#include "debugger.h"
#include "codeblocks.h"
#include "decoder.h"
#include "deployer.h"
#include "gpacache.h"
#include "hook.h"
#include "hook_cr.h"
#include "icache.h"
#include "introapi.h"
#include "kernvm.h"
#include "memcloak.h"
#include "ptfilter.h"
#include "swapmem.h"
#include "vasmonitor.h"
#include "vecore.h"
#include "visibility.h"
#include "winnet.h"
#include "winpe.h"
#include "winpfn.h"
#include "winprocesshp.h"
#include "lixksym.h"
#include "swapgs.h"

Data Structures
struct	_DEBUGGER_COMMAND

Typedefs
typedef void(*	PFUNC_DebuggerFunctionArgs) (DWORD Argc, const char *Argv[])

typedef void(*	PFUNC_DebuggerFunctionNoArgs) (void)

typedef struct _DEBUGGER_COMMAND	DEBUGGER_COMMAND

Functions
static INTSTATUS	DbgSwapCallback (void Context, QWORD Cr3, QWORD VirtualAddress, QWORD PhysicalAddress, void Data, DWORD DataSize, DWORD Flags)

static INTSTATUS	DbgVaModificationHandler (void *Context, QWORD VirtualAddress, QWORD OldEntry, QWORD NewEntry, QWORD OldPageSize, QWORD NewPageSize)

static INTSTATUS	DbgVaSpaceIterationCallback (QWORD Cr3, QWORD VirtualAddress, QWORD Entry, QWORD PageSize)

static INTSTATUS	DbgVaSpaceIterationCallbackCount (QWORD Cr3, QWORD VirtualAddress, QWORD PhysicalAddress, QWORD PageSize)

static void	IntDbgCheckHooks (void)

static void	DbgDumpKmException (KM_EXCEPTION *Exception)

static void	DbgDumpUmException (UM_EXCEPTION *Exception)

static void	DbgDumpUmExceptionGlobMatch (UM_EXCEPTION_GLOB *Exception)

static INTSTATUS	DbgCrWriteTestCallback (void Context, DWORD Cr, QWORD OldValue, QWORD NewValue, INTRO_ACTION Action)

static void	DbgShowHelp (void)

static void	DbgDumpGuestModules (void)

static void	DbgInjectPf (DWORD Argc, const char *Argv[])

static void	DbgDumpPfn (DWORD Argc, const char *Argv[])

static void	DbgDumpCodeblocks (DWORD Argc, const char *Argv[])

static void	DbgDumpExceptions (void)

static void	DbgDumpHooksGva (void)

static void	DbgDumpProcesses (void)

static void	DbgProcAdd (DWORD Argc, const char *Argv[])

static void	DbgProcRem (DWORD Argc, const char *Argv[])

static void	DbgProcClear (void)

static void	DbgProcList (void)

static void	DbgDumpGpaCache (void)

static void	DbgDisasm (DWORD Argc, const char *Argv[])

static void	DbgInjectAgent (DWORD Argc, const char *Argv[])

static void	DbgInjectFileAgent (DWORD Argc, const char *Argv[])

static void	DbgSearchVaSpace (DWORD Argc, const char *Argv[])

static void	DbgIterateVaSpace (void)

static void	DbgDumpTranslation (DWORD Argc, const char *Argv[])

static void	DbgPtsHook (DWORD Argc, const char *Argv[])

static void	DbgPtsUnhook (DWORD Argc, const char *Argv[])

static void	DbgPtsWrite (DWORD Argc, const char *Argv[])

static void	DbgDumpCpuState (void)

static void	DbgLogCoreOptions (void)

static void	DbgSetCoreOptions (DWORD Argc, const char *Argv[])

static void	DbgLogCurrentProcess (void)

static void	DbgFindKsym (DWORD Argc, const char *Argv[])

static void	DbgLogKpcr (void)

static void	DbgDumpProcToken (DWORD Argc, const char *Argv[])

static void	DbgDumpEthreadToken (DWORD Argc, const char *Argv[])

static void	DbgDumpVaSpace (DWORD Argc, const char *Argv[])

static void	DbgSwap (DWORD Argc, const char *Argv[])

static void	DbgDumpVadRoot (DWORD Argc, const char *Argv[])

static void	DbgDumpVads (DWORD Argc, const char *Argv[])

static void	DbgVadFind (DWORD Argc, const char *Argv[])

static void	DbgLogFilePath (DWORD Argc, const char *Argv[])

static void	DbgLoadPt (void)

static void	DbgUnloadPt (void)

static void	DbgLoadVe (void)

static void	DbgUnloadVe (void)

static void	DbgTestSse (DWORD Argc, const char *Argv[])

static void	DbgTestRead (DWORD Argc, const char *Argv[])

static void	DbgTestCrHookSet (DWORD Argc, const char *Argv[])

static void	DbgTestCrHookRem (DWORD Argc, const char *Argv[])

static void	DbgFailAllocs (void)

static void	DbgCheckEpt (void)

static void	DbgSetLogLevel (DWORD Argc, const char *Argv[])

static void	DbgMitigateSwapgs (DWORD Argc, const char *Argv[])

INTSTATUS	IntDbgProcessCommand (DWORD Argc, const char *Argv[])

Variables
BOOLEAN	gFailAllocs = FALSE

BOOLEAN	gInsideDebugger = FALSE
	Set to True when introcore is inside a debugger. More...

LIST_HEAD	gWinProcesses
	The list of all the processes inside the guest. More...

BOOLEAN	gLoadPtDriver

BOOLEAN	gUnloadPtDriver

BOOLEAN	gInjectVeLoader

BOOLEAN	gInjectVeUnloader

static QWORD	gTargetPML4

static QWORD	gPagesRead

static QWORD	gPagesWrite

static QWORD	gPagesDirty

static BYTE *	gPagesBitmap = NULL

BOOLEAN	swapgsMit = FALSE

static DEBUGGER_COMMAND	gDbgCommands []

Typedef Documentation

◆ DEBUGGER_COMMAND

typedef struct _DEBUGGER_COMMAND DEBUGGER_COMMAND

◆ PFUNC_DebuggerFunctionArgs

typedef void(* PFUNC_DebuggerFunctionArgs) (DWORD Argc, const char *Argv[])

Definition at line 37 of file debugger.c.

◆ PFUNC_DebuggerFunctionNoArgs

typedef void(* PFUNC_DebuggerFunctionNoArgs) (void)

Definition at line 42 of file debugger.c.

Function Documentation

◆ DbgCheckEpt()

static void DbgCheckEpt ( void )

static

Definition at line 2359 of file debugger.c.

◆ DbgCrWriteTestCallback()

static INTSTATUS DbgCrWriteTestCallback	(	void *	Context,
		DWORD	Cr,
		QWORD	OldValue,
		QWORD	NewValue,
		INTRO_ACTION *	Action
	)

static

Definition at line 392 of file debugger.c.

Referenced by DbgTestCrHookSet().

◆ DbgDisasm()

static void DbgDisasm	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1494 of file debugger.c.

◆ DbgDumpCodeblocks()

static void DbgDumpCodeblocks	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 881 of file debugger.c.

◆ DbgDumpCpuState()

static void DbgDumpCpuState ( void )

static

Definition at line 1766 of file debugger.c.

◆ DbgDumpEthreadToken()

static void DbgDumpEthreadToken	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1954 of file debugger.c.

◆ DbgDumpExceptions()

static void DbgDumpExceptions ( void )

static

Definition at line 981 of file debugger.c.

◆ DbgDumpGpaCache()

static void DbgDumpGpaCache ( void )

static

Definition at line 1485 of file debugger.c.

◆ DbgDumpGuestModules()

static void DbgDumpGuestModules ( void )

static

Definition at line 652 of file debugger.c.

◆ DbgDumpHooksGva()

static void DbgDumpHooksGva ( void )

static

Definition at line 1250 of file debugger.c.

◆ DbgDumpKmException()

static void DbgDumpKmException ( KM_EXCEPTION * Exception )

static

Definition at line 249 of file debugger.c.

Referenced by DbgDumpExceptions().

◆ DbgDumpPfn()

static void DbgDumpPfn	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 782 of file debugger.c.

◆ DbgDumpProcesses()

static void DbgDumpProcesses ( void )

static

Definition at line 1301 of file debugger.c.

◆ DbgDumpProcToken()

static void DbgDumpProcToken	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1916 of file debugger.c.

◆ DbgDumpTranslation()

static void DbgDumpTranslation	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1639 of file debugger.c.

◆ DbgDumpUmException()

static void DbgDumpUmException ( UM_EXCEPTION * Exception )

static

Definition at line 296 of file debugger.c.

Referenced by DbgDumpExceptions().

◆ DbgDumpUmExceptionGlobMatch()

static void DbgDumpUmExceptionGlobMatch ( UM_EXCEPTION_GLOB * Exception )

static

Definition at line 344 of file debugger.c.

Referenced by DbgDumpExceptions().

◆ DbgDumpVadRoot()

static void DbgDumpVadRoot	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2052 of file debugger.c.

◆ DbgDumpVads()

static void DbgDumpVads	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2107 of file debugger.c.

◆ DbgDumpVaSpace()

static void DbgDumpVaSpace	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1996 of file debugger.c.

◆ DbgFailAllocs()

static void DbgFailAllocs ( void )

static

Definition at line 2348 of file debugger.c.

◆ DbgFindKsym()

static void DbgFindKsym	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1835 of file debugger.c.

◆ DbgInjectAgent()

static void DbgInjectAgent	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1526 of file debugger.c.

◆ DbgInjectFileAgent()

static void DbgInjectFileAgent	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1553 of file debugger.c.

◆ DbgInjectPf()

static void DbgInjectPf	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 755 of file debugger.c.

◆ DbgIterateVaSpace()

static void DbgIterateVaSpace ( void )

static

Definition at line 1604 of file debugger.c.

◆ DbgLoadPt()

static void DbgLoadPt ( void )

static

Definition at line 2165 of file debugger.c.

◆ DbgLoadVe()

static void DbgLoadVe ( void )

static

Definition at line 2183 of file debugger.c.

◆ DbgLogCoreOptions()

static void DbgLogCoreOptions ( void )

static

Definition at line 1786 of file debugger.c.

◆ DbgLogCurrentProcess()

static void DbgLogCurrentProcess ( void )

static

Definition at line 1817 of file debugger.c.

◆ DbgLogFilePath()

static void DbgLogFilePath	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2152 of file debugger.c.

◆ DbgLogKpcr()

static void DbgLogKpcr ( void )

static

Definition at line 1883 of file debugger.c.

◆ DbgMitigateSwapgs()

static void DbgMitigateSwapgs	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2406 of file debugger.c.

◆ DbgProcAdd()

static void DbgProcAdd	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1317 of file debugger.c.

◆ DbgProcClear()

static void DbgProcClear ( void )

static

Definition at line 1460 of file debugger.c.

◆ DbgProcList()

static void DbgProcList ( void )

static

Definition at line 1469 of file debugger.c.

◆ DbgProcRem()

static void DbgProcRem	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1389 of file debugger.c.

◆ DbgPtsHook()

static void DbgPtsHook	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1676 of file debugger.c.

◆ DbgPtsUnhook()

static void DbgPtsUnhook	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1710 of file debugger.c.

◆ DbgPtsWrite()

static void DbgPtsWrite	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1736 of file debugger.c.

◆ DbgSearchVaSpace()

static void DbgSearchVaSpace	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1579 of file debugger.c.

◆ DbgSetCoreOptions()

static void DbgSetCoreOptions	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 1795 of file debugger.c.

◆ DbgSetLogLevel()

static void DbgSetLogLevel	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2379 of file debugger.c.

◆ DbgShowHelp()

static void DbgShowHelp ( void )

static

Definition at line 2822 of file debugger.c.

Referenced by DbgCrWriteTestCallback().

◆ DbgSwap()

static void DbgSwap	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2021 of file debugger.c.

◆ DbgSwapCallback()

static INTSTATUS DbgSwapCallback	(	void *	Context,
		QWORD	Cr3,
		QWORD	VirtualAddress,
		QWORD	PhysicalAddress,
		void *	Data,
		DWORD	DataSize,
		DWORD	Flags
	)

static

Definition at line 48 of file debugger.c.

Referenced by DbgSwap().

◆ DbgTestCrHookRem()

static void DbgTestCrHookRem	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2323 of file debugger.c.

◆ DbgTestCrHookSet()

static void DbgTestCrHookSet	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2293 of file debugger.c.

◆ DbgTestRead()

static void DbgTestRead	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2257 of file debugger.c.

◆ DbgTestSse()

static void DbgTestSse	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2201 of file debugger.c.

◆ DbgUnloadPt()

static void DbgUnloadPt ( void )

static

Definition at line 2174 of file debugger.c.

◆ DbgUnloadVe()

static void DbgUnloadVe ( void )

static

Definition at line 2192 of file debugger.c.

◆ DbgVadFind()

static void DbgVadFind	(	DWORD	Argc,
		const char *	Argv[]
	)

static

Definition at line 2126 of file debugger.c.

◆ DbgVaModificationHandler()

static INTSTATUS DbgVaModificationHandler	(	void *	Context,
		QWORD	VirtualAddress,
		QWORD	OldEntry,
		QWORD	NewEntry,
		QWORD	OldPageSize,
		QWORD	NewPageSize
	)

static

Definition at line 69 of file debugger.c.

Referenced by DbgPtsHook().

◆ DbgVaSpaceIterationCallback()

static INTSTATUS DbgVaSpaceIterationCallback	(	QWORD	Cr3,
		QWORD	VirtualAddress,
		QWORD	Entry,
		QWORD	PageSize
	)

static

Definition at line 98 of file debugger.c.

Referenced by DbgSearchVaSpace().

◆ DbgVaSpaceIterationCallbackCount()

static INTSTATUS DbgVaSpaceIterationCallbackCount	(	QWORD	Cr3,
		QWORD	VirtualAddress,
		QWORD	PhysicalAddress,
		QWORD	PageSize
	)

static

Definition at line 120 of file debugger.c.

Referenced by DbgIterateVaSpace().

◆ IntDbgCheckHooks()

static void IntDbgCheckHooks ( void )

static

Definition at line 182 of file debugger.c.

Referenced by IntHookCommitAllHooks().

◆ IntDbgProcessCommand()

INTSTATUS IntDbgProcessCommand	(	DWORD	Argc,
		const char *	Argv[]
	)

Definition at line 2857 of file debugger.c.

Referenced by IntDbgEnterDebugger2(), and IntProcessDebugCommand().

Variable Documentation

◆ gDbgCommands

DEBUGGER_COMMAND gDbgCommands[]

static

Definition at line 2443 of file debugger.c.

◆ gFailAllocs

BOOLEAN gFailAllocs = FALSE

Definition at line 27 of file debugger.c.

Referenced by DbgFailAllocs().

◆ gInjectVeLoader

BOOLEAN gInjectVeLoader

Definition at line 30 of file callbacks.c.

Referenced by DbgLoadVe(), and IntHandleTimer().

◆ gInjectVeUnloader

BOOLEAN gInjectVeUnloader

Definition at line 30 of file callbacks.c.

Referenced by DbgUnloadVe(), and IntHandleTimer().

◆ gInsideDebugger

BOOLEAN gInsideDebugger = FALSE

Set to True when introcore is inside a debugger.

This is used to avoid pausing VCPUs while trapped inside a debugger, as that can lead to deadlocks

Definition at line 28 of file debugger.c.

Referenced by IntDbgProcessCommand(), IntPauseVcpus(), and IntResumeVcpus().

◆ gLoadPtDriver

BOOLEAN gLoadPtDriver

Definition at line 31 of file callbacks.c.

Referenced by DbgLoadPt(), and IntHandleTimer().

◆ gPagesBitmap

BYTE* gPagesBitmap = NULL

static

Definition at line 116 of file debugger.c.

◆ gPagesDirty

QWORD gPagesDirty

static

Definition at line 115 of file debugger.c.

◆ gPagesRead

QWORD gPagesRead

static

Definition at line 115 of file debugger.c.

◆ gPagesWrite

QWORD gPagesWrite

static

Definition at line 115 of file debugger.c.

◆ gTargetPML4

QWORD gTargetPML4

static

Definition at line 94 of file debugger.c.

◆ gUnloadPtDriver

BOOLEAN gUnloadPtDriver

Definition at line 31 of file callbacks.c.

Referenced by DbgUnloadPt(), and IntHandleTimer().

◆ gWinProcesses

LIST_HEAD gWinProcesses

The list of all the processes inside the guest.

Definition at line 11 of file winprocesshp.c.

◆ swapgsMit

BOOLEAN swapgsMit = FALSE

Definition at line 2403 of file debugger.c.

Data Structures

Typedefs

Functions

Variables

Typedef Documentation

◆ DEBUGGER_COMMAND

◆ PFUNC_DebuggerFunctionArgs

◆ PFUNC_DebuggerFunctionNoArgs

Function Documentation

◆ DbgCheckEpt()

◆ DbgCrWriteTestCallback()

◆ DbgDisasm()

◆ DbgDumpCodeblocks()

◆ DbgDumpCpuState()

◆ DbgDumpEthreadToken()

◆ DbgDumpExceptions()

◆ DbgDumpGpaCache()

◆ DbgDumpGuestModules()

◆ DbgDumpHooksGva()

◆ DbgDumpKmException()

◆ DbgDumpPfn()

◆ DbgDumpProcesses()

◆ DbgDumpProcToken()

◆ DbgDumpTranslation()

◆ DbgDumpUmException()

◆ DbgDumpUmExceptionGlobMatch()

◆ DbgDumpVadRoot()

◆ DbgDumpVads()

◆ DbgDumpVaSpace()

◆ DbgFailAllocs()

◆ DbgFindKsym()

◆ DbgInjectAgent()

◆ DbgInjectFileAgent()

◆ DbgInjectPf()

◆ DbgIterateVaSpace()

◆ DbgLoadPt()

◆ DbgLoadVe()

◆ DbgLogCoreOptions()

◆ DbgLogCurrentProcess()

◆ DbgLogFilePath()

◆ DbgLogKpcr()

◆ DbgMitigateSwapgs()

◆ DbgProcAdd()

◆ DbgProcClear()

◆ DbgProcList()

◆ DbgProcRem()

◆ DbgPtsHook()

◆ DbgPtsUnhook()

◆ DbgPtsWrite()

◆ DbgSearchVaSpace()

◆ DbgSetCoreOptions()

◆ DbgSetLogLevel()

◆ DbgShowHelp()

◆ DbgSwap()

◆ DbgSwapCallback()

◆ DbgTestCrHookRem()

◆ DbgTestCrHookSet()

◆ DbgTestRead()

◆ DbgTestSse()

◆ DbgUnloadPt()

◆ DbgUnloadVe()

◆ DbgVadFind()

◆ DbgVaModificationHandler()

◆ DbgVaSpaceIterationCallback()

◆ DbgVaSpaceIterationCallbackCount()

◆ IntDbgCheckHooks()

◆ IntDbgProcessCommand()

Variable Documentation

◆ gDbgCommands

◆ gFailAllocs

◆ gInjectVeLoader

◆ gInjectVeUnloader

◆ gInsideDebugger

◆ gLoadPtDriver

◆ gPagesBitmap

◆ gPagesDirty

◆ gPagesRead

◆ gPagesWrite

◆ gTargetPML4

◆ gUnloadPtDriver