U8 - // Detailed info for all explicit and implicit instruction operands. - Operands [5]EncoderOperand - Evex EncoderRequestEvexFeatures_ - Mvex EncoderRequestMvexFeatures_ -} -type EncoderRequestEvexFeatures_ struct { - // The broadcast-mode. Specify `ZYDIS_BROADCAST_MODE_INVALID` for instructions with - // static broadcast functionality. - Broadcast BroadcastMode - // The rounding-mode. - Rounding RoundingMode - // Signals, if the `SAE` (suppress-all-exceptions) functionality should be enabled for - // the instruction. - Sae Bool - // Signals, if the zeroing-mask functionality should be enabled for the instruction. - // Specify `ZYAN_TRUE` for instructions with forced zeroing mask. - ZeroingMask Bool -} -type EncoderRequestMvexFeatures_ struct { - // The broadcast-mode. - Broadcast BroadcastMode - // The data-conversion mode. - Conversion ConversionMode - // The rounding-mode. - Rounding RoundingMode - // The `AVX` register-swizzle mode. - Swizzle SwizzleMode - // Signals, if the `SAE` (suppress-all-exceptions) functionality is enabled for - // the instruction. - Sae Bool - // Signals, if the instruction has a memory-eviction-hint (`KNC` only). - EvictionHint Bool -} -type Allocator struct { - // The allocate function. - Allocate AllocatorAllocate - // The reallocate function. - Reallocate AllocatorAllocate - // The deallocate function. - Deallocate AllocatorDeallocate -} -type Vector struct { - // The memory allocator. - Allocator *Allocator - // The growth factor. - GrowthFactor U8 - // The shrink threshold. - ShrinkThreshold U8 - // The current number of elements in the vector. - Size USize - // The maximum capacity (number of elements). - Capacity USize - // The size of a single element in bytes. - ElementSize USize - // The element destructor callback. - Destructor MemberProcedure - // The data pointer. - Data unsafe.Pointer -} -type String struct { - // String flags. - Flags StringFlags - // The vector that contains the actual string. - Vector Vector -} -type StringView struct { - // The string data. - // The view internally re-uses the normal string struct to allow casts without any runtime - // overhead. - String String -} -type FormatterToken struct { - // The token type. - Type TokenType - // An offset to the next token, or `0`. - Next U8 -} -type FormatterBuffer struct { - // `ZYAN_TRUE`, if the buffer contains a token stream or `ZYAN_FALSE, if it - // contains a simple string. - IsTokenList Bool - // The remaining capacity of the buffer. - Capacity USize - // The `ZyanString` instance that refers to the literal value of the most - // recently added token. - String String -} -type FormatterContext struct { - // A pointer to the `ZydisDecodedInstruction` struct. - Instruction *DecodedInstruction - // A pointer to the first `ZydisDecodedOperand` struct of the instruction. - Operands *DecodedOperand - // A pointer to the `ZydisDecodedOperand` struct. - Operand *DecodedOperand - // The runtime address of the instruction. - RuntimeAddress U64 - // A pointer to user-defined data. - // This is the value that was previously passed as the `user_data` argument to - // - // @ref ZydisFormatterFormatInstruction - // or - // @ref ZydisFormatterTokenizeOperand. - UserData unsafe.Pointer -} -type Formatter struct { - // The formatter style. - Style FormatterStyle - // The `ZYDIS_FORMATTER_PROP_FORCE_SIZE` property. - ForceMemorySize Bool - // The `ZYDIS_FORMATTER_PROP_FORCE_SEGMENT` property. - ForceMemorySegment Bool - // The `ZYDIS_FORMATTER_PROP_FORCE_SCALE_ONE` property. - ForceMemoryScale Bool - // The `ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_BRANCHES` property. - ForceRelativeBranches Bool - // The `ZYDIS_FORMATTER_PROP_FORCE_RELATIVE_RIPREL` property. - ForceRelativeRiprel Bool - // The `ZYDIS_FORMATTER_PROP_PRINT_BRANCH_SIZE` property. - PrintBranchSize Bool - // The `ZYDIS_FORMATTER_PROP_DETAILED_PREFIXES` property. - DetailedPrefixes Bool - // The `ZYDIS_FORMATTER_PROP_ADDR_BASE` property. - AddrBase NumericBase - // The `ZYDIS_FORMATTER_PROP_ADDR_SIGNEDNESS` property. - AddrSignedness Signedness - // The `ZYDIS_FORMATTER_PROP_ADDR_PADDING_ABSOLUTE` property. - AddrPaddingAbsolute Padding - // The `ZYDIS_FORMATTER_PROP_ADDR_PADDING_RELATIVE` property. - AddrPaddingRelative Padding - // The `ZYDIS_FORMATTER_PROP_DISP_BASE` property. - DispBase NumericBase - // The `ZYDIS_FORMATTER_PROP_DISP_SIGNEDNESS` property. - DispSignedness Signedness - // The `ZYDIS_FORMATTER_PROP_DISP_PADDING` property. - DispPadding Padding - // The `ZYDIS_FORMATTER_PROP_IMM_BASE` property. - ImmBase NumericBase - // The `ZYDIS_FORMATTER_PROP_IMM_SIGNEDNESS` property. - ImmSignedness Signedness - // The `ZYDIS_FORMATTER_PROP_IMM_PADDING` property. - ImmPadding Padding - // The `ZYDIS_FORMATTER_PROP_UPPERCASE_PREFIXES` property. - CasePrefixes I32 - // The `ZYDIS_FORMATTER_PROP_UPPERCASE_MNEMONIC` property. - CaseMnemonic I32 - // The `ZYDIS_FORMATTER_PROP_UPPERCASE_REGISTERS` property. - CaseRegisters I32 - // The `ZYDIS_FORMATTER_PROP_UPPERCASE_TYPECASTS` property. - CaseTypecasts I32 - // The `ZYDIS_FORMATTER_PROP_UPPERCASE_DECORATORS` property. - CaseDecorators I32 - // The `ZYDIS_FORMATTER_PROP_HEX_UPPERCASE` property. - HexUppercase Bool - // The `ZYDIS_FORMATTER_PROP_HEX_FORCE_LEADING_NUMBER` property. - HexForceLeadingNumber Bool - NumberFormat [2][2]Anon11276_5 - // The `ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION` function. - FuncPreInstruction FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_POST_INSTRUCTION` function. - FuncPostInstruction FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_FORMAT_INSTRUCTION` function. - FuncFormatInstruction FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRE_OPERAND` function. - FuncPreOperand FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_POST_OPERAND` function. - FuncPostOperand FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_REG` function. - FuncFormatOperandReg FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_MEM` function. - FuncFormatOperandMem FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_PTR` function. - FuncFormatOperandPtr FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_IMM` function. - FuncFormatOperandImm FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_MNEMONIC function. - FuncPrintMnemonic FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_REGISTER` function. - FuncPrintRegister FormatterRegisterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` function. - FuncPrintAddressAbs FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL` function. - FuncPrintAddressRel FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_DISP` function. - FuncPrintDisp FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_IMM` function. - FuncPrintImm FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_TYPECAST` function. - FuncPrintTypecast FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_SEGMENT` function. - FuncPrintSegment FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_PREFIXES` function. - FuncPrintPrefixes FormatterFunc - // The `ZYDIS_FORMATTER_FUNC_PRINT_DECORATOR` function. - FuncPrintDecorator FormatterDecoratorFunc -} -type Anon11276_5 struct { - // A pointer to the `ZyanStringView` to use as prefix/suffix. - String *StringView - // The `ZyanStringView` to use as prefix/suffix - StringData StringView - // The actual string data. - Buffer [11]byte -} -type InstructionSegments struct { - // The number of logical instruction segments. - Count U8 - Segments [9]Anon11687_5 -} -type Anon11687_5 struct { - // The type of the segment. - Type InstructionSegment - // The offset of the segment relative to the start of the instruction (in bytes). - Offset U8 - // The size of the segment, in bytes. - Size U8 -} -type DisassembledInstruction struct { - // The runtime address that was passed when disassembling the instruction. - RuntimeAddress U64 - // General information about the decoded instruction in machine-readable format. - Info DecodedInstruction - // The operands of the decoded instruction in a machine-readable format. - // The amount of actual operands can be determined by inspecting the corresponding fields - // in the `info` member of this struct. Inspect `operand_count_visible` if you care about - // visible operands (those that are printed by the formatter) or `operand_count` if you're - // also interested in implicit operands (for example the registers implicitly accessed by - // `pushad`). Unused entries are zeroed. - Operands [10]DecodedOperand - // The textual, human-readable representation of the instruction. - // Guaranteed to be zero-terminated. - Text [96]byte -} -type ( - _Int128T = any - _Uint128T = any - __NSConstantString = any - SizeT = uint64 - _BuiltinMsVaList = *byte - _BuiltinVaList = *byte - U8 = uint8 - U16 = uint16 - U32 = uint32 - U64 = uint64 - I8 = int8 - I16 = int16 - I32 = int32 - I64 = int64 - USize = uint64 - ISize = int64 - UPointer = uint64 - IPointer = int64 -) - -// Defines the `ZyanVoidPointer` data-type. -type VoidPointer = unsafe.Pointer - -// Defines the `ZyanConstVoidPointer` data-type. -type ConstVoidPointer = unsafe.Pointer - -// Defines the `ZyanBool` data-type. -// Represents a default boolean data-type where `0` is interpreted as `false` and all other values -// as `true`. -type Bool = U8 - -// Defines the `ZyanTernary` data-type. -// The `ZyanTernary` is a balanced ternary type that uses three truth values indicating `true`, -// `false` and an indeterminate third value. -type Ternary = I8 - -// Defines the `ZyanCharPointer` data-type. -// This type is most often used to represent null-terminated strings aka. C-style strings. -type CharPointer = *byte - -// Defines the `ZyanConstCharPointer` data-type. -// This type is most often used to represent null-terminated strings aka. C-style strings. -type ConstCharPointer = *byte - -// Defines the `ZydisElementSize` datatype. -type ElementSize = U16 - -// Defines the `ZydisOperandActions` data-type. -type OperandActions = U8 - -// Defines the `ZydisInstructionAttributes` data-type. -type InstructionAttributes = U64 - -// Defines the `ZydisRegisterWidth` data-type. -type RegisterWidth = U16 - -// Defines the `ZydisOperandAttributes` data-type. -type OperandAttributes = U8 - -// Defines the `ZydisAccessedFlagsMask` data-type. -type AccessedFlagsMask = U32 - -// Detailed info about the `EVEX` prefix. -// type DecodedInstructionRawEvex = DecodedInstructionRawEvex - -// Defines the `ZyanStatus` data type. -type Status = U32 - -// Defines the `ZyanAllocatorAllocate` function prototype. -// -// @param allocator A pointer to the `ZyanAllocator` instance. -// -// @param p Receives a pointer to the first memory block sufficient to hold an -// array of `n` elements with a size of `element_size`. -// -// @param element_size The size of a single element. -// -// @param n The number of elements to allocate storage for. -// -// @return A zyan status code. -// This prototype is used for the `allocate()` and `reallocate()` functions. -// The result of the `reallocate()` function is undefined, if `p` does not point to a memory block -// previously obtained by `(re-)allocate()`. -type AllocatorAllocate = unsafe.Pointer - -// Defines the `ZyanAllocatorDeallocate` function prototype. -// -// @param allocator A pointer to the `ZyanAllocator` instance. -// -// @param p The pointer obtained from `(re-)allocate()`. -// -// @param element_size The size of a single element. -// -// @param n The number of elements earlier passed to `(re-)allocate()`. -// -// @return A zyan status code. -type AllocatorDeallocate = unsafe.Pointer - -// Defines the `ZyanEqualityComparison` function prototype. -// -// @param left A pointer to the first element. -// -// @param right A pointer to the second element. -// -// @return This function should return `ZYAN_TRUE` if the `left` element equals the `right` one -// or `ZYAN_FALSE`, if not. -type EqualityComparison = unsafe.Pointer - -// Defines the `ZyanComparison` function prototype. -// -// @param left A pointer to the first element. -// -// @param right A pointer to the second element. -// -// @return This function should return values in the following range: -// `left == right -> result == 0` -// `left -// < -// right -> result -// < -// 0` -// `left > right -> result > 0` -type Comparison = unsafe.Pointer - -// Defines the `ZyanMemberProcedure` function prototype. -// -// @param object A pointer to the object. -type MemberProcedure = unsafe.Pointer - -// Defines the `ZyanConstMemberProcedure` function prototype. -// -// @param object A pointer to the object. -type ConstMemberProcedure = unsafe.Pointer - -// Defines the `ZyanMemberFunction` function prototype. -// -// @param object A pointer to the object. -// -// @return A zyan status code. -type MemberFunction = unsafe.Pointer - -// Defines the `ZyanConstMemberFunction` function prototype. -// -// @param object A pointer to the object. -// -// @return A zyan status code. -type ConstMemberFunction = unsafe.Pointer - -// Defines the `ZyanStringFlags` data-type. -type StringFlags = U8 - -// Defines the `ZydisTokenType` data-type. -type TokenType = U8 - -// Defines the `ZydisFormatterTokenConst` data-type. -type FormatterTokenConst = FormatterToken - -// Defines the `ZydisFormatterFunc` function prototype. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param context A pointer to the `ZydisFormatterContext` struct. -// -// @return A zyan status code. -// Returning a status code other than `ZYAN_STATUS_SUCCESS` will immediately cause the formatting -// process to fail (see exceptions below). -// Returning `ZYDIS_STATUS_SKIP_TOKEN` is valid for functions of the following types and will -// instruct the formatter to omit the whole operand: -// - `ZYDIS_FORMATTER_FUNC_PRE_OPERAND` -// - `ZYDIS_FORMATTER_FUNC_POST_OPERAND` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_REG` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_MEM` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_PTR` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_IMM` -// This function prototype is used by functions of the following types: -// - `ZYDIS_FORMATTER_FUNC_PRE_INSTRUCTION` -// - `ZYDIS_FORMATTER_FUNC_POST_INSTRUCTION` -// - `ZYDIS_FORMATTER_FUNC_PRE_OPERAND` -// - `ZYDIS_FORMATTER_FUNC_POST_OPERAND` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_INSTRUCTION` -// - `ZYDIS_FORMATTER_FUNC_PRINT_MNEMONIC` -// - `ZYDIS_FORMATTER_FUNC_PRINT_PREFIXES` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_REG` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_MEM` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_PTR` -// - `ZYDIS_FORMATTER_FUNC_FORMAT_OPERAND_IMM` -// - `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS` -// - `ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_REL` -// - `ZYDIS_FORMATTER_FUNC_PRINT_DISP` -// - `ZYDIS_FORMATTER_FUNC_PRINT_IMM` -// - `ZYDIS_FORMATTER_FUNC_PRINT_TYPECAST` -// - `ZYDIS_FORMATTER_FUNC_PRINT_SEGMENT` -type FormatterFunc = unsafe.Pointer - -// Defines the `ZydisFormatterRegisterFunc` function prototype. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param context A pointer to the `ZydisFormatterContext` struct. -// -// @param reg The register. -// -// @return Returning a status code other than `ZYAN_STATUS_SUCCESS` will immediately cause the -// formatting process to fail. -// This function prototype is used by functions of the following types: -// - `ZYDIS_FORMATTER_FUNC_PRINT_REGISTER`. -type FormatterRegisterFunc = unsafe.Pointer - -// Defines the `ZydisFormatterDecoratorFunc` function prototype. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param context A pointer to the `ZydisFormatterContext` struct. -// -// @param decorator The decorator type. -// -// @return Returning a status code other than `ZYAN_STATUS_SUCCESS` will immediately cause the -// formatting process to fail. -// This function type is used for: -// - `ZYDIS_FORMATTER_FUNC_PRINT_DECORATOR` -type FormatterDecoratorFunc = unsafe.Pointer - -var __imp_ZydisCategoryGetString gengort.PreloadProc - -// Gengo init function. -func init() { - __imp_ZydisCategoryGetString = GengoLibrary.ImportNow("ZydisCategoryGetString") - __imp_ZydisISASetGetString = GengoLibrary.ImportNow("ZydisISASetGetString") - __imp_ZydisISAExtGetString = GengoLibrary.ImportNow("ZydisISAExtGetString") - __imp_ZydisMnemonicGetString = GengoLibrary.ImportNow("ZydisMnemonicGetString") - __imp_ZydisMnemonicGetStringWrapped = GengoLibrary.ImportNow("ZydisMnemonicGetStringWrapped") - __imp_ZydisRegisterEncode = GengoLibrary.ImportNow("ZydisRegisterEncode") - __imp_ZydisRegisterGetId = GengoLibrary.ImportNow("ZydisRegisterGetId") - __imp_ZydisRegisterGetClass = GengoLibrary.ImportNow("ZydisRegisterGetClass") - __imp_ZydisRegisterGetWidth = GengoLibrary.ImportNow("ZydisRegisterGetWidth") - __imp_ZydisRegisterGetLargestEnclosing = GengoLibrary.ImportNow("ZydisRegisterGetLargestEnclosing") - __imp_ZydisRegisterGetString = GengoLibrary.ImportNow("ZydisRegisterGetString") - __imp_ZydisRegisterGetStringWrapped = GengoLibrary.ImportNow("ZydisRegisterGetStringWrapped") - __imp_ZydisRegisterClassGetWidth = GengoLibrary.ImportNow("ZydisRegisterClassGetWidth") - __imp_ZydisDecoderInit = GengoLibrary.ImportNow("ZydisDecoderInit") - __imp_ZydisDecoderEnableMode = GengoLibrary.ImportNow("ZydisDecoderEnableMode") - __imp_ZydisDecoderDecodeFull = GengoLibrary.ImportNow("ZydisDecoderDecodeFull") - __imp_ZydisDecoderDecodeInstruction = GengoLibrary.ImportNow("ZydisDecoderDecodeInstruction") - __imp_ZydisDecoderDecodeOperands = GengoLibrary.ImportNow("ZydisDecoderDecodeOperands") - __imp_ZydisEncoderEncodeInstruction = GengoLibrary.ImportNow("ZydisEncoderEncodeInstruction") - __imp_ZydisEncoderEncodeInstructionAbsolute = GengoLibrary.ImportNow("ZydisEncoderEncodeInstructionAbsolute") - __imp_ZydisEncoderDecodedInstructionToEncoderRequest = GengoLibrary.ImportNow("ZydisEncoderDecodedInstructionToEncoderRequest") - __imp_ZydisEncoderNopFill = GengoLibrary.ImportNow("ZydisEncoderNopFill") - __imp_ZyanAllocatorInit = GengoLibrary.ImportNow("ZyanAllocatorInit") - __imp_ZyanEqualsPointer = GengoLibrary.ImportNow("ZyanEqualsPointer") - __imp_ZyanEqualsBool = GengoLibrary.ImportNow("ZyanEqualsBool") - __imp_ZyanEqualsNumeric8 = GengoLibrary.ImportNow("ZyanEqualsNumeric8") - __imp_ZyanEqualsNumeric16 = GengoLibrary.ImportNow("ZyanEqualsNumeric16") - __imp_ZyanEqualsNumeric32 = GengoLibrary.ImportNow("ZyanEqualsNumeric32") - __imp_ZyanEqualsNumeric64 = GengoLibrary.ImportNow("ZyanEqualsNumeric64") - __imp_ZyanComparePointer = GengoLibrary.ImportNow("ZyanComparePointer") - __imp_ZyanCompareBool = GengoLibrary.ImportNow("ZyanCompareBool") - __imp_ZyanCompareNumeric8 = GengoLibrary.ImportNow("ZyanCompareNumeric8") - __imp_ZyanCompareNumeric16 = GengoLibrary.ImportNow("ZyanCompareNumeric16") - __imp_ZyanCompareNumeric32 = GengoLibrary.ImportNow("ZyanCompareNumeric32") - __imp_ZyanCompareNumeric64 = GengoLibrary.ImportNow("ZyanCompareNumeric64") - __imp_ZyanVectorInitEx = GengoLibrary.ImportNow("ZyanVectorInitEx") - __imp_ZyanVectorInitCustomBuffer = GengoLibrary.ImportNow("ZyanVectorInitCustomBuffer") - __imp_ZyanVectorDestroy = GengoLibrary.ImportNow("ZyanVectorDestroy") - __imp_ZyanVectorDuplicateEx = GengoLibrary.ImportNow("ZyanVectorDuplicateEx") - __imp_ZyanVectorDuplicateCustomBuffer = GengoLibrary.ImportNow("ZyanVectorDuplicateCustomBuffer") - __imp_ZyanVectorGet = GengoLibrary.ImportNow("ZyanVectorGet") - __imp_ZyanVectorGetMutable = GengoLibrary.ImportNow("ZyanVectorGetMutable") - __imp_ZyanVectorGetPointer = GengoLibrary.ImportNow("ZyanVectorGetPointer") - __imp_ZyanVectorGetPointerMutable = GengoLibrary.ImportNow("ZyanVectorGetPointerMutable") - __imp_ZyanVectorSet = GengoLibrary.ImportNow("ZyanVectorSet") - __imp_ZyanVectorPushBack = GengoLibrary.ImportNow("ZyanVectorPushBack") - __imp_ZyanVectorInsert = GengoLibrary.ImportNow("ZyanVectorInsert") - __imp_ZyanVectorInsertRange = GengoLibrary.ImportNow("ZyanVectorInsertRange") - __imp_ZyanVectorEmplace = GengoLibrary.ImportNow("ZyanVectorEmplace") - __imp_ZyanVectorEmplaceEx = GengoLibrary.ImportNow("ZyanVectorEmplaceEx") - __imp_ZyanVectorSwapElements = GengoLibrary.ImportNow("ZyanVectorSwapElements") - __imp_ZyanVectorDelete = GengoLibrary.ImportNow("ZyanVectorDelete") - __imp_ZyanVectorDeleteRange = GengoLibrary.ImportNow("ZyanVectorDeleteRange") - __imp_ZyanVectorPopBack = GengoLibrary.ImportNow("ZyanVectorPopBack") - __imp_ZyanVectorClear = GengoLibrary.ImportNow("ZyanVectorClear") - __imp_ZyanVectorFind = GengoLibrary.ImportNow("ZyanVectorFind") - __imp_ZyanVectorFindEx = GengoLibrary.ImportNow("ZyanVectorFindEx") - __imp_ZyanVectorBinarySearch = GengoLibrary.ImportNow("ZyanVectorBinarySearch") - __imp_ZyanVectorBinarySearchEx = GengoLibrary.ImportNow("ZyanVectorBinarySearchEx") - __imp_ZyanVectorResize = GengoLibrary.ImportNow("ZyanVectorResize") - __imp_ZyanVectorResizeEx = GengoLibrary.ImportNow("ZyanVectorResizeEx") - __imp_ZyanVectorReserve = GengoLibrary.ImportNow("ZyanVectorReserve") - __imp_ZyanVectorShrinkToFit = GengoLibrary.ImportNow("ZyanVectorShrinkToFit") - __imp_ZyanVectorGetCapacity = GengoLibrary.ImportNow("ZyanVectorGetCapacity") - __imp_ZyanVectorGetSize = GengoLibrary.ImportNow("ZyanVectorGetSize") - __imp_ZyanStringInitEx = GengoLibrary.ImportNow("ZyanStringInitEx") - __imp_ZyanStringInitCustomBuffer = GengoLibrary.ImportNow("ZyanStringInitCustomBuffer") - __imp_ZyanStringDestroy = GengoLibrary.ImportNow("ZyanStringDestroy") - __imp_ZyanStringDuplicateEx = GengoLibrary.ImportNow("ZyanStringDuplicateEx") - __imp_ZyanStringDuplicateCustomBuffer = GengoLibrary.ImportNow("ZyanStringDuplicateCustomBuffer") - __imp_ZyanStringConcatEx = GengoLibrary.ImportNow("ZyanStringConcatEx") - __imp_ZyanStringConcatCustomBuffer = GengoLibrary.ImportNow("ZyanStringConcatCustomBuffer") - __imp_ZyanStringViewInsideView = GengoLibrary.ImportNow("ZyanStringViewInsideView") - __imp_ZyanStringViewInsideViewEx = GengoLibrary.ImportNow("ZyanStringViewInsideViewEx") - __imp_ZyanStringViewInsideBuffer = GengoLibrary.ImportNow("ZyanStringViewInsideBuffer") - __imp_ZyanStringViewInsideBufferEx = GengoLibrary.ImportNow("ZyanStringViewInsideBufferEx") - __imp_ZyanStringViewGetSize = GengoLibrary.ImportNow("ZyanStringViewGetSize") - __imp_ZyanStringViewGetData = GengoLibrary.ImportNow("ZyanStringViewGetData") - __imp_ZyanStringGetChar = GengoLibrary.ImportNow("ZyanStringGetChar") - __imp_ZyanStringGetCharMutable = GengoLibrary.ImportNow("ZyanStringGetCharMutable") - __imp_ZyanStringSetChar = GengoLibrary.ImportNow("ZyanStringSetChar") - __imp_ZyanStringInsert = GengoLibrary.ImportNow("ZyanStringInsert") - __imp_ZyanStringInsertEx = GengoLibrary.ImportNow("ZyanStringInsertEx") - __imp_ZyanStringAppend = GengoLibrary.ImportNow("ZyanStringAppend") - __imp_ZyanStringAppendEx = GengoLibrary.ImportNow("ZyanStringAppendEx") - __imp_ZyanStringDelete = GengoLibrary.ImportNow("ZyanStringDelete") - __imp_ZyanStringTruncate = GengoLibrary.ImportNow("ZyanStringTruncate") - __imp_ZyanStringClear = GengoLibrary.ImportNow("ZyanStringClear") - __imp_ZyanStringLPos = GengoLibrary.ImportNow("ZyanStringLPos") - __imp_ZyanStringLPosEx = GengoLibrary.ImportNow("ZyanStringLPosEx") - __imp_ZyanStringLPosI = GengoLibrary.ImportNow("ZyanStringLPosI") - __imp_ZyanStringLPosIEx = GengoLibrary.ImportNow("ZyanStringLPosIEx") - __imp_ZyanStringRPos = GengoLibrary.ImportNow("ZyanStringRPos") - __imp_ZyanStringRPosEx = GengoLibrary.ImportNow("ZyanStringRPosEx") - __imp_ZyanStringRPosI = GengoLibrary.ImportNow("ZyanStringRPosI") - __imp_ZyanStringRPosIEx = GengoLibrary.ImportNow("ZyanStringRPosIEx") - __imp_ZyanStringCompare = GengoLibrary.ImportNow("ZyanStringCompare") - __imp_ZyanStringCompareI = GengoLibrary.ImportNow("ZyanStringCompareI") - __imp_ZyanStringToLowerCase = GengoLibrary.ImportNow("ZyanStringToLowerCase") - __imp_ZyanStringToLowerCaseEx = GengoLibrary.ImportNow("ZyanStringToLowerCaseEx") - __imp_ZyanStringToUpperCase = GengoLibrary.ImportNow("ZyanStringToUpperCase") - __imp_ZyanStringToUpperCaseEx = GengoLibrary.ImportNow("ZyanStringToUpperCaseEx") - __imp_ZyanStringResize = GengoLibrary.ImportNow("ZyanStringResize") - __imp_ZyanStringReserve = GengoLibrary.ImportNow("ZyanStringReserve") - __imp_ZyanStringShrinkToFit = GengoLibrary.ImportNow("ZyanStringShrinkToFit") - __imp_ZyanStringGetCapacity = GengoLibrary.ImportNow("ZyanStringGetCapacity") - __imp_ZyanStringGetSize = GengoLibrary.ImportNow("ZyanStringGetSize") - __imp_ZyanStringGetData = GengoLibrary.ImportNow("ZyanStringGetData") - __imp_ZydisFormatterTokenGetValue = GengoLibrary.ImportNow("ZydisFormatterTokenGetValue") - __imp_ZydisFormatterTokenNext = GengoLibrary.ImportNow("ZydisFormatterTokenNext") - __imp_ZydisFormatterBufferGetToken = GengoLibrary.ImportNow("ZydisFormatterBufferGetToken") - __imp_ZydisFormatterBufferGetString = GengoLibrary.ImportNow("ZydisFormatterBufferGetString") - __imp_ZydisFormatterBufferAppend = GengoLibrary.ImportNow("ZydisFormatterBufferAppend") - __imp_ZydisFormatterBufferRemember = GengoLibrary.ImportNow("ZydisFormatterBufferRemember") - __imp_ZydisFormatterBufferRestore = GengoLibrary.ImportNow("ZydisFormatterBufferRestore") - __imp_ZydisFormatterInit = GengoLibrary.ImportNow("ZydisFormatterInit") - __imp_ZydisFormatterSetProperty = GengoLibrary.ImportNow("ZydisFormatterSetProperty") - __imp_ZydisFormatterSetHook = GengoLibrary.ImportNow("ZydisFormatterSetHook") - __imp_ZydisFormatterFormatInstruction = GengoLibrary.ImportNow("ZydisFormatterFormatInstruction") - __imp_ZydisFormatterFormatOperand = GengoLibrary.ImportNow("ZydisFormatterFormatOperand") - __imp_ZydisFormatterTokenizeInstruction = GengoLibrary.ImportNow("ZydisFormatterTokenizeInstruction") - __imp_ZydisFormatterTokenizeOperand = GengoLibrary.ImportNow("ZydisFormatterTokenizeOperand") - __imp_ZydisGetInstructionSegments = GengoLibrary.ImportNow("ZydisGetInstructionSegments") - __imp_ZydisDisassembleIntel = GengoLibrary.ImportNow("ZydisDisassembleIntel") - __imp_ZydisDisassembleATT = GengoLibrary.ImportNow("ZydisDisassembleATT") - __imp_ZydisCalcAbsoluteAddress = GengoLibrary.ImportNow("ZydisCalcAbsoluteAddress") - __imp_ZydisCalcAbsoluteAddressEx = GengoLibrary.ImportNow("ZydisCalcAbsoluteAddressEx") - __imp_ZydisGetVersion = GengoLibrary.ImportNow("ZydisGetVersion") - __imp_ZydisIsFeatureEnabled = GengoLibrary.ImportNow("ZydisIsFeatureEnabled") - gengort.Validate((*ShortString)(nil), 0x9, 0x1) - gengort.Validate((*RegisterContext)(nil), 0x850, 0x8, "Values", 0x0) - gengort.Validate((*DecodedOperandReg)(nil), 0x4, 0x4, "Value", 0x0) - gengort.Validate((*DecodedOperandMem)(nil), 0x28, 0x8, "Type", 0x0, "Segment", 0x4, "Base", 0x8, "Index", 0xc, "Scale", 0x10, "Disp", 0x18) - gengort.Validate((*DecodedOperandMemDisp_)(nil), 0x10, 0x8, "HasDisplacement", 0x0, "Value", 0x8) - gengort.Validate((*DecodedOperandPtr)(nil), 0x8, 0x4, "Segment", 0x0, "Offset", 0x4) - gengort.Validate((*DecodedOperandImm)(nil), 0x10, 0x8, "IsSigned", 0x0, "IsRelative", 0x1, "Value", 0x8) - gengort.Validate((*DecodedOperandImmValue_)(nil), 0x8, 0x8) - gengort.Validate((*DecodedOperand)(nil), 0x50, 0x8, "Id", 0x0, "Visibility", 0x4, "Actions", 0x8, "Encoding", 0xc, "Size", 0x10, "ElementType", 0x14, "ElementSize", 0x18, "ElementCount", 0x1a, "Attributes", 0x1c, "Type", 0x20) - gengort.Validate((*Anon5338_5)(nil), 0x28, 0x8) - gengort.Validate((*AccessedFlags)(nil), 0x14, 0x4, "Tested", 0x0, "Modified", 0x4, "Set0", 0x8, "Set1", 0xc, "Undefined", 0x10) - gengort.Validate((*DecodedInstructionRawRex)(nil), 0x5, 0x1, "W", 0x0, "R", 0x1, "X", 0x2, "B", 0x3, "Offset", 0x4) - gengort.Validate((*DecodedInstructionRawXop)(nil), 0x9, 0x1, "R", 0x0, "X", 0x1, "B", 0x2, "MMmmm", 0x3, "W", 0x4, "Vvvv", 0x5, "L", 0x6, "Pp", 0x7, "Offset", 0x8) - gengort.Validate((*DecodedInstructionRawVex)(nil), 0xa, 0x1, "R", 0x0, "X", 0x1, "B", 0x2, "MMmmm", 0x3, "W", 0x4, "Vvvv", 0x5, "L", 0x6, "Pp", 0x7, "Offset", 0x8, "Size", 0x9) - gengort.Validate((*DecodedInstructionRawEvex)(nil), 0xf, 0x1, "R", 0x0, "X", 0x1, "B", 0x2, "R2", 0x3, "Mmm", 0x4, "W", 0x5, "Vvvv", 0x6, "Pp", 0x7, "Z", 0x8, "L2", 0x9, "L", 0xa, "B", 0xb, "V2", 0xc, "Aaa", 0xd, "Offset", 0xe) - gengort.Validate((*DecodedInstructionRawMvex)(nil), 0xd, 0x1, "R", 0x0, "X", 0x1, "B", 0x2, "R2", 0x3, "Mmmm", 0x4, "W", 0x5, "Vvvv", 0x6, "Pp", 0x7, "E", 0x8, "Sss", 0x9, "V2", 0xa, "Kkk", 0xb, "Offset", 0xc) - gengort.Validate((*DecodedInstructionAvx)(nil), 0x24, 0x4, "VectorLength", 0x0, "Mask", 0x4, "Broadcast", 0xc, "Rounding", 0x14, "Swizzle", 0x18, "Conversion", 0x1c, "HasSae", 0x20, "HasEvictionHint", 0x21) - gengort.Validate((*DecodedInstructionAvxMask_)(nil), 0x8, 0x4, "Mode", 0x0, "Reg", 0x4) - gengort.Validate((*DecodedInstructionAvxBroadcast_)(nil), 0x8, 0x4, "IsStatic", 0x0, "Mode", 0x4) - gengort.Validate((*DecodedInstructionAvxRounding_)(nil), 0x4, 0x4, "Mode", 0x0) - gengort.Validate((*DecodedInstructionAvxSwizzle_)(nil), 0x4, 0x4, "Mode", 0x0) - gengort.Validate((*DecodedInstructionAvxConversion_)(nil), 0x4, 0x4, "Mode", 0x0) - gengort.Validate((*DecodedInstructionMeta)(nil), 0x14, 0x4, "Category", 0x0, "IsaSet", 0x4, "IsaExt", 0x8, "BranchType", 0xc, "ExceptionClass", 0x10) - gengort.Validate((*DecodedInstructionRaw)(nil), 0xd8, 0x8, "PrefixCount", 0x0, "Prefixes", 0x4, "Encoding2", 0x7c, "Modrm", 0x8f, "Sib", 0x93, "Disp", 0x98, "Imm", 0xa8) - gengort.Validate((*DecodedInstructionRawPrefixes_)(nil), 0x8, 0x4, "Type", 0x0, "Value", 0x4) - gengort.Validate((*Anon6217_5)(nil), 0xf, 0x1) - gengort.Validate((*DecodedInstructionModRm_)(nil), 0x4, 0x1, "Mod", 0x0, "Reg", 0x1, "Rm", 0x2, "Offset", 0x3) - gengort.Validate((*DecodedInstructionRawSib_)(nil), 0x4, 0x1, "Scale", 0x0, "Index", 0x1, "Base", 0x2, "Offset", 0x3) - gengort.Validate((*DecodedInstructionRawDisp_)(nil), 0x10, 0x8, "Value", 0x0, "Size", 0x8, "Offset", 0x9) - gengort.Validate((*DecodedInstructionRawImm_)(nil), 0x18, 0x8, "IsSigned", 0x0, "IsRelative", 0x1, "Value", 0x8, "Size", 0x10, "Offset", 0x11) - gengort.Validate((*DecodedInstructionRawImmValue_)(nil), 0x8, 0x8) - gengort.Validate((*DecodedInstruction)(nil), 0x148, 0x8, "MachineMode", 0x0, "Mnemonic", 0x4, "Length", 0x8, "Encoding", 0xc, "OpcodeMap", 0x10, "Opcode", 0x14, "StackWidth", 0x15, "OperandWidth", 0x16, "AddressWidth", 0x17, "OperandCount", 0x18, "OperandCountVisible", 0x19, "Attributes", 0x20, "CpuFlags", 0x28, "FpuFlags", 0x30, "Avx", 0x38, "Meta", 0x5c, "Raw", 0x70) - gengort.Validate((*DecoderContext)(nil), 0x20, 0x8, "Definition", 0x0, "EoszIndex", 0x8, "EaszIndex", 0x9, "VectorUnified", 0xa, "RegInfo", 0x14, "Evex", 0x1a, "Mvex", 0x1c, "Cd8Scale", 0x1d) - gengort.Validate((*Anon6451_5)(nil), 0xa, 0x1, "W", 0x0, "R", 0x1, "X", 0x2, "B", 0x3, "L", 0x4, "Ll", 0x5, "R2", 0x6, "V2", 0x7, "Vvvv", 0x8, "Mask", 0x9) - gengort.Validate((*Anon6467_5)(nil), 0x6, 0x1, "IsModReg", 0x0, "IdReg", 0x1, "IdRm", 0x2, "IdNdsndd", 0x3, "IdBase", 0x4, "IdIndex", 0x5) - gengort.Validate((*Anon6504_5)(nil), 0x2, 0x1, "TupleType", 0x0, "ElementSize", 0x1) - gengort.Validate((*Anon6518_5)(nil), 0x1, 0x1, "Functionality", 0x0) - gengort.Validate((*Decoder)(nil), 0xc, 0x4, "MachineMode", 0x0, "StackWidth", 0x4, "DecoderMode", 0x8) - gengort.Validate((*EncoderOperand)(nil), 0x40, 0x8, "Type", 0x0, "Reg", 0x4, "Mem", 0x10, "Ptr", 0x30, "Imm", 0x38) - gengort.Validate((*EncoderOperandReg_)(nil), 0x8, 0x4, "Value", 0x0, "Is4", 0x4) - gengort.Validate((*EncoderOperandMem_)(nil), 0x20, 0x8, "Base", 0x0, "Index", 0x4, "Scale", 0x8, "Displacement", 0x10, "Size", 0x18) - gengort.Validate((*EncoderOperandPtr_)(nil), 0x8, 0x4, "Segment", 0x0, "Offset", 0x4) - gengort.Validate((*EncoderOperandImm_)(nil), 0x8, 0x8) - gengort.Validate((*EncoderRequest)(nil), 0x190, 0x8, "MachineMode", 0x0, "AllowedEncodings", 0x4, "Mnemonic", 0x8, "Prefixes", 0x10, "BranchType", 0x18, "BranchWidth", 0x1c, "AddressSizeHint", 0x20, "OperandSizeHint", 0x24, "OperandCount", 0x28, "Operands", 0x30, "Evex", 0x170, "Mvex", 0x17c) - gengort.Validate((*EncoderRequestEvexFeatures_)(nil), 0xc, 0x4, "Broadcast", 0x0, "Rounding", 0x4, "Sae", 0x8, "ZeroingMask", 0x9) - gengort.Validate((*EncoderRequestMvexFeatures_)(nil), 0x14, 0x4, "Broadcast", 0x0, "Conversion", 0x4, "Rounding", 0x8, "Swizzle", 0xc, "Sae", 0x10, "EvictionHint", 0x11) - gengort.Validate((*Allocator)(nil), 0x18, 0x8, "Allocate", 0x0, "Reallocate", 0x8, "Deallocate", 0x10) - gengort.Validate((*Vector)(nil), 0x38, 0x8, "Allocator", 0x0, "GrowthFactor", 0x8, "ShrinkThreshold", 0x9, "Size", 0x10, "Capacity", 0x18, "ElementSize", 0x20, "Destructor", 0x28, "Data", 0x30) - gengort.Validate((*String)(nil), 0x40, 0x8, "Flags", 0x0, "Vector", 0x8) - gengort.Validate((*StringView)(nil), 0x40, 0x8, "String", 0x0) - gengort.Validate((*FormatterToken)(nil), 0x2, 0x1, "Type", 0x0, "Next", 0x1) - gengort.Validate((*FormatterBuffer)(nil), 0x50, 0x8, "IsTokenList", 0x0, "Capacity", 0x8, "String", 0x10) - gengort.Validate((*FormatterContext)(nil), 0x28, 0x8, "Instruction", 0x0, "Operands", 0x8, "Operand", 0x10, "RuntimeAddress", 0x18, "UserData", 0x20) - gengort.Validate((*Formatter)(nil), 0x248, 0x8, "Style", 0x0, "ForceMemorySize", 0x4, "ForceMemorySegment", 0x5, "ForceMemoryScale", 0x6, "ForceRelativeBranches", 0x7, "ForceRelativeRiprel", 0x8, "PrintBranchSize", 0x9, "DetailedPrefixes", 0xa, "AddrBase", 0xc, "AddrSignedness", 0x10, "AddrPaddingAbsolute", 0x14, "AddrPaddingRelative", 0x18, "DispBase", 0x1c, "DispSignedness", 0x20, "DispPadding", 0x24, "ImmBase", 0x28, "ImmSignedness", 0x2c, "ImmPadding", 0x30, "CasePrefixes", 0x34, "CaseMnemonic", 0x38, "CaseRegisters", 0x3c, "CaseTypecasts", 0x40, "CaseDecorators", 0x44, "HexUppercase", 0x48, "HexForceLeadingNumber", 0x49, "NumberFormat", 0x50, "FuncPreInstruction", 0x1b0, "FuncPostInstruction", 0x1b8, "FuncFormatInstruction", 0x1c0, "FuncPreOperand", 0x1c8, "FuncPostOperand", 0x1d0, "FuncFormatOperandReg", 0x1d8, "FuncFormatOperandMem", 0x1e0, "FuncFormatOperandPtr", 0x1e8, "FuncFormatOperandImm", 0x1f0, "FuncPrintMnemonic", 0x1f8, "FuncPrintRegister", 0x200, "FuncPrintAddressAbs", 0x208, "FuncPrintAddressRel", 0x210, "FuncPrintDisp", 0x218, "FuncPrintImm", 0x220, "FuncPrintTypecast", 0x228, "FuncPrintSegment", 0x230, "FuncPrintPrefixes", 0x238, "FuncPrintDecorator", 0x240) - gengort.Validate((*Anon11276_5)(nil), 0x58, 0x8, "String", 0x0, "StringData", 0x8, "Buffer", 0x48) - gengort.Validate((*InstructionSegments)(nil), 0x4c, 0x4, "Count", 0x0, "Segments", 0x4) - gengort.Validate((*Anon11687_5)(nil), 0x8, 0x4, "Type", 0x0, "Offset", 0x4, "Size", 0x5) - gengort.Validate((*DisassembledInstruction)(nil), 0x4d0, 0x8, "RuntimeAddress", 0x0, "Info", 0x8, "Operands", 0x150, "Text", 0x470) -} - -// Returns the specified instruction category string. -// -// @param category The instruction category. -// -// @return The instruction category string or `ZYAN_NULL`, if an invalid category was passed. -func (category InstructionCategory) GetString() *byte { - __res := gengort.CCall1(__imp_ZydisCategoryGetString.Addr(), gengort.MarshallSyscall(category)) - return gengort.UnmarshallSyscall[*byte](__res) -} - -var __imp_ZydisISASetGetString gengort.PreloadProc - -// Returns the specified isa-set string. -// -// @param isa_set The isa-set. -// -// @return The isa-set string or `ZYAN_NULL`, if an invalid isa-set was passed. -func (isa_set ISASet) GetString() *byte { - __res := gengort.CCall1(__imp_ZydisISASetGetString.Addr(), gengort.MarshallSyscall(isa_set)) - return gengort.UnmarshallSyscall[*byte](__res) -} - -var __imp_ZydisISAExtGetString gengort.PreloadProc - -// Returns the specified isa-extension string. -// -// @param isa_ext The isa-extension. -// -// @return The isa-extension string or `ZYAN_NULL`, if an invalid isa-extension was passed. -func (isa_ext ISAExt) GetString() *byte { - __res := gengort.CCall1(__imp_ZydisISAExtGetString.Addr(), gengort.MarshallSyscall(isa_ext)) - return gengort.UnmarshallSyscall[*byte](__res) -} - -var __imp_ZydisMnemonicGetString gengort.PreloadProc - -// Returns the specified instruction mnemonic string. -// -// @param mnemonic The mnemonic. -// -// @return The instruction mnemonic string or `ZYAN_NULL`, if an invalid mnemonic was passed. -func (mnemonic Mnemonic) GetString() *byte { - __res := gengort.CCall1(__imp_ZydisMnemonicGetString.Addr(), gengort.MarshallSyscall(mnemonic)) - return gengort.UnmarshallSyscall[*byte](__res) -} - -var __imp_ZydisMnemonicGetStringWrapped gengort.PreloadProc - -// Returns the specified instruction mnemonic as `ZydisShortString`. -// -// @param mnemonic The mnemonic. -// -// @return The instruction mnemonic string or `ZYAN_NULL`, if an invalid mnemonic was passed. -// The `buffer` of the returned struct is guaranteed to be zero-terminated in this special case. -func (mnemonic Mnemonic) GetStringWrapped() *ShortString { - __res := gengort.CCall1(__imp_ZydisMnemonicGetStringWrapped.Addr(), gengort.MarshallSyscall(mnemonic)) - return gengort.UnmarshallSyscall[*ShortString](__res) -} - -var __imp_ZydisRegisterEncode gengort.PreloadProc - -// Returns the register specified by the `register_class` and `id` tuple. -// -// @param register_class The register class. -// -// @param id The register id. -// -// @return The register specified by the `register_class` and `id` tuple or `ZYDIS_REGISTER_NONE`, -// if an invalid parameter was passed. -func (register_class RegisterClass) Encode(id U8) Register { - __res := gengort.CCall2(__imp_ZydisRegisterEncode.Addr(), gengort.MarshallSyscall(register_class), gengort.MarshallSyscall(id)) - return gengort.UnmarshallSyscall[Register](__res) -} - -var __imp_ZydisRegisterGetId gengort.PreloadProc - -// Returns the id of the specified register. -// -// @param reg The register. -// -// @return The id of the specified register, or -1 if an invalid parameter was passed. -func (reg Register) GetId() I8 { - __res := gengort.CCall1(__imp_ZydisRegisterGetId.Addr(), gengort.MarshallSyscall(reg)) - return gengort.UnmarshallSyscall[I8](__res) -} - -var __imp_ZydisRegisterGetClass gengort.PreloadProc - -// Returns the register-class of the specified register. -// -// @param reg The register. -// -// @return The register-class of the specified register. -func (reg Register) GetClass() RegisterClass { - __res := gengort.CCall1(__imp_ZydisRegisterGetClass.Addr(), gengort.MarshallSyscall(reg)) - return gengort.UnmarshallSyscall[RegisterClass](__res) -} - -var __imp_ZydisRegisterGetWidth gengort.PreloadProc - -// Returns the width of the specified register. -// -// @param mode The active machine mode. -// -// @param reg The register. -// -// @return The width of the specified register, or `ZYDIS_REGISTER_NONE` if the register is -// invalid for the active machine-mode. -func (reg Register) GetWidth(mode MachineMode) RegisterWidth { - __res := gengort.CCall2(__imp_ZydisRegisterGetWidth.Addr(), gengort.MarshallSyscall(mode), gengort.MarshallSyscall(reg)) - return gengort.UnmarshallSyscall[RegisterWidth](__res) -} - -var __imp_ZydisRegisterGetLargestEnclosing gengort.PreloadProc - -// Returns the largest enclosing register of the given register. -// -// @param mode The active machine mode. -// -// @param reg The register. -// -// @return The largest enclosing register of the given register, or `ZYDIS_REGISTER_NONE` if the -// register is invalid for the active machine-mode. -func (reg Register) GetLargestEnclosing(mode MachineMode) Register { - __res := gengort.CCall2(__imp_ZydisRegisterGetLargestEnclosing.Addr(), gengort.MarshallSyscall(mode), gengort.MarshallSyscall(reg)) - return gengort.UnmarshallSyscall[Register](__res) -} - -var __imp_ZydisRegisterGetString gengort.PreloadProc - -// Returns the specified register string. -// -// @param reg The register. -// -// @return The register string or `ZYAN_NULL`, if an invalid register was passed. -func (reg Register) GetString() *byte { - __res := gengort.CCall1(__imp_ZydisRegisterGetString.Addr(), gengort.MarshallSyscall(reg)) - return gengort.UnmarshallSyscall[*byte](__res) -} - -var __imp_ZydisRegisterGetStringWrapped gengort.PreloadProc - -// Returns the specified register string as `ZydisShortString`. -// -// @param reg The register. -// -// @return The register string or `ZYAN_NULL`, if an invalid register was passed. -// The `buffer` of the returned struct is guaranteed to be zero-terminated in this special case. -func (reg Register) GetStringWrapped() *ShortString { - __res := gengort.CCall1(__imp_ZydisRegisterGetStringWrapped.Addr(), gengort.MarshallSyscall(reg)) - return gengort.UnmarshallSyscall[*ShortString](__res) -} - -var __imp_ZydisRegisterClassGetWidth gengort.PreloadProc - -// Returns the width of the specified register-class. -// -// @param mode The active machine mode. -// -// @param register_class The register class. -// -// @return The width of the specified register. -func (register_class RegisterClass) ClassGetWidth(mode MachineMode) RegisterWidth { - __res := gengort.CCall2(__imp_ZydisRegisterClassGetWidth.Addr(), gengort.MarshallSyscall(mode), gengort.MarshallSyscall(register_class)) - return gengort.UnmarshallSyscall[RegisterWidth](__res) -} - -var __imp_ZydisDecoderInit gengort.PreloadProc - -// Initializes the given `ZydisDecoder` instance. -// -// @param decoder A pointer to the `ZydisDecoder` instance. -// -// @param machine_mode The machine mode. -// -// @param stack_width The stack width. -// -// @return A zyan status code. -func (decoder *Decoder) Init(machine_mode MachineMode, stack_width StackWidth) Status { - __res := gengort.CCall3(__imp_ZydisDecoderInit.Addr(), gengort.MarshallSyscall(decoder), gengort.MarshallSyscall(machine_mode), gengort.MarshallSyscall(stack_width)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisDecoderEnableMode gengort.PreloadProc - -// Enables or disables the specified decoder-mode. -// -// @param decoder A pointer to the `ZydisDecoder` instance. -// -// @param mode The decoder mode. -// -// @param enabled `ZYAN_TRUE` to enable, or `ZYAN_FALSE` to disable the specified decoder-mode. -// -// @return A zyan status code. -func (decoder *Decoder) EnableMode(mode DecoderMode, enabled Bool) Status { - __res := gengort.CCall3(__imp_ZydisDecoderEnableMode.Addr(), gengort.MarshallSyscall(decoder), gengort.MarshallSyscall(mode), gengort.MarshallSyscall(enabled)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisDecoderDecodeFull gengort.PreloadProc - -// Decodes the instruction in the given input `buffer` and returns all details (e.g. operands). -// -// @param decoder A pointer to the `ZydisDecoder` instance. -// -// @param buffer A pointer to the input buffer. -// -// @param length The length of the input buffer. Note that this can be bigger than the -// actual size of the instruction -- you don't have to know the size up -// front. This length is merely used to prevent Zydis from doing -// out-of-bounds reads on your buffer. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct receiving the details -// about the decoded instruction. -// -// @param operands A pointer to an array with `ZYDIS_MAX_OPERAND_COUNT` entries that -// receives the decoded operands. The number of operands decoded is -// determined by the `instruction.operand_count` field. Excess entries are -// zeroed. -// This is a convenience function that combines the following functions into one call: -// - `ZydisDecoderDecodeInstruction` -// - `ZydisDecoderDecodeOperands` -// Please refer to `ZydisDecoderDecodeInstruction` if operand decoding is not required or should -// be done separately (`ZydisDecoderDecodeOperands`). -// This function is not available in MINIMAL_MODE. -// -// @return A zyan status code. -func (decoder *Decoder) DecodeFull(buffer unsafe.Pointer, length USize, instruction *DecodedInstruction, operands *DecodedOperand) Status { - __res := gengort.CCall5(__imp_ZydisDecoderDecodeFull.Addr(), gengort.MarshallSyscall(decoder), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operands)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisDecoderDecodeInstruction gengort.PreloadProc - -// Decodes the instruction in the given input `buffer`. -// -// @param decoder A pointer to the `ZydisDecoder` instance. -// -// @param context A pointer to a decoder context struct which is required for further -// decoding (e.g. operand decoding using `ZydisDecoderDecodeOperands`) or -// `ZYAN_NULL` if not needed. -// -// @param buffer A pointer to the input buffer. -// -// @param length The length of the input buffer. Note that this can be bigger than the -// actual size of the instruction -- you don't have to know the size up -// front. This length is merely used to prevent Zydis from doing -// out-of-bounds reads on your buffer. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct, that receives the -// details about the decoded instruction. -// -// @return A zyan status code. -func (decoder *Decoder) DecodeInstruction(context *DecoderContext, buffer unsafe.Pointer, length USize, instruction *DecodedInstruction) Status { - __res := gengort.CCall5(__imp_ZydisDecoderDecodeInstruction.Addr(), gengort.MarshallSyscall(decoder), gengort.MarshallSyscall(context), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(instruction)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisDecoderDecodeOperands gengort.PreloadProc - -// Decodes the instruction operands. -// -// @param decoder A pointer to the `ZydisDecoder` instance. -// -// @param context A pointer to the `ZydisDecoderContext` struct. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operands The array that receives the decoded operands. -// Refer to `ZYDIS_MAX_OPERAND_COUNT` or `ZYDIS_MAX_OPERAND_COUNT_VISIBLE` -// when allocating space for the array to ensure that the buffer size is -// sufficient to always fit all instruction operands. -// Refer to `instruction.operand_count` or -// `instruction.operand_count_visible' when allocating space for the array -// to ensure that the buffer size is sufficient to fit all operands of -// the given instruction. -// -// @param operand_count The length of the `operands` array. -// This argument as well limits the maximum amount of operands to decode. -// If this value is `0`, no operands will be decoded and `ZYAN_NULL` will -// be accepted for the `operands` argument. -// This function fails, if `operand_count` is larger than the total number of operands for the -// given instruction (`instruction.operand_count`). -// This function is not available in MINIMAL_MODE. -// -// @return A zyan status code. -func (decoder *Decoder) DecodeOperands(context *DecoderContext, instruction *DecodedInstruction, operands *DecodedOperand, operand_count U8) Status { - __res := gengort.CCall5(__imp_ZydisDecoderDecodeOperands.Addr(), gengort.MarshallSyscall(decoder), gengort.MarshallSyscall(context), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operands), gengort.MarshallSyscall(operand_count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisEncoderEncodeInstruction gengort.PreloadProc - -// Encodes instruction with semantics specified in encoder request structure. -// -// @param request A pointer to the `ZydisEncoderRequest` struct. -// -// @param buffer A pointer to the output buffer receiving encoded instruction. -// -// @param length A pointer to the variable containing length of the output buffer. Upon -// successful return this variable receives length of the encoded instruction. -// -// @return A zyan status code. -func (request *EncoderRequest) EncodeInstruction(buffer unsafe.Pointer, length *USize) Status { - __res := gengort.CCall3(__imp_ZydisEncoderEncodeInstruction.Addr(), gengort.MarshallSyscall(request), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisEncoderEncodeInstructionAbsolute gengort.PreloadProc - -// Encodes instruction with semantics specified in encoder request structure. This function expects -// absolute addresses inside encoder request instead of `EIP`/`RIP`-relative values. Function -// predicts final instruction length prior to encoding and writes back calculated relative operands -// to provided encoder request. -// -// @param request A pointer to the `ZydisEncoderRequest` struct. -// -// @param buffer A pointer to the output buffer receiving encoded instruction. -// -// @param length A pointer to the variable containing length of the output buffer. Upon -// successful return this variable receives length of the encoded -// instruction. -// -// @param runtime_address The runtime address of the instruction. -// -// @return A zyan status code. -func (request *EncoderRequest) EncodeInstructionAbsolute(buffer unsafe.Pointer, length *USize, runtime_address U64) Status { - __res := gengort.CCall4(__imp_ZydisEncoderEncodeInstructionAbsolute.Addr(), gengort.MarshallSyscall(request), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(runtime_address)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisEncoderDecodedInstructionToEncoderRequest gengort.PreloadProc - -// Converts decoded instruction to encoder request that can be passed to -// `ZydisEncoderEncodeInstruction`. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operands A pointer to the decoded operands. -// -// @param operand_count The operand count. -// -// @param request A pointer to the `ZydisEncoderRequest` struct, that receives -// information necessary for encoder to re-encode the instruction. -// This function performs simple structure conversion and does minimal sanity checks on the -// input. There's no guarantee that produced request will be accepted by -// `ZydisEncoderEncodeInstruction` if malformed `ZydisDecodedInstruction` or malformed -// `ZydisDecodedOperands` is passed to this function. -// -// @return A zyan status code. -func (request *EncoderRequest) DecodedInstructionToEncoderRequest(instruction *DecodedInstruction, operands *DecodedOperand, operand_count U8) Status { - __res := gengort.CCall4(__imp_ZydisEncoderDecodedInstructionToEncoderRequest.Addr(), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operands), gengort.MarshallSyscall(operand_count), gengort.MarshallSyscall(request)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisEncoderNopFill gengort.PreloadProc - -// Fills provided buffer with `NOP` instructions using longest possible multi-byte instructions. -// -// @param buffer A pointer to the output buffer receiving encoded instructions. -// -// @param length Size of the output buffer. -// -// @return A zyan status code. -func EncoderNopFill(buffer unsafe.Pointer, length USize) Status { - __res := gengort.CCall2(__imp_ZydisEncoderNopFill.Addr(), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanAllocatorInit gengort.PreloadProc - -// Initializes the given `ZyanAllocator` instance. -// -// @param allocator A pointer to the `ZyanAllocator` instance. -// -// @param allocate The allocate function. -// -// @param reallocate The reallocate function. -// -// @param deallocate The deallocate function. -// -// @return A zyan status code. -func AllocatorInit(allocator *Allocator, allocate AllocatorAllocate, reallocate AllocatorAllocate, deallocate AllocatorDeallocate) Status { - __res := gengort.CCall4(__imp_ZyanAllocatorInit.Addr(), gengort.MarshallSyscall(allocator), gengort.MarshallSyscall(allocate), gengort.MarshallSyscall(reallocate), gengort.MarshallSyscall(deallocate)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanEqualsPointer gengort.PreloadProc - -func EqualsPointer(left *unsafe.Pointer, right *unsafe.Pointer) Bool { - __res := gengort.CCall2(__imp_ZyanEqualsPointer.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[Bool](__res) -} - -var __imp_ZyanEqualsBool gengort.PreloadProc - -func EqualsBool(left *Bool, right *Bool) Bool { - __res := gengort.CCall2(__imp_ZyanEqualsBool.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[Bool](__res) -} - -var __imp_ZyanEqualsNumeric8 gengort.PreloadProc - -func EqualsNumeric8(left *U8, right *U8) Bool { - __res := gengort.CCall2(__imp_ZyanEqualsNumeric8.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[Bool](__res) -} - -var __imp_ZyanEqualsNumeric16 gengort.PreloadProc - -func EqualsNumeric16(left *U16, right *U16) Bool { - __res := gengort.CCall2(__imp_ZyanEqualsNumeric16.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[Bool](__res) -} - -var __imp_ZyanEqualsNumeric32 gengort.PreloadProc - -func EqualsNumeric32(left *U32, right *U32) Bool { - __res := gengort.CCall2(__imp_ZyanEqualsNumeric32.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[Bool](__res) -} - -var __imp_ZyanEqualsNumeric64 gengort.PreloadProc - -func EqualsNumeric64(left *U64, right *U64) Bool { - __res := gengort.CCall2(__imp_ZyanEqualsNumeric64.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[Bool](__res) -} - -var __imp_ZyanComparePointer gengort.PreloadProc - -func ComparePointer(left *unsafe.Pointer, right *unsafe.Pointer) I32 { - __res := gengort.CCall2(__imp_ZyanComparePointer.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[I32](__res) -} - -var __imp_ZyanCompareBool gengort.PreloadProc - -func CompareBool(left *Bool, right *Bool) I32 { - __res := gengort.CCall2(__imp_ZyanCompareBool.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[I32](__res) -} - -var __imp_ZyanCompareNumeric8 gengort.PreloadProc - -func CompareNumeric8(left *U8, right *U8) I32 { - __res := gengort.CCall2(__imp_ZyanCompareNumeric8.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[I32](__res) -} - -var __imp_ZyanCompareNumeric16 gengort.PreloadProc - -func CompareNumeric16(left *U16, right *U16) I32 { - __res := gengort.CCall2(__imp_ZyanCompareNumeric16.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[I32](__res) -} - -var __imp_ZyanCompareNumeric32 gengort.PreloadProc - -func CompareNumeric32(left *U32, right *U32) I32 { - __res := gengort.CCall2(__imp_ZyanCompareNumeric32.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[I32](__res) -} - -var __imp_ZyanCompareNumeric64 gengort.PreloadProc - -func CompareNumeric64(left *U64, right *U64) I32 { - __res := gengort.CCall2(__imp_ZyanCompareNumeric64.Addr(), gengort.MarshallSyscall(left), gengort.MarshallSyscall(right)) - return gengort.UnmarshallSyscall[I32](__res) -} - -var __imp_ZyanVectorInitEx gengort.PreloadProc - -// Initializes the given `ZyanVector` instance and sets a custom `allocator` and memory -// allocation/deallocation parameters. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element_size The size of a single element in bytes. -// -// @param capacity The initial capacity (number of elements). -// -// @param destructor A destructor callback that is invoked every time an item is deleted, -// or `ZYAN_NULL` if not needed. -// -// @param allocator A pointer to a `ZyanAllocator` instance. -// -// @param growth_factor The growth factor. -// -// @param shrink_threshold The shrink threshold. -// -// @return A zyan status code. -// A growth factor of `1` disables overallocation and a shrink threshold of `0` disables -// dynamic shrinking. -// Finalization with `ZyanVectorDestroy` is required for all instances created by this function. -func (vector *Vector) InitEx(element_size USize, capacity USize, destructor MemberProcedure, allocator *Allocator, growth_factor U8, shrink_threshold U8) Status { - __res := gengort.CCall7(__imp_ZyanVectorInitEx.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element_size), gengort.MarshallSyscall(capacity), gengort.MarshallSyscall(destructor), gengort.MarshallSyscall(allocator), gengort.MarshallSyscall(growth_factor), gengort.MarshallSyscall(shrink_threshold)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorInitCustomBuffer gengort.PreloadProc - -// Initializes the given `ZyanVector` instance and configures it to use a custom user -// defined buffer with a fixed size. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element_size The size of a single element in bytes. -// -// @param buffer A pointer to the buffer that is used as storage for the elements. -// -// @param capacity The maximum capacity (number of elements) of the buffer. -// -// @param destructor A destructor callback that is invoked every time an item is deleted, or -// `ZYAN_NULL` if not needed. -// -// @return A zyan status code. -// Finalization is not required for instances created by this function. -func (vector *Vector) InitCustomBuffer(element_size USize, buffer unsafe.Pointer, capacity USize, destructor MemberProcedure) Status { - __res := gengort.CCall5(__imp_ZyanVectorInitCustomBuffer.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element_size), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(capacity), gengort.MarshallSyscall(destructor)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorDestroy gengort.PreloadProc - -// Destroys the given `ZyanVector` instance. -// -// @param vector A pointer to the `ZyanVector` instance.. -// -// @return A zyan status code. -func (vector *Vector) Destroy() Status { - __res := gengort.CCall1(__imp_ZyanVectorDestroy.Addr(), gengort.MarshallSyscall(vector)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorDuplicateEx gengort.PreloadProc - -// Initializes a new `ZyanVector` instance by duplicating an existing vector and sets a -// custom `allocator` and memory allocation/deallocation parameters. -// -// @param destination A pointer to the (uninitialized) destination `ZyanVector` instance. -// -// @param source A pointer to the source vector. -// -// @param capacity The initial capacity (number of elements). -// This value is automatically adjusted to the size of the source -// vector, if a smaller value was passed. -// -// @param allocator A pointer to a `ZyanAllocator` instance. -// -// @param growth_factor The growth factor. -// -// @param shrink_threshold The shrink threshold. -// -// @return A zyan status code. -// A growth factor of `1` disables overallocation and a shrink threshold of `0` disables -// dynamic shrinking. -// Finalization with `ZyanVectorDestroy` is required for all instances created by this function. -func (destination *Vector) DuplicateEx(source *Vector, capacity USize, allocator *Allocator, growth_factor U8, shrink_threshold U8) Status { - __res := gengort.CCall6(__imp_ZyanVectorDuplicateEx.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(source), gengort.MarshallSyscall(capacity), gengort.MarshallSyscall(allocator), gengort.MarshallSyscall(growth_factor), gengort.MarshallSyscall(shrink_threshold)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorDuplicateCustomBuffer gengort.PreloadProc - -// Initializes a new `ZyanVector` instance by duplicating an existing vector and -// configures it to use a custom user defined buffer with a fixed size. -// -// @param destination A pointer to the (uninitialized) destination `ZyanVector` instance. -// -// @param source A pointer to the source vector. -// -// @param buffer A pointer to the buffer that is used as storage for the elements. -// -// @param capacity The maximum capacity (number of elements) of the buffer. -// This function will fail, if the capacity of the buffer is less than the -// size of the source vector. -// -// @return A zyan status code. -// Finalization is not required for instances created by this function. -func (destination *Vector) DuplicateCustomBuffer(source *Vector, buffer unsafe.Pointer, capacity USize) Status { - __res := gengort.CCall4(__imp_ZyanVectorDuplicateCustomBuffer.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(source), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorGet gengort.PreloadProc - -// Returns a constant pointer to the element at the given `index`. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The element index. -// -// @return A constant pointer to the desired element in the vector or `ZYAN_NULL`, if an error -// occurred. -// Note that the returned pointer might get invalid when the vector is resized by either a manual -// call to the memory-management functions or implicitly by inserting or removing elements. -// Take a look at `ZyanVectorGetPointer` instead, if you need a function that returns a zyan status -// code. -func (vector *Vector) Get(index USize) unsafe.Pointer { - __res := gengort.CCall2(__imp_ZyanVectorGet.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index)) - return gengort.UnmarshallSyscall[unsafe.Pointer](__res) -} - -var __imp_ZyanVectorGetMutable gengort.PreloadProc - -// Returns a mutable pointer to the element at the given `index`. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The element index. -// -// @return A mutable pointer to the desired element in the vector or `ZYAN_NULL`, if an error -// occurred. -// Note that the returned pointer might get invalid when the vector is resized by either a manual -// call to the memory-management functions or implicitly by inserting or removing elements. -// Take a look at `ZyanVectorGetPointerMutable` instead, if you need a function that returns a -// zyan status code. -func (vector *Vector) GetMutable(index USize) unsafe.Pointer { - __res := gengort.CCall2(__imp_ZyanVectorGetMutable.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index)) - return gengort.UnmarshallSyscall[unsafe.Pointer](__res) -} - -var __imp_ZyanVectorGetPointer gengort.PreloadProc - -// Returns a constant pointer to the element at the given `index`. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The element index. -// -// @param value Receives a constant pointer to the desired element in the vector. -// Note that the returned pointer might get invalid when the vector is resized by either a manual -// call to the memory-management functions or implicitly by inserting or removing elements. -// -// @return A zyan status code. -func (vector *Vector) GetPointer(index USize, value *unsafe.Pointer) Status { - __res := gengort.CCall3(__imp_ZyanVectorGetPointer.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorGetPointerMutable gengort.PreloadProc - -// Returns a mutable pointer to the element at the given `index`. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The element index. -// -// @param value Receives a mutable pointer to the desired element in the vector. -// Note that the returned pointer might get invalid when the vector is resized by either a manual -// call to the memory-management functions or implicitly by inserting or removing elements. -// -// @return A zyan status code. -func (vector *Vector) GetPointerMutable(index USize, value *unsafe.Pointer) Status { - __res := gengort.CCall3(__imp_ZyanVectorGetPointerMutable.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorSet gengort.PreloadProc - -// Assigns a new value to the element at the given `index`. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The value index. -// -// @param value The value to assign. -// -// @return A zyan status code. -func (vector *Vector) Set(index USize, value unsafe.Pointer) Status { - __res := gengort.CCall3(__imp_ZyanVectorSet.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorPushBack gengort.PreloadProc - -// Adds a new `element` to the end of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element A pointer to the element to add. -// -// @return A zyan status code. -func (vector *Vector) PushBack(element unsafe.Pointer) Status { - __res := gengort.CCall2(__imp_ZyanVectorPushBack.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorInsert gengort.PreloadProc - -// Inserts an `element` at the given `index` of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The insert index. -// -// @param element A pointer to the element to insert. -// -// @return A zyan status code. -func (vector *Vector) Insert(index USize, element unsafe.Pointer) Status { - __res := gengort.CCall3(__imp_ZyanVectorInsert.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index), gengort.MarshallSyscall(element)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorInsertRange gengort.PreloadProc - -// Inserts multiple `elements` at the given `index` of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The insert index. -// -// @param elements A pointer to the first element. -// -// @param count The number of elements to insert. -// -// @return A zyan status code. -func (vector *Vector) InsertRange(index USize, elements unsafe.Pointer, count USize) Status { - __res := gengort.CCall4(__imp_ZyanVectorInsertRange.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index), gengort.MarshallSyscall(elements), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorEmplace gengort.PreloadProc - -// Constructs an `element` in-place at the end of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element Receives a pointer to the new element. -// -// @param constructor The constructor callback or `ZYAN_NULL`. The new element will be in -// undefined state, if no constructor was passed. -// -// @return A zyan status code. -func (vector *Vector) Emplace(element *unsafe.Pointer, constructor MemberFunction) Status { - __res := gengort.CCall3(__imp_ZyanVectorEmplace.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element), gengort.MarshallSyscall(constructor)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorEmplaceEx gengort.PreloadProc - -// Constructs an `element` in-place and inserts it at the given `index` of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The insert index. -// -// @param element Receives a pointer to the new element. -// -// @param constructor The constructor callback or `ZYAN_NULL`. The new element will be in -// undefined state, if no constructor was passed. -// -// @return A zyan status code. -func (vector *Vector) EmplaceEx(index USize, element *unsafe.Pointer, constructor MemberFunction) Status { - __res := gengort.CCall4(__imp_ZyanVectorEmplaceEx.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index), gengort.MarshallSyscall(element), gengort.MarshallSyscall(constructor)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorSwapElements gengort.PreloadProc - -// Swaps the element at `index_first` with the element at `index_second`. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index_first The index of the first element. -// -// @param index_second The index of the second element. -// -// @return A zyan status code. -// This function requires the vector to have spare capacity for one temporary element. Call -// `ZyanVectorReserve` before this function to increase capacity, if needed. -func (vector *Vector) SwapElements(index_first USize, index_second USize) Status { - __res := gengort.CCall3(__imp_ZyanVectorSwapElements.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index_first), gengort.MarshallSyscall(index_second)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorDelete gengort.PreloadProc - -// Deletes the element at the given `index` of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The element index. -// -// @return A zyan status code. -func (vector *Vector) Delete(index USize) Status { - __res := gengort.CCall2(__imp_ZyanVectorDelete.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorDeleteRange gengort.PreloadProc - -// Deletes multiple elements from the given vector, starting at `index`. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param index The index of the first element to delete. -// -// @param count The number of elements to delete. -// -// @return A zyan status code. -func (vector *Vector) DeleteRange(index USize, count USize) Status { - __res := gengort.CCall3(__imp_ZyanVectorDeleteRange.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorPopBack gengort.PreloadProc - -// Removes the last element of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @return A zyan status code. -func (vector *Vector) PopBack() Status { - __res := gengort.CCall1(__imp_ZyanVectorPopBack.Addr(), gengort.MarshallSyscall(vector)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorClear gengort.PreloadProc - -// Erases all elements of the given vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @return A zyan status code. -func (vector *Vector) Clear() Status { - __res := gengort.CCall1(__imp_ZyanVectorClear.Addr(), gengort.MarshallSyscall(vector)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorFind gengort.PreloadProc - -// Sequentially searches for the first occurrence of `element` in the given vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element A pointer to the element to search for. -// -// @param found_index A pointer to a variable that receives the index of the found element. -// -// @param comparison The comparison function to use. -// -// @return `ZYAN_STATUS_TRUE` if the element was found, `ZYAN_STATUS_FALSE` if not or a generic -// zyan status code if an error occurred. -// The `found_index` is set to `-1`, if the element was not found. -func (vector *Vector) Find(element unsafe.Pointer, found_index *ISize, comparison EqualityComparison) Status { - __res := gengort.CCall4(__imp_ZyanVectorFind.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(comparison)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorFindEx gengort.PreloadProc - -// Sequentially searches for the first occurrence of `element` in the given vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element A pointer to the element to search for. -// -// @param found_index A pointer to a variable that receives the index of the found element. -// -// @param comparison The comparison function to use. -// -// @param index The start index. -// -// @param count The maximum number of elements to iterate, beginning from the start `index`. -// -// @return `ZYAN_STATUS_TRUE` if the element was found, `ZYAN_STATUS_FALSE` if not or a generic -// zyan status code if an error occurred. -// The `found_index` is set to `-1`, if the element was not found. -func (vector *Vector) FindEx(element unsafe.Pointer, found_index *ISize, comparison EqualityComparison, index USize, count USize) Status { - __res := gengort.CCall6(__imp_ZyanVectorFindEx.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(comparison), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorBinarySearch gengort.PreloadProc - -// Searches for the first occurrence of `element` in the given vector using a binary- -// search algorithm. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element A pointer to the element to search for. -// -// @param found_index A pointer to a variable that receives the index of the found element. -// -// @param comparison The comparison function to use. -// -// @return `ZYAN_STATUS_TRUE` if the element was found, `ZYAN_STATUS_FALSE` if not or a generic -// zyan status code if an error occurred. -// If found, `found_index` contains the zero-based index of `element`. If not found, `found_index` -// contains the index of the first entry larger than `element`. -// This function requires all elements in the vector to be strictly ordered (sorted). -func (vector *Vector) BinarySearch(element unsafe.Pointer, found_index *USize, comparison Comparison) Status { - __res := gengort.CCall4(__imp_ZyanVectorBinarySearch.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(comparison)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorBinarySearchEx gengort.PreloadProc - -// Searches for the first occurrence of `element` in the given vector using a binary- -// search algorithm. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param element A pointer to the element to search for. -// -// @param found_index A pointer to a variable that receives the index of the found element. -// -// @param comparison The comparison function to use. -// -// @param index The start index. -// -// @param count The maximum number of elements to iterate, beginning from the start `index`. -// -// @return `ZYAN_STATUS_TRUE` if the element was found, `ZYAN_STATUS_FALSE` if not or a generic -// zyan status code if an error occurred. -// If found, `found_index` contains the zero-based index of `element`. If not found, `found_index` -// contains the index of the first entry larger than `element`. -// This function requires all elements in the vector to be strictly ordered (sorted). -func (vector *Vector) BinarySearchEx(element unsafe.Pointer, found_index *USize, comparison Comparison, index USize, count USize) Status { - __res := gengort.CCall6(__imp_ZyanVectorBinarySearchEx.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(element), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(comparison), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorResize gengort.PreloadProc - -// Resizes the given `ZyanVector` instance. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param size The new size of the vector. -// -// @return A zyan status code. -func (vector *Vector) Resize(size USize) Status { - __res := gengort.CCall2(__imp_ZyanVectorResize.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(size)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorResizeEx gengort.PreloadProc - -// Resizes the given `ZyanVector` instance. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param size The new size of the vector. -// -// @param initializer A pointer to a value to be used as initializer for new items. -// -// @return A zyan status code. -func (vector *Vector) ResizeEx(size USize, initializer unsafe.Pointer) Status { - __res := gengort.CCall3(__imp_ZyanVectorResizeEx.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(size), gengort.MarshallSyscall(initializer)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorReserve gengort.PreloadProc - -// Changes the capacity of the given `ZyanVector` instance. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param capacity The new minimum capacity of the vector. -// -// @return A zyan status code. -func (vector *Vector) Reserve(capacity USize) Status { - __res := gengort.CCall2(__imp_ZyanVectorReserve.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorShrinkToFit gengort.PreloadProc - -// Shrinks the capacity of the given vector to match it's size. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @return A zyan status code. -func (vector *Vector) ShrinkToFit() Status { - __res := gengort.CCall1(__imp_ZyanVectorShrinkToFit.Addr(), gengort.MarshallSyscall(vector)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorGetCapacity gengort.PreloadProc - -// Returns the current capacity of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param capacity Receives the size of the vector. -// -// @return A zyan status code. -func (vector *Vector) GetCapacity(capacity *USize) Status { - __res := gengort.CCall2(__imp_ZyanVectorGetCapacity.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanVectorGetSize gengort.PreloadProc - -// Returns the current size of the vector. -// -// @param vector A pointer to the `ZyanVector` instance. -// -// @param size Receives the size of the vector. -// -// @return A zyan status code. -func (vector *Vector) GetSize(size *USize) Status { - __res := gengort.CCall2(__imp_ZyanVectorGetSize.Addr(), gengort.MarshallSyscall(vector), gengort.MarshallSyscall(size)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringInitEx gengort.PreloadProc - -// Initializes the given `ZyanString` instance and sets a custom `allocator` and memory -// allocation/deallocation parameters. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param capacity The initial capacity (number of characters). -// -// @param allocator A pointer to a `ZyanAllocator` instance. -// -// @param growth_factor The growth factor. -// -// @param shrink_threshold The shrink threshold. -// -// @return A zyan status code. -// A growth factor of `1` disables overallocation and a shrink threshold of `0` disables -// dynamic shrinking. -// The allocated buffer will be at least one character larger than the given `capacity`, to reserve -// space for the terminating ' -// \ -// 0'. -// Finalization with `ZyanStringDestroy` is required for all strings created by this function. -func (_string *String) InitEx(capacity USize, allocator *Allocator, growth_factor U8, shrink_threshold U8) Status { - __res := gengort.CCall5(__imp_ZyanStringInitEx.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(capacity), gengort.MarshallSyscall(allocator), gengort.MarshallSyscall(growth_factor), gengort.MarshallSyscall(shrink_threshold)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringInitCustomBuffer gengort.PreloadProc - -// Initializes the given `ZyanString` instance and configures it to use a custom user -// defined buffer with a fixed size. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param buffer A pointer to the buffer that is used as storage for the string. -// -// @param capacity The maximum capacity (number of characters) of the buffer, including -// the terminating ' -// \ -// 0'. -// -// @return A zyan status code. -// Finalization is not required for strings created by this function. -func (_string *String) InitCustomBuffer(buffer *byte, capacity USize) Status { - __res := gengort.CCall3(__imp_ZyanStringInitCustomBuffer.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringDestroy gengort.PreloadProc - -// Destroys the given `ZyanString` instance. -// -// @param string A pointer to the `ZyanString` instance. -// -// @return A zyan status code. -func (_string *String) Destroy() Status { - __res := gengort.CCall1(__imp_ZyanStringDestroy.Addr(), gengort.MarshallSyscall(_string)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringDuplicateEx gengort.PreloadProc - -// Initializes a new `ZyanString` instance by duplicating an existing string and sets a -// custom `allocator` and memory allocation/deallocation parameters. -// -// @param destination A pointer to the (uninitialized) destination `ZyanString` instance. -// -// @param source A pointer to the source string. -// -// @param capacity The initial capacity (number of characters). -// This value is automatically adjusted to the size of the source -// string, if a smaller value was passed. -// -// @param allocator A pointer to a `ZyanAllocator` instance. -// -// @param growth_factor The growth factor. -// -// @param shrink_threshold The shrink threshold. -// -// @return A zyan status code. -// The behavior of this function is undefined, if `source` is a view into the `destination` -// string or `destination` points to an already initialized `ZyanString` instance. -// A growth factor of `1` disables overallocation and a shrink threshold of `0` disables -// dynamic shrinking. -// The allocated buffer will be at least one character larger than the given `capacity`, to reserve -// space for the terminating ' -// \ -// 0'. -// Finalization with `ZyanStringDestroy` is required for all strings created by this function. -func (destination *String) DuplicateEx(source *StringView, capacity USize, allocator *Allocator, growth_factor U8, shrink_threshold U8) Status { - __res := gengort.CCall6(__imp_ZyanStringDuplicateEx.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(source), gengort.MarshallSyscall(capacity), gengort.MarshallSyscall(allocator), gengort.MarshallSyscall(growth_factor), gengort.MarshallSyscall(shrink_threshold)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringDuplicateCustomBuffer gengort.PreloadProc - -// Initializes a new `ZyanString` instance by duplicating an existing string and -// configures it to use a custom user defined buffer with a fixed size. -// -// @param destination A pointer to the (uninitialized) destination `ZyanString` instance. -// -// @param source A pointer to the source string. -// -// @param buffer A pointer to the buffer that is used as storage for the string. -// -// @param capacity The maximum capacity (number of characters) of the buffer, including the -// terminating ' -// \ -// 0'. -// This function will fail, if the capacity of the buffer is less or equal to -// the size of the source string. -// -// @return A zyan status code. -// The behavior of this function is undefined, if `source` is a view into the `destination` -// string or `destination` points to an already initialized `ZyanString` instance. -// Finalization is not required for strings created by this function. -func (destination *String) DuplicateCustomBuffer(source *StringView, buffer *byte, capacity USize) Status { - __res := gengort.CCall4(__imp_ZyanStringDuplicateCustomBuffer.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(source), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringConcatEx gengort.PreloadProc - -// Initializes a new `ZyanString` instance by concatenating two existing strings and sets -// a custom `allocator` and memory allocation/deallocation parameters. -// -// @param destination A pointer to the (uninitialized) destination `ZyanString` instance. -// This function will fail, if the destination `ZyanString` instance -// equals one of the source strings. -// -// @param s1 A pointer to the first source string. -// -// @param s2 A pointer to the second source string. -// -// @param capacity The initial capacity (number of characters). -// This value is automatically adjusted to the combined size of the -// source strings, if a smaller value was passed. -// -// @param allocator A pointer to a `ZyanAllocator` instance. -// -// @param growth_factor The growth factor. -// -// @param shrink_threshold The shrink threshold. -// -// @return A zyan status code. -// The behavior of this function is undefined, if `s1` or `s2` are views into the `destination` -// string or `destination` points to an already initialized `ZyanString` instance. -// A growth factor of `1` disables overallocation and a shrink threshold of `0` disables -// dynamic shrinking. -// The allocated buffer will be at least one character larger than the given `capacity`, to reserve -// space for the terminating ' -// \ -// 0'. -// Finalization with `ZyanStringDestroy` is required for all strings created by this function. -func (destination *String) ConcatEx(s1 *StringView, s2 *StringView, capacity USize, allocator *Allocator, growth_factor U8, shrink_threshold U8) Status { - __res := gengort.CCall7(__imp_ZyanStringConcatEx.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(s1), gengort.MarshallSyscall(s2), gengort.MarshallSyscall(capacity), gengort.MarshallSyscall(allocator), gengort.MarshallSyscall(growth_factor), gengort.MarshallSyscall(shrink_threshold)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringConcatCustomBuffer gengort.PreloadProc - -// Initializes a new `ZyanString` instance by concatenating two existing strings and -// configures it to use a custom user defined buffer with a fixed size. -// -// @param destination A pointer to the (uninitialized) destination `ZyanString` instance. -// This function will fail, if the destination `ZyanString` instance equals -// one of the source strings. -// -// @param s1 A pointer to the first source string. -// -// @param s2 A pointer to the second source string. -// -// @param buffer A pointer to the buffer that is used as storage for the string. -// -// @param capacity The maximum capacity (number of characters) of the buffer. -// This function will fail, if the capacity of the buffer is less or equal to -// the combined size of the source strings. -// -// @return A zyan status code. -// The behavior of this function is undefined, if `s1` or `s2` are views into the `destination` -// string or `destination` points to an already initialized `ZyanString` instance. -// Finalization is not required for strings created by this function. -func (destination *String) ConcatCustomBuffer(s1 *StringView, s2 *StringView, buffer *byte, capacity USize) Status { - __res := gengort.CCall5(__imp_ZyanStringConcatCustomBuffer.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(s1), gengort.MarshallSyscall(s2), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringViewInsideView gengort.PreloadProc - -// Returns a view inside an existing view/string. -// -// @param view A pointer to the `ZyanStringView` instance. -// -// @param source A pointer to the source string. -// -// @return A zyan status code. -// The `ZYAN_STRING_TO_VEW` macro can be used to pass any `ZyanString` instance as value for the -// `source` string. -func (view *StringView) InsideView(source *StringView) Status { - __res := gengort.CCall2(__imp_ZyanStringViewInsideView.Addr(), gengort.MarshallSyscall(view), gengort.MarshallSyscall(source)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringViewInsideViewEx gengort.PreloadProc - -// Returns a view inside an existing view/string starting from the given `index`. -// -// @param view A pointer to the `ZyanStringView` instance. -// -// @param source A pointer to the source string. -// -// @param index The start index. -// -// @param count The number of characters. -// -// @return A zyan status code. -// The `ZYAN_STRING_TO_VEW` macro can be used to pass any `ZyanString` instance as value for the -// `source` string. -func (view *StringView) InsideViewEx(source *StringView, index USize, count USize) Status { - __res := gengort.CCall4(__imp_ZyanStringViewInsideViewEx.Addr(), gengort.MarshallSyscall(view), gengort.MarshallSyscall(source), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringViewInsideBuffer gengort.PreloadProc - -// Returns a view inside a null-terminated C-style string. -// -// @param view A pointer to the `ZyanStringView` instance. -// -// @param string The C-style string. -// -// @return A zyan status code. -func (view *StringView) InsideBuffer(_string *byte) Status { - __res := gengort.CCall2(__imp_ZyanStringViewInsideBuffer.Addr(), gengort.MarshallSyscall(view), gengort.MarshallSyscall(_string)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringViewInsideBufferEx gengort.PreloadProc - -// Returns a view inside a character buffer with custom length. -// -// @param view A pointer to the `ZyanStringView` instance. -// -// @param buffer A pointer to the buffer containing the string characters. -// -// @param length The length of the string (number of characters). -// -// @return A zyan status code. -func (view *StringView) InsideBufferEx(buffer *byte, length USize) Status { - __res := gengort.CCall3(__imp_ZyanStringViewInsideBufferEx.Addr(), gengort.MarshallSyscall(view), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringViewGetSize gengort.PreloadProc - -// Returns the size (number of characters) of the view. -// -// @param view A pointer to the `ZyanStringView` instance. -// -// @param size Receives the size (number of characters) of the view. -// -// @return A zyan status code. -func (view *StringView) GetSize(size *USize) Status { - __res := gengort.CCall2(__imp_ZyanStringViewGetSize.Addr(), gengort.MarshallSyscall(view), gengort.MarshallSyscall(size)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringViewGetData gengort.PreloadProc - -// Returns the C-style string of the given `ZyanString` instance. -// -// @warning The string is not guaranteed to be null terminated! -// -// @param view A pointer to the `ZyanStringView` instance. -// -// @param buffer Receives a pointer to the C-style string. -// -// @return A zyan status code. -func (view *StringView) GetData(buffer **byte) Status { - __res := gengort.CCall2(__imp_ZyanStringViewGetData.Addr(), gengort.MarshallSyscall(view), gengort.MarshallSyscall(buffer)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringGetChar gengort.PreloadProc - -// Returns the character at the given `index`. -// -// @param string A pointer to the `ZyanStringView` instance. -// -// @param index The character index. -// -// @param value Receives the desired character of the string. -// -// @return A zyan status code. -func (_string *StringView) GetChar(index USize, value *byte) Status { - __res := gengort.CCall3(__imp_ZyanStringGetChar.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(index), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringGetCharMutable gengort.PreloadProc - -// Returns a pointer to the character at the given `index`. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param index The character index. -// -// @param value Receives a pointer to the desired character in the string. -// -// @return A zyan status code. -func (_string *String) GetCharMutable(index USize, value **byte) Status { - __res := gengort.CCall3(__imp_ZyanStringGetCharMutable.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(index), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringSetChar gengort.PreloadProc - -// Assigns a new value to the character at the given `index`. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param index The character index. -// -// @param value The character to assign. -// -// @return A zyan status code. -func (_string *String) SetChar(index USize, value byte) Status { - __res := gengort.CCall3(__imp_ZyanStringSetChar.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(index), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringInsert gengort.PreloadProc - -// Inserts the content of the source string in the destination string at the given `index`. -// -// @param destination The destination string. -// -// @param index The insert index. -// -// @param source The source string. -// -// @return A zyan status code. -func (destination *String) Insert(index USize, source *StringView) Status { - __res := gengort.CCall3(__imp_ZyanStringInsert.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(index), gengort.MarshallSyscall(source)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringInsertEx gengort.PreloadProc - -// Inserts `count` characters of the source string in the destination string at the given -// `index`. -// -// @param destination The destination string. -// -// @param destination_index The insert index. -// -// @param source The source string. -// -// @param source_index The index of the first character to be inserted from the source -// string. -// -// @param count The number of chars to insert from the source string. -// -// @return A zyan status code. -func (destination *String) InsertEx(destination_index USize, source *StringView, source_index USize, count USize) Status { - __res := gengort.CCall5(__imp_ZyanStringInsertEx.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(destination_index), gengort.MarshallSyscall(source), gengort.MarshallSyscall(source_index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringAppend gengort.PreloadProc - -// Appends the content of the source string to the end of the destination string. -// -// @param destination The destination string. -// -// @param source The source string. -// -// @return A zyan status code. -func (destination *String) Append(source *StringView) Status { - __res := gengort.CCall2(__imp_ZyanStringAppend.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(source)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringAppendEx gengort.PreloadProc - -// Appends `count` characters of the source string to the end of the destination string. -// -// @param destination The destination string. -// -// @param source The source string. -// -// @param source_index The index of the first character to be appended from the source string. -// -// @param count The number of chars to append from the source string. -// -// @return A zyan status code. -func (destination *String) AppendEx(source *StringView, source_index USize, count USize) Status { - __res := gengort.CCall4(__imp_ZyanStringAppendEx.Addr(), gengort.MarshallSyscall(destination), gengort.MarshallSyscall(source), gengort.MarshallSyscall(source_index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringDelete gengort.PreloadProc - -// Deletes characters from the given string, starting at `index`. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param index The index of the first character to delete. -// -// @param count The number of characters to delete. -// -// @return A zyan status code. -func (_string *String) Delete(index USize, count USize) Status { - __res := gengort.CCall3(__imp_ZyanStringDelete.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringTruncate gengort.PreloadProc - -// Deletes all remaining characters from the given string, starting at `index`. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param index The index of the first character to delete. -// -// @return A zyan status code. -func (_string *String) Truncate(index USize) Status { - __res := gengort.CCall2(__imp_ZyanStringTruncate.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(index)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringClear gengort.PreloadProc - -// Erases the given string. -// -// @param string A pointer to the `ZyanString` instance. -// -// @return A zyan status code. -func (_string *String) Clear() Status { - __res := gengort.CCall1(__imp_ZyanStringClear.Addr(), gengort.MarshallSyscall(_string)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringLPos gengort.PreloadProc - -// Searches for the first occurrence of `needle` in the given `haystack` starting from the -// left. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occured. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) LPos(needle *StringView, found_index *ISize) Status { - __res := gengort.CCall3(__imp_ZyanStringLPos.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringLPosEx gengort.PreloadProc - -// Searches for the first occurrence of `needle` in the given `haystack` starting from the -// left. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @param index The start index. -// -// @param count The maximum number of characters to iterate, beginning from the start -// `index`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occured. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) LPosEx(needle *StringView, found_index *ISize, index USize, count USize) Status { - __res := gengort.CCall5(__imp_ZyanStringLPosEx.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringLPosI gengort.PreloadProc - -// Performs a case-insensitive search for the first occurrence of `needle` in the given -// `haystack` starting from the left. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occured. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) LPosI(needle *StringView, found_index *ISize) Status { - __res := gengort.CCall3(__imp_ZyanStringLPosI.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringLPosIEx gengort.PreloadProc - -// Performs a case-insensitive search for the first occurrence of `needle` in the given -// `haystack` starting from the left. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @param index The start index. -// -// @param count The maximum number of characters to iterate, beginning from the start -// `index`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occurred. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) LPosIEx(needle *StringView, found_index *ISize, index USize, count USize) Status { - __res := gengort.CCall5(__imp_ZyanStringLPosIEx.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringRPos gengort.PreloadProc - -// Searches for the first occurrence of `needle` in the given `haystack` starting from the -// right. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occurred. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) RPos(needle *StringView, found_index *ISize) Status { - __res := gengort.CCall3(__imp_ZyanStringRPos.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringRPosEx gengort.PreloadProc - -// Searches for the first occurrence of `needle` in the given `haystack` starting from the -// right. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @param index The start index. -// -// @param count The maximum number of characters to iterate, beginning from the start -// `index`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occurred. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) RPosEx(needle *StringView, found_index *ISize, index USize, count USize) Status { - __res := gengort.CCall5(__imp_ZyanStringRPosEx.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringRPosI gengort.PreloadProc - -// Performs a case-insensitive search for the first occurrence of `needle` in the given -// `haystack` starting from the right. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occurred. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) RPosI(needle *StringView, found_index *ISize) Status { - __res := gengort.CCall3(__imp_ZyanStringRPosI.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringRPosIEx gengort.PreloadProc - -// Performs a case-insensitive search for the first occurrence of `needle` in the given -// `haystack` starting from the right. -// -// @param haystack The string to search in. -// -// @param needle The sub-string to search for. -// -// @param found_index A pointer to a variable that receives the index of the first occurrence of -// `needle`. -// -// @param index The start index. -// -// @param count The maximum number of characters to iterate, beginning from the start -// `index`. -// -// @return `ZYAN_STATUS_TRUE`, if the needle was found, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occurred. -// The `found_index` is set to `-1`, if the needle was not found. -func (haystack *StringView) RPosIEx(needle *StringView, found_index *ISize, index USize, count USize) Status { - __res := gengort.CCall5(__imp_ZyanStringRPosIEx.Addr(), gengort.MarshallSyscall(haystack), gengort.MarshallSyscall(needle), gengort.MarshallSyscall(found_index), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringCompare gengort.PreloadProc - -// Compares two strings. -// -// @param s1 The first string -// -// @param s2 The second string. -// -// @param result Receives the comparison result. -// Values: -// - `result -// < -// 0` -> The first character that does not match has a lower value -// in `s1` than in `s2`. -// - `result == 0` -> The contents of both strings are equal. -// - `result > 0` -> The first character that does not match has a greater value -// in `s1` than in `s2`. -// -// @return `ZYAN_STATUS_TRUE`, if the strings are equal, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occurred. -func (s1 *StringView) Compare(s2 *StringView, result *I32) Status { - __res := gengort.CCall3(__imp_ZyanStringCompare.Addr(), gengort.MarshallSyscall(s1), gengort.MarshallSyscall(s2), gengort.MarshallSyscall(result)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringCompareI gengort.PreloadProc - -// Performs a case-insensitive comparison of two strings. -// -// @param s1 The first string -// -// @param s2 The second string. -// -// @param result Receives the comparison result. -// Values: -// - `result -// < -// 0` -> The first character that does not match has a lower value -// in `s1` than in `s2`. -// - `result == 0` -> The contents of both strings are equal. -// - `result > 0` -> The first character that does not match has a greater value -// in `s1` than in `s2`. -// -// @return `ZYAN_STATUS_TRUE`, if the strings are equal, `ZYAN_STATUS_FALSE`, if not, or another -// zyan status code, if an error occurred. -func (s1 *StringView) CompareI(s2 *StringView, result *I32) Status { - __res := gengort.CCall3(__imp_ZyanStringCompareI.Addr(), gengort.MarshallSyscall(s1), gengort.MarshallSyscall(s2), gengort.MarshallSyscall(result)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringToLowerCase gengort.PreloadProc - -// Converts the given string to lowercase letters. -// -// @param string A pointer to the `ZyanString` instance. -// -// @return A zyan status code. -// This function will fail, if the `ZYAN_STRING_IS_IMMUTABLE` flag is set for the specified -// `ZyanString` instance. -func (_string *String) ToLowerCase() Status { - __res := gengort.CCall1(__imp_ZyanStringToLowerCase.Addr(), gengort.MarshallSyscall(_string)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringToLowerCaseEx gengort.PreloadProc - -// Converts `count` characters of the given string to lowercase letters. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param index The start index. -// -// @param count The number of characters to convert, beginning from the start `index`. -// -// @return A zyan status code. -// This function will fail, if the `ZYAN_STRING_IS_IMMUTABLE` flag is set for the specified -// `ZyanString` instance. -func (_string *String) ToLowerCaseEx(index USize, count USize) Status { - __res := gengort.CCall3(__imp_ZyanStringToLowerCaseEx.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringToUpperCase gengort.PreloadProc - -// Converts the given string to uppercase letters. -// -// @param string A pointer to the `ZyanString` instance. -// -// @return A zyan status code. -// This function will fail, if the `ZYAN_STRING_IS_IMMUTABLE` flag is set for the specified -// `ZyanString` instance. -func (_string *String) ToUpperCase() Status { - __res := gengort.CCall1(__imp_ZyanStringToUpperCase.Addr(), gengort.MarshallSyscall(_string)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringToUpperCaseEx gengort.PreloadProc - -// Converts `count` characters of the given string to uppercase letters. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param index The start index. -// -// @param count The number of characters to convert, beginning from the start `index`. -// -// @return A zyan status code. -// This function will fail, if the `ZYAN_STRING_IS_IMMUTABLE` flag is set for the specified -// `ZyanString` instance. -func (_string *String) ToUpperCaseEx(index USize, count USize) Status { - __res := gengort.CCall3(__imp_ZyanStringToUpperCaseEx.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(index), gengort.MarshallSyscall(count)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringResize gengort.PreloadProc - -// Resizes the given `ZyanString` instance. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param size The new size of the string. -// -// @return A zyan status code. -// This function will fail, if the `ZYAN_STRING_IS_IMMUTABLE` flag is set for the specified -// `ZyanString` instance. -func (_string *String) Resize(size USize) Status { - __res := gengort.CCall2(__imp_ZyanStringResize.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(size)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringReserve gengort.PreloadProc - -// Changes the capacity of the given `ZyanString` instance. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param capacity The new minimum capacity of the string. -// -// @return A zyan status code. -// This function will fail, if the `ZYAN_STRING_IS_IMMUTABLE` flag is set for the specified -// `ZyanString` instance. -func (_string *String) Reserve(capacity USize) Status { - __res := gengort.CCall2(__imp_ZyanStringReserve.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringShrinkToFit gengort.PreloadProc - -// Shrinks the capacity of the given string to match it's size. -// -// @param string A pointer to the `ZyanString` instance. -// -// @return A zyan status code. -// This function will fail, if the `ZYAN_STRING_IS_IMMUTABLE` flag is set for the specified -// `ZyanString` instance. -func (_string *String) ShrinkToFit() Status { - __res := gengort.CCall1(__imp_ZyanStringShrinkToFit.Addr(), gengort.MarshallSyscall(_string)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringGetCapacity gengort.PreloadProc - -// Returns the current capacity of the string. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param capacity Receives the size of the string. -// -// @return A zyan status code. -func (_string *String) GetCapacity(capacity *USize) Status { - __res := gengort.CCall2(__imp_ZyanStringGetCapacity.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(capacity)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringGetSize gengort.PreloadProc - -// Returns the current size (number of characters) of the string (excluding the -// terminating zero character). -// -// @param string A pointer to the `ZyanString` instance. -// -// @param size Receives the size (number of characters) of the string. -// -// @return A zyan status code. -func (_string *String) GetSize(size *USize) Status { - __res := gengort.CCall2(__imp_ZyanStringGetSize.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(size)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZyanStringGetData gengort.PreloadProc - -// Returns the C-style string of the given `ZyanString` instance. -// -// @param string A pointer to the `ZyanString` instance. -// -// @param value Receives a pointer to the C-style string. -// -// @return A zyan status code. -func (_string *String) GetData(value **byte) Status { - __res := gengort.CCall2(__imp_ZyanStringGetData.Addr(), gengort.MarshallSyscall(_string), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterTokenGetValue gengort.PreloadProc - -// Returns the `type` and the string `value` of the given `token`. -// -// @param token A pointer to the `ZydisFormatterToken` struct. -// -// @param type Receives the token type. -// -// @param value Receives a pointer to the string value of the token. -// -// @return A zyan status code. -func FormatterTokenGetValue(token *FormatterToken, _type *TokenType, value *ConstCharPointer) Status { - __res := gengort.CCall3(__imp_ZydisFormatterTokenGetValue.Addr(), gengort.MarshallSyscall(token), gengort.MarshallSyscall(_type), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterTokenNext gengort.PreloadProc - -// Obtains the next `token` linked to the passed one. -// -// @param token Receives a pointer to the next `ZydisFormatterToken` struct -// linked to the passed one. -// -// @return A zyan status code. -func FormatterTokenNext(token **FormatterTokenConst) Status { - __res := gengort.CCall1(__imp_ZydisFormatterTokenNext.Addr(), gengort.MarshallSyscall(token)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterBufferGetToken gengort.PreloadProc - -// Returns the current (most recently added) token. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param token Receives a pointer to the current token. -// -// @return A zyan status code. -// This function returns `ZYAN_STATUS_INVALID_OPERATION`, if the buffer does not contain at least -// one token. -func (buffer *FormatterBuffer) GetToken(token **FormatterTokenConst) Status { - __res := gengort.CCall2(__imp_ZydisFormatterBufferGetToken.Addr(), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(token)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterBufferGetString gengort.PreloadProc - -// Returns the `ZyanString` instance associated with the given buffer. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param string Receives a pointer to the `ZyanString` instance associated with the given -// buffer. -// -// @return A zyan status code. -// This function returns `ZYAN_STATUS_INVALID_OPERATION`, if the buffer does not contain at least -// one token. -// The returned string always refers to the literal value of the current (most recently added) -// token and will remain valid until the buffer is destroyed. -func (buffer *FormatterBuffer) GetString(_string **String) Status { - __res := gengort.CCall2(__imp_ZydisFormatterBufferGetString.Addr(), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(_string)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterBufferAppend gengort.PreloadProc - -// Appends a new token to the `buffer`. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param type The type of the new token. -// -// @return A zyan status code. -// Note that the `ZyanString` instance returned by `ZydisFormatterBufferGetString` will -// automatically be updated by calling this function. -func (buffer *FormatterBuffer) Append(_type TokenType) Status { - __res := gengort.CCall2(__imp_ZydisFormatterBufferAppend.Addr(), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(_type)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterBufferRemember gengort.PreloadProc - -// Returns a snapshot of the buffer-state. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param state Receives a snapshot of the buffer-state. -// -// @return A zyan status code. -// Note that the buffer-state is saved inside the buffer itself and thus becomes invalid as soon -// as the buffer gets overwritten or destroyed. -func (buffer *FormatterBuffer) Remember(state *UPointer) Status { - __res := gengort.CCall2(__imp_ZydisFormatterBufferRemember.Addr(), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(state)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterBufferRestore gengort.PreloadProc - -// Restores a previously saved buffer-state. -// -// @param buffer A pointer to the `ZydisFormatterBuffer` struct. -// -// @param state The buffer-state to restore. -// -// @return A zyan status code. -// All tokens added after obtaining the given `state` snapshot will be removed. This function -// does NOT restore any string content. -// Note that the `ZyanString` instance returned by `ZydisFormatterBufferGetString` will -// automatically be updated by calling this function. -func (buffer *FormatterBuffer) Restore(state UPointer) Status { - __res := gengort.CCall2(__imp_ZydisFormatterBufferRestore.Addr(), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(state)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterInit gengort.PreloadProc - -// Initializes the given `ZydisFormatter` instance. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param style The base formatter style (either `AT -// &T -// ` or `Intel` style). -// -// @return A zyan status code. -func (formatter *Formatter) Init(style FormatterStyle) Status { - __res := gengort.CCall2(__imp_ZydisFormatterInit.Addr(), gengort.MarshallSyscall(formatter), gengort.MarshallSyscall(style)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterSetProperty gengort.PreloadProc - -// Changes the value of the specified formatter `property`. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param property The id of the formatter-property. -// -// @param value The new value. -// -// @return A zyan status code. -// This function returns `ZYAN_STATUS_INVALID_OPERATION` if a property can't be changed for the -// current formatter-style. -func (formatter *Formatter) SetProperty(property FormatterProperty, value UPointer) Status { - __res := gengort.CCall3(__imp_ZydisFormatterSetProperty.Addr(), gengort.MarshallSyscall(formatter), gengort.MarshallSyscall(property), gengort.MarshallSyscall(value)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterSetHook gengort.PreloadProc - -// Replaces a formatter function with a custom callback and/or retrieves the currently -// used function. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param type The formatter function-type. -// -// @param callback A pointer to a variable that contains the pointer of the callback function -// and receives the pointer of the currently used function. -// -// @return A zyan status code. -// Call this function with `callback` pointing to a `ZYAN_NULL` value to retrieve the currently -// used function without replacing it. -// This function returns `ZYAN_STATUS_INVALID_OPERATION` if a function can't be replaced for the -// current formatter-style. -func (formatter *Formatter) SetHook(_type FormatterFunction, callback *unsafe.Pointer) Status { - __res := gengort.CCall3(__imp_ZydisFormatterSetHook.Addr(), gengort.MarshallSyscall(formatter), gengort.MarshallSyscall(_type), gengort.MarshallSyscall(callback)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterFormatInstruction gengort.PreloadProc - -// Formats the given instruction and writes it into the output buffer. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operands A pointer to the decoded operands array. -// -// @param operand_count The length of the `operands` array. Must be equal to or greater than -// the value of `instruction->operand_count_visible`. -// -// @param buffer A pointer to the output buffer. -// -// @param length The length of the output buffer (in characters). -// -// @param runtime_address The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` -// to print relative addresses. -// -// @param user_data A pointer to user-defined data which can be used in custom formatter -// callbacks. Can be `ZYAN_NULL`. -// -// @return A zyan status code. -func (formatter *Formatter) FormatInstruction(instruction *DecodedInstruction, operands *DecodedOperand, operand_count U8, buffer *byte, length USize, runtime_address U64, user_data unsafe.Pointer) Status { - __res := gengort.CCall8(__imp_ZydisFormatterFormatInstruction.Addr(), gengort.MarshallSyscall(formatter), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operands), gengort.MarshallSyscall(operand_count), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(user_data)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterFormatOperand gengort.PreloadProc - -// Formats the given operand and writes it into the output buffer. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operand A pointer to the `ZydisDecodedOperand` struct of the operand to format. -// -// @param buffer A pointer to the output buffer. -// -// @param length The length of the output buffer (in characters). -// -// @param runtime_address The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` -// to print relative addresses. -// -// @param user_data A pointer to user-defined data which can be used in custom formatter -// callbacks. Can be `ZYAN_NULL`. -// -// @return A zyan status code. -// Use `ZydisFormatterFormatInstruction` or `ZydisFormatterFormatInstructionEx` to format a -// complete instruction. -func (formatter *Formatter) FormatOperand(instruction *DecodedInstruction, operand *DecodedOperand, buffer *byte, length USize, runtime_address U64, user_data unsafe.Pointer) Status { - __res := gengort.CCall7(__imp_ZydisFormatterFormatOperand.Addr(), gengort.MarshallSyscall(formatter), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operand), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(user_data)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterTokenizeInstruction gengort.PreloadProc - -// Tokenizes the given instruction and writes it into the output buffer. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operands A pointer to the decoded operands array. -// -// @param operand_count The length of the `operands` array. Must be equal to or greater than -// the value of `instruction->operand_count_visible`. -// -// @param buffer A pointer to the output buffer. -// -// @param length The length of the output buffer (in bytes). -// -// @param runtime_address The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` -// to print relative addresses. -// -// @param token Receives a pointer to the first token in the output buffer. -// -// @param user_data A pointer to user-defined data which can be used in custom formatter -// callbacks. Can be `ZYAN_NULL`. -// -// @return A zyan status code. -func (formatter *Formatter) TokenizeInstruction(instruction *DecodedInstruction, operands *DecodedOperand, operand_count U8, buffer unsafe.Pointer, length USize, runtime_address U64, token **FormatterTokenConst, user_data unsafe.Pointer) Status { - __res := gengort.CCall9(__imp_ZydisFormatterTokenizeInstruction.Addr(), gengort.MarshallSyscall(formatter), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operands), gengort.MarshallSyscall(operand_count), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(token), gengort.MarshallSyscall(user_data)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisFormatterTokenizeOperand gengort.PreloadProc - -// Tokenizes the given operand and writes it into the output buffer. -// -// @param formatter A pointer to the `ZydisFormatter` instance. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operand A pointer to the `ZydisDecodedOperand` struct of the operand to format. -// -// @param buffer A pointer to the output buffer. -// -// @param length The length of the output buffer (in bytes). -// -// @param runtime_address The runtime address of the instruction or `ZYDIS_RUNTIME_ADDRESS_NONE` -// to print relative addresses. -// -// @param token Receives a pointer to the first token in the output buffer. -// -// @param user_data A pointer to user-defined data which can be used in custom formatter -// callbacks. Can be `ZYAN_NULL`. -// -// @return A zyan status code. -// Use `ZydisFormatterTokenizeInstruction` to tokenize a complete instruction. -func (formatter *Formatter) TokenizeOperand(instruction *DecodedInstruction, operand *DecodedOperand, buffer unsafe.Pointer, length USize, runtime_address U64, token **FormatterTokenConst, user_data unsafe.Pointer) Status { - __res := gengort.CCall8(__imp_ZydisFormatterTokenizeOperand.Addr(), gengort.MarshallSyscall(formatter), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operand), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(token), gengort.MarshallSyscall(user_data)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisGetInstructionSegments gengort.PreloadProc - -// Returns offsets and sizes of all logical instruction segments (e.g. `OPCODE`, -// `MODRM`, ...). -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param segments Receives the instruction segments information. -// -// @return A zyan status code. -func GetInstructionSegments(instruction *DecodedInstruction, segments *InstructionSegments) Status { - __res := gengort.CCall2(__imp_ZydisGetInstructionSegments.Addr(), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(segments)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisDisassembleIntel gengort.PreloadProc - -// Disassemble an instruction and format it to human-readable text in a single step (Intel syntax). -// -// @param machine_mode The machine mode to assume when disassembling. When in doubt, pass -// `ZYDIS_MACHINE_MODE_LONG_64` for what is typically referred to as -// "64-bit mode" or `ZYDIS_MACHINE_MODE_LEGACY_32` for "32-bit mode". -// -// @param runtime_address The program counter (`eip` / `rip`) to assume when formatting the -// instruction. Many instructions behave differently depending on the -// address they are located at. -// -// @param buffer A pointer to the raw instruction bytes that you wish to decode. -// -// @param length The length of the input buffer. Note that this can be bigger than the -// actual size of the instruction -- you don't have to know the size up -// front. This length is merely used to prevent Zydis from doing -// out-of-bounds reads on your buffer. -// -// @param instruction A pointer to receive the decoded instruction information. Can be -// uninitialized and reused on later calls. -// This is a convenience function intended as a quick path for getting started with using Zydis. -// It internally calls a range of other more advanced functions to obtain all commonly needed -// information about the instruction. It is likely that you won't need most of this information in -// practice, so it is advisable to instead call these more advanced functions directly if you're -// concerned about performance. -// This function essentially combines the following more advanced functions into a single call: -// - `ZydisDecoderInit` -// - `ZydisDecoderDecodeInstruction` -// - `ZydisDecoderDecodeOperands` -// - `ZydisFormatterInit` -// - `ZydisFormatterFormatInstruction` -// -// @return A zyan status code. -func DisassembleIntel(machine_mode MachineMode, runtime_address U64, buffer unsafe.Pointer, length USize, instruction *DisassembledInstruction) Status { - __res := gengort.CCall5(__imp_ZydisDisassembleIntel.Addr(), gengort.MarshallSyscall(machine_mode), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(instruction)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisDisassembleATT gengort.PreloadProc - -// Disassemble an instruction and format it to human-readable text in a single step (AT -// &T -// syntax). -// -// @copydetails ZydisDisassembleIntel -func DisassembleATT(machine_mode MachineMode, runtime_address U64, buffer unsafe.Pointer, length USize, instruction *DisassembledInstruction) Status { - __res := gengort.CCall5(__imp_ZydisDisassembleATT.Addr(), gengort.MarshallSyscall(machine_mode), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(buffer), gengort.MarshallSyscall(length), gengort.MarshallSyscall(instruction)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisCalcAbsoluteAddress gengort.PreloadProc - -// Calculates the absolute address value for the given instruction operand. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operand A pointer to the `ZydisDecodedOperand` struct. -// -// @param runtime_address The runtime address of the instruction. -// -// @param result_address A pointer to the memory that receives the absolute address. -// -// @return A zyan status code. -// You should use this function in the following cases: -// - `IMM` operands with relative address (e.g. `JMP`, `CALL`, ...) -// - `MEM` operands with `RIP`/`EIP`-relative address (e.g. `MOV RAX, [RIP+0x12345678]`) -// - `MEM` operands with absolute address (e.g. `MOV RAX, [0x12345678]`) -// - The displacement needs to get truncated and zero extended -func CalcAbsoluteAddress(instruction *DecodedInstruction, operand *DecodedOperand, runtime_address U64, result_address *U64) Status { - __res := gengort.CCall4(__imp_ZydisCalcAbsoluteAddress.Addr(), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operand), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(result_address)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisCalcAbsoluteAddressEx gengort.PreloadProc - -// Calculates the absolute address value for the given instruction operand. -// -// @param instruction A pointer to the `ZydisDecodedInstruction` struct. -// -// @param operand A pointer to the `ZydisDecodedOperand` struct. -// -// @param runtime_address The runtime address of the instruction. -// -// @param register_context A pointer to the `ZydisRegisterContext` struct. -// -// @param result_address A pointer to the memory that receives the absolute target-address. -// -// @return A zyan status code. -// This function behaves like `ZydisCalcAbsoluteAddress` but takes an additional register-context -// argument to allow calculation of addresses depending on runtime register values. -// Note that `IP/EIP/RIP` from the register-context will be ignored in favor of the passed -// runtime-address. -func CalcAbsoluteAddressEx(instruction *DecodedInstruction, operand *DecodedOperand, runtime_address U64, register_context *RegisterContext, result_address *U64) Status { - __res := gengort.CCall5(__imp_ZydisCalcAbsoluteAddressEx.Addr(), gengort.MarshallSyscall(instruction), gengort.MarshallSyscall(operand), gengort.MarshallSyscall(runtime_address), gengort.MarshallSyscall(register_context), gengort.MarshallSyscall(result_address)) - return gengort.UnmarshallSyscall[Status](__res) -} - -var __imp_ZydisGetVersion gengort.PreloadProc - -// Returns the zydis version. -// -// @return The zydis version. -// Use the macros provided in this file to extract the major, minor, patch and build part from the -// returned version value. -func GetVersion() U64 { - __res := gengort.CCall0(__imp_ZydisGetVersion.Addr()) - return gengort.UnmarshallSyscall[U64](__res) -} - -var __imp_ZydisIsFeatureEnabled gengort.PreloadProc - -// Checks, if the specified feature is enabled in the current zydis library instance. -// -// @param feature The feature. -// -// @return `ZYAN_STATUS_TRUE` if the feature is enabled, `ZYAN_STATUS_FALSE` if not. Another -// zyan status code, if an error occured. -func IsFeatureEnabled(feature Feature) Status { - __res := gengort.CCall1(__imp_ZydisIsFeatureEnabled.Addr(), gengort.MarshallSyscall(feature)) - return gengort.UnmarshallSyscall[Status](__res) -} - -// The buffer that contains the actual (null-terminated) string. -func (s ShortString) Data() *byte { - return gengort.ReadBitcast[*byte](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -// The buffer that contains the actual (null-terminated) string. -func (s *ShortString) SetData(v *byte) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -// The length (number of characters) of the string (without 0-termination). -func (s ShortString) Size() U8 { - return gengort.ReadBitcast[U8](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 8)) -} - -// The length (number of characters) of the string (without 0-termination). -func (s *ShortString) SetSize(v U8) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 8), v) -} - -func (s DecodedOperandImmValue_) U() U64 { - return gengort.ReadBitcast[U64](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *DecodedOperandImmValue_) SetU(v U64) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s DecodedOperandImmValue_) S() I64 { - return gengort.ReadBitcast[I64](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *DecodedOperandImmValue_) SetS(v I64) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon5338_5) Reg() DecodedOperandReg { - return gengort.ReadBitcast[DecodedOperandReg](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon5338_5) SetReg(v DecodedOperandReg) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon5338_5) Mem() DecodedOperandMem { - return gengort.ReadBitcast[DecodedOperandMem](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon5338_5) SetMem(v DecodedOperandMem) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon5338_5) Ptr() DecodedOperandPtr { - return gengort.ReadBitcast[DecodedOperandPtr](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon5338_5) SetPtr(v DecodedOperandPtr) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon5338_5) Imm() DecodedOperandImm { - return gengort.ReadBitcast[DecodedOperandImm](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon5338_5) SetImm(v DecodedOperandImm) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon6217_5) Rex() DecodedInstructionRawRex { - return gengort.ReadBitcast[DecodedInstructionRawRex](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon6217_5) SetRex(v DecodedInstructionRawRex) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon6217_5) Xop() DecodedInstructionRawXop { - return gengort.ReadBitcast[DecodedInstructionRawXop](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon6217_5) SetXop(v DecodedInstructionRawXop) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon6217_5) Vex() DecodedInstructionRawVex { - return gengort.ReadBitcast[DecodedInstructionRawVex](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon6217_5) SetVex(v DecodedInstructionRawVex) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon6217_5) Evex() DecodedInstructionRawEvex { - return gengort.ReadBitcast[DecodedInstructionRawEvex](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon6217_5) SetEvex(v DecodedInstructionRawEvex) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s Anon6217_5) Mvex() DecodedInstructionRawMvex { - return gengort.ReadBitcast[DecodedInstructionRawMvex](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *Anon6217_5) SetMvex(v DecodedInstructionRawMvex) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s DecodedInstructionRawImmValue_) U() U64 { - return gengort.ReadBitcast[U64](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *DecodedInstructionRawImmValue_) SetU(v U64) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -func (s DecodedInstructionRawImmValue_) S() I64 { - return gengort.ReadBitcast[I64](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -func (s *DecodedInstructionRawImmValue_) SetS(v I64) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -// The unsigned immediate value. -func (s EncoderOperandImm_) U() U64 { - return gengort.ReadBitcast[U64](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -// The unsigned immediate value. -func (s *EncoderOperandImm_) SetU(v U64) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} - -// The signed immediate value. -func (s EncoderOperandImm_) S() I64 { - return gengort.ReadBitcast[I64](unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0)) -} - -// The signed immediate value. -func (s *EncoderOperandImm_) SetS(v I64) { - gengort.WriteBitcast(unsafe.Add(unsafe.Pointer(unsafe.SliceData(s.Raw[:])), 0), v) -} diff --git a/gengo/bind/zydis/zydis_test.go b/gengo/bind/zydis/zydis_test.go index 3aa121460..d3b7480e6 100644 --- a/gengo/bind/zydis/zydis_test.go +++ b/gengo/bind/zydis/zydis_test.go @@ -10,10 +10,11 @@ import ( func TestGetVersion(t *testing.T) { mylog.Todo("panic: Failed to find ZydisCategoryGetString procedure in zydis: The specified procedure could not be found.") - GetVersion() + // GetVersion() } func TestZydis(t *testing.T) { + mylog.SetDebug(false) pkg := gengo.NewPackage("zydis", gengo.WithRemovePrefix( "Zydis_", "Zyan_", "Zycore_", @@ -42,8 +43,8 @@ func TestZydis(t *testing.T) { Sources: []string{"amalgamated-dist/Zydis.h"}, AdditionalParams: []string{ "-DZYAN_NO_LIBC", - "-DZYAN_STATIC_ASSERT", + //"-DZYAN_STATIC_ASSERT", }, })) - mylog.Check(pkg.WriteToDir(".")) + mylog.Check(pkg.WriteToDir("./tmp")) } diff --git a/gengo/clang/invoke.go b/gengo/clang/invoke.go index 8d323ecb0..c610c8b94 100644 --- a/gengo/clang/invoke.go +++ b/gengo/clang/invoke.go @@ -81,7 +81,7 @@ func Parse(opt *Options) (ast Node, layout *LayoutMap, err error) { //errg.Go(func() error { res := mylog.Check2(CreateAST(opt)) stream.WriteTruncate("ast.json", res) - ast = mylog.Check2(ParseAST(res)) + ast = mylog.Check2(ParseAST(res)) //must ok res = mylog.Check2(CreateLayoutMap(opt)) stream.WriteTruncate("astLayout.log", res)