├── .gitignore ├── ExdiKdSample ├── dirs ├── ExdiKdSample │ ├── ReadMe.txt │ ├── resource.h │ ├── ExdiKdSample.rc │ ├── GeneratedSources │ │ ├── ExdiKDSample.tlb │ │ ├── dlldata.c │ │ └── ExdiKdSample_i.c │ ├── ExdiKdSample.rgs │ ├── targetver.h │ ├── stdafx.cpp │ ├── LiveExdiSampleServer.rgs │ ├── ExdiKdSample.def │ ├── dllmain.h │ ├── dllmain.cpp │ ├── StaticExdiSampleServer.rgs │ ├── stdafx.h │ ├── ComHelpers.h │ ├── ExdiKdSample.idl │ ├── ExdiKdSample.vcxproj.user │ ├── sources │ ├── ExdiKdSample.cpp │ ├── KDCommandLogger.h │ ├── InterfaceMarshalHelper.h │ ├── BasicExdiBreakpoint.h │ ├── ArgumentHelpers.h │ ├── LiveExdiSampleServer.h │ └── dbgeng_exdi_io.h ├── readme.docx ├── images │ ├── EXDI6.png │ ├── EXDI7.png │ ├── EXDI8.png │ ├── EXDI9.png │ ├── EXDi.png │ ├── EXDi2.png │ ├── EXDi3.png │ ├── EXDi4.png │ ├── EXDi5.png │ └── EXDI10.png ├── KdControllerLib │ ├── KdControllerLib.vcxproj.user │ ├── stdafx.cpp │ ├── stdafx.h │ ├── targetver.h │ ├── sources │ ├── ExceptionHelpers.h │ ├── AsynchronousKDController.h │ ├── BufferedStreamReader.h │ ├── KdControllerLib.vcxproj.filters │ ├── HandleHelpers.h │ ├── KDController.h │ ├── BufferWrapper.h │ ├── BufferedStreamReader.cpp │ ├── AsynchronousKdController.cpp │ └── KdControllerLib.vcxproj ├── KernelConnect0198271677.debugTarget ├── Readme.md └── ExdiKdSample.sln ├── hvmm ├── hvmm │ ├── hvmm.h │ ├── lib │ │ └── Win1017666 │ │ │ ├── winhvr.exp │ │ │ ├── winhvr.lib │ │ │ ├── winhvr.sys │ │ │ ├── create_lib.bat │ │ │ ├── Developer Command Prompt for VS 2017.lnk │ │ │ ├── winhvr_short.def │ │ │ └── winhvr.def │ ├── hvmm.inf │ ├── hvmm.vcxproj.user │ ├── mDbgPrint.h │ ├── hvmm.vcxproj.filters │ ├── AMD64.asm │ ├── misc.c │ ├── mWin.h │ ├── hvmm.c │ └── hvmm.vcxproj └── hvmm.sln ├── images ├── image02.png ├── image03.png ├── image04.png └── screen.png ├── LiveCloudKd ├── stdafx.h ├── stdafx.cpp ├── targetver.h ├── resource.h ├── LiveCloudKd.vcxproj.user ├── file.c ├── LiveCloudKd.sln ├── LiveCloudKd.vcxproj.filters ├── hvdd.h ├── misc.h ├── misc.c ├── hooker.h └── dmp.h ├── LiveCloudKdSdk ├── files │ ├── hvmm.sys │ ├── hvlib.dll │ └── hvlib.lib └── public │ ├── HvlibEnumPublic.h │ └── HvlibHandle.h ├── LiveCloudKdExample ├── files │ └── hvlib.lib ├── images │ └── Demo.png ├── LiveCloudKdExample │ ├── LiveCloudKdExample.h │ ├── LiveCloudKdExample.vcxproj.filters │ ├── LiveCloudKdExample.sln │ └── LiveCloudKdExample.vcxproj.user └── README.md ├── leechcore_device_hvmm ├── images │ ├── 1.png │ └── 2.png ├── README.md ├── leechcore_device_hvmm.vcxproj.filters ├── leechcore_device_hvmm.vcxproj.user └── leechcore_device_hvmm.h └── LiveCloudKdPy ├── Example.py └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | *.log 2 | *.obj 3 | *.tlog 4 | *.ipch 5 | *.pdb 6 | -------------------------------------------------------------------------------- /ExdiKdSample/dirs: -------------------------------------------------------------------------------- 1 | DIRS = \ 2 | KdControllerLib \ 3 | ExdiKdSample 4 | -------------------------------------------------------------------------------- /hvmm/hvmm/hvmm.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/hvmm/hvmm/hvmm.h -------------------------------------------------------------------------------- /images/image02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/images/image02.png -------------------------------------------------------------------------------- /images/image03.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/images/image03.png -------------------------------------------------------------------------------- /images/image04.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/images/image04.png -------------------------------------------------------------------------------- /images/screen.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/images/screen.png -------------------------------------------------------------------------------- /LiveCloudKd/stdafx.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKd/stdafx.h -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ReadMe.txt: -------------------------------------------------------------------------------- 1 | Please refer to the included documentation for project details. -------------------------------------------------------------------------------- /ExdiKdSample/readme.docx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/readme.docx -------------------------------------------------------------------------------- /LiveCloudKd/stdafx.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKd/stdafx.cpp -------------------------------------------------------------------------------- /LiveCloudKd/targetver.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKd/targetver.h -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDI6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDI6.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDI7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDI7.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDI8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDI8.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDI9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDI9.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDi.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDi.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDi2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDi2.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDi3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDi3.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDi4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDi4.png -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDi5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDi5.png -------------------------------------------------------------------------------- /LiveCloudKdSdk/files/hvmm.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKdSdk/files/hvmm.sys -------------------------------------------------------------------------------- /ExdiKdSample/images/EXDI10.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/images/EXDI10.png -------------------------------------------------------------------------------- /LiveCloudKdSdk/files/hvlib.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKdSdk/files/hvlib.dll -------------------------------------------------------------------------------- /LiveCloudKdSdk/files/hvlib.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKdSdk/files/hvlib.lib -------------------------------------------------------------------------------- /LiveCloudKdExample/files/hvlib.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKdExample/files/hvlib.lib -------------------------------------------------------------------------------- /LiveCloudKdExample/images/Demo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/LiveCloudKdExample/images/Demo.png -------------------------------------------------------------------------------- /leechcore_device_hvmm/images/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/leechcore_device_hvmm/images/1.png -------------------------------------------------------------------------------- /leechcore_device_hvmm/images/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/leechcore_device_hvmm/images/2.png -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/resource.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/ExdiKdSample/resource.h -------------------------------------------------------------------------------- /hvmm/hvmm/lib/Win1017666/winhvr.exp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/hvmm/hvmm/lib/Win1017666/winhvr.exp -------------------------------------------------------------------------------- /hvmm/hvmm/lib/Win1017666/winhvr.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/hvmm/hvmm/lib/Win1017666/winhvr.lib -------------------------------------------------------------------------------- /hvmm/hvmm/lib/Win1017666/winhvr.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/hvmm/hvmm/lib/Win1017666/winhvr.sys -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ExdiKdSample.rc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/ExdiKdSample/ExdiKdSample.rc -------------------------------------------------------------------------------- /hvmm/hvmm/lib/Win1017666/create_lib.bat: -------------------------------------------------------------------------------- 1 | dumpbin /exports D:\Project\hyperv60\Win1017666\winhvr.sys > tmp.txt 2 | lib.exe /def:winhvr.def /OUT:winhvr.lib /machine:x64 -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/GeneratedSources/ExdiKDSample.tlb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/ExdiKdSample/ExdiKdSample/GeneratedSources/ExdiKDSample.tlb -------------------------------------------------------------------------------- /hvmm/hvmm/lib/Win1017666/Developer Command Prompt for VS 2017.lnk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/msuiche/LiveCloudKd/HEAD/hvmm/hvmm/lib/Win1017666/Developer Command Prompt for VS 2017.lnk -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ExdiKdSample.rgs: -------------------------------------------------------------------------------- 1 | HKCR 2 | { 3 | NoRemove AppID 4 | { 5 | ForceRemove %APPID% = s 'ExdiTestServer1' 6 | { 7 | val DllSurrogate = s '' 8 | } 9 | } 10 | } -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/KdControllerLib.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /hvmm/hvmm/lib/Win1017666/winhvr_short.def: -------------------------------------------------------------------------------- 1 | LIBRARY winhvr.sys 2 | EXPORTS 3 | WinHvGetPartitionId 4 | WinHvGetPartitionProperty 5 | WinHvInstallIntercept 6 | WinHvPostMessage 7 | WinHvSignalEvent 8 | WinHvAllocatePartitionSintIndex 9 | WinHvAssertVirtualInterrupt -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/targetver.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | // Including SDKDDKVer.h defines the highest available Windows platform. 4 | 5 | // If you wish to build your application for a previous Windows platform, include WinSDKVer.h and 6 | // set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. 7 | 8 | #include 9 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/stdafx.cpp: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // stdafx.cpp 4 | // 5 | // This file is used to generate precompiled header files. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #include "stdafx.h" 12 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/stdafx.cpp: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // stdafx.cpp 4 | // 5 | // This file is used to generate precompiled header files. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #include "stdafx.h" 12 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/LiveExdiSampleServer.rgs: -------------------------------------------------------------------------------- 1 | HKCR 2 | { 3 | NoRemove CLSID 4 | { 5 | ForceRemove {67030926-1754-4FDA-9788-7F731CBDAE42} = s 'LiveExdiSampleServer Class' 6 | { 7 | InprocServer32 = s '%MODULE%' 8 | { 9 | val ThreadingModel = s 'Apartment' 10 | } 11 | TypeLib = s '{FEA1B500-2641-4B1D-88A3-E795429C842B}' 12 | Version = s '1.0' 13 | val AppID = s '%APPID%' 14 | } 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ExdiKdSample.def: -------------------------------------------------------------------------------- 1 | ;---------------------------------------------------------------------------- 2 | ; 3 | ; Copyright (c) Microsoft. All rights reserved. 4 | ; 5 | ;---------------------------------------------------------------------------- 6 | 7 | LIBRARY 8 | 9 | EXPORTS 10 | DllCanUnloadNow PRIVATE 11 | DllGetClassObject PRIVATE 12 | DllRegisterServer PRIVATE 13 | DllUnregisterServer PRIVATE 14 | DllInstall PRIVATE 15 | -------------------------------------------------------------------------------- /LiveCloudKd/resource.h: -------------------------------------------------------------------------------- 1 | //{{NO_DEPENDENCIES}} 2 | // Microsoft Visual C++ generated include file. 3 | // Used by LiveCloudKd.rc 4 | 5 | // Next default values for new objects 6 | // 7 | #ifdef APSTUDIO_INVOKED 8 | #ifndef APSTUDIO_READONLY_SYMBOLS 9 | #define _APS_NEXT_RESOURCE_VALUE 101 10 | #define _APS_NEXT_COMMAND_VALUE 40001 11 | #define _APS_NEXT_CONTROL_VALUE 1001 12 | #define _APS_NEXT_SYMED_VALUE 101 13 | #endif 14 | #endif 15 | -------------------------------------------------------------------------------- /LiveCloudKdExample/LiveCloudKdExample/LiveCloudKdExample.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include 4 | #include 5 | 6 | #define HANDLE_TYPE_EXAMPLE 7 | 8 | #include "HvlibHandle.h" 9 | 10 | #define DUMP_BLOCK_SIZE 1024*1024 11 | #define DUMP_PAGE_SIZE 0x1000 12 | 13 | BOOL 14 | CreateDestinationFile( 15 | LPCWSTR Filename, 16 | PHANDLE Handle 17 | ); 18 | 19 | BOOL 20 | WriteFileSynchronous( 21 | HANDLE Handle, 22 | PVOID Buffer, 23 | ULONG NbOfBytesToWrite 24 | ); 25 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/stdafx.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // stdafx.h 4 | // 5 | // The headers referenced in this file will be precompiled. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | 13 | #include "targetver.h" 14 | 15 | #include 16 | #include 17 | 18 | #include 19 | #include 20 | -------------------------------------------------------------------------------- /hvmm/hvmm/hvmm.inf: -------------------------------------------------------------------------------- 1 | ; 2 | ; hvlckd.inf 3 | ; 4 | 5 | [Version] 6 | Signature="$WINDOWS NT$" 7 | Class=System 8 | ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} 9 | Provider=%ManufacturerName% 10 | DriverVer= 11 | CatalogFile=hvmm.cat 12 | 13 | [DestinationDirs] 14 | DefaultDestDir = 12 15 | 16 | 17 | [SourceDisksNames] 18 | 1 = %DiskName%,,,"" 19 | 20 | [SourceDisksFiles] 21 | 22 | 23 | [Manufacturer] 24 | %ManufacturerName%=Standard,NT$ARCH$ 25 | 26 | [Standard.NT$ARCH$] 27 | 28 | 29 | [Strings] 30 | ManufacturerName="" ;TODO: Replace with your manufacturer name 31 | ClassName="" 32 | DiskName="hvmm" 33 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/dllmain.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // dllmain.h 4 | // 5 | // Declaration of the module class. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | class CStaticExdiSampleModule : public ATL::CAtlDllModuleT< CStaticExdiSampleModule > 12 | { 13 | public : 14 | DECLARE_LIBID(LIBID_ExdiKdSampleLib) 15 | DECLARE_REGISTRY_APPID_RESOURCEID(IDR_STATICEXDISAMPLE, "{B1C91B48-34B6-406F-9481-FFB6A16D4C4F}") 16 | }; 17 | 18 | extern class CStaticExdiSampleModule _AtlModule; 19 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/targetver.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // targetver.h 4 | // 5 | // Target version definition file. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | #pragma once 11 | 12 | // Including SDKDDKVer.h defines the highest available Windows platform. 13 | 14 | // If you wish to build your application for a previous Windows platform, include WinSDKVer.h and 15 | // set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. 16 | 17 | #include 18 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/dllmain.cpp: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // dllmain.cpp 4 | // 5 | // Implementation of DllMain(). 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #include "stdafx.h" 12 | #include "resource.h" 13 | #include "ExdiKdSample.h" 14 | #include "dllmain.h" 15 | 16 | CStaticExdiSampleModule _AtlModule; 17 | 18 | // DLL Entry Point 19 | extern "C" BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved) 20 | { 21 | hInstance; 22 | return _AtlModule.DllMain(dwReason, lpReserved); 23 | } 24 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/StaticExdiSampleServer.rgs: -------------------------------------------------------------------------------- 1 | HKCR 2 | { 3 | NoRemove CLSID 4 | { 5 | ForceRemove {53838F70-0936-44A9-AB4E-ABB568401508} = s 'StaticExdiSampleServer Class' 6 | { 7 | InprocServer32 = s '%MODULE%' 8 | { 9 | val ThreadingModel = s 'Apartment' 10 | } 11 | TypeLib = s '{FEA1B500-2641-4B1D-88A3-E795429C842B}' 12 | Version = s '1.0' 13 | val AppID = s '%APPID%' 14 | } 15 | } 16 | } 17 | 18 | HKLM 19 | { 20 | NoRemove SOFTWARE 21 | { 22 | NoRemove Microsoft 23 | { 24 | NoRemove eXdi 25 | { 26 | NoRemove DriverList 27 | { 28 | val {53838F70-0936-44A9-AB4E-ABB568401508} = s 'exdikd' 29 | } 30 | } 31 | } 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /leechcore_device_hvmm/README.md: -------------------------------------------------------------------------------- 1 | This is MemProcFS plugin for reading Hyper-V memory using Hyper-V Memory Manager library 2 | 3 | Sources was taken from https://github.com/ufrisk/LeechCore 4 | 5 | - MemProcFs can be found on https://github.com/ufrisk/MemProcFS by @ulfrisk 6 | 7 | - LiveCloudKd: https://github.com/gerhart01/LiveCloudKd 8 | 9 | Copy leechcore_device_hvmm.dll with hvlib.dll and hvmm.sys to MemProcFS folder 10 | 11 | start MemProcFs: 12 | ``` 13 | MemProcFS.exe -device hvmm -v 14 | ``` 15 | 16 | you must see something like that: 17 | 18 | ![](./images/1.png) 19 | 20 | Next you can go to M: driver and use pypykatz plugin, f.e. 21 | 22 | ![](./images/2.png) 23 | 24 | Also you can read instructions about plugin usage at: 25 | https://github.com/ufrisk/LeechCore/wiki/Device_LiveCloudKd 26 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/stdafx.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // stdafx.h 4 | // 5 | // The headers referenced in this file will be precompiled. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | 13 | #ifndef STRICT 14 | #define STRICT 15 | #endif 16 | 17 | #include "targetver.h" 18 | 19 | #define _ATL_APARTMENT_THREADED 20 | 21 | #define _ATL_NO_AUTOMATIC_NAMESPACE 22 | 23 | #define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // some CString constructors will be explicit 24 | 25 | 26 | #define ATL_NO_ASSERT_ON_DESTROY_NONEXISTENT_WINDOW 27 | 28 | #define _CRT_SECURE_NO_WARNINGS 29 | #include "resource.h" 30 | #include 31 | #include 32 | #include 33 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ComHelpers.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // ComHelpers.h 4 | // 5 | // Helper methods used to facilitate COM-related tasks. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | #include 13 | #include 14 | 15 | namespace COMHelpers 16 | { 17 | static inline LPOLESTR CopyStringToTaskMem(const wchar_t *pString) 18 | { 19 | assert(pString != nullptr); 20 | size_t stringSizeInBytes = (wcslen(pString) + 1) * sizeof(wchar_t); 21 | LPOLESTR pResult = (LPOLESTR)CoTaskMemAlloc(stringSizeInBytes); 22 | if (pResult != nullptr) 23 | { 24 | memcpy(pResult, pString, stringSizeInBytes); 25 | } 26 | return pResult; 27 | } 28 | } -------------------------------------------------------------------------------- /hvmm/hvmm/hvmm.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Win10x17666 5 | DbgengKernelDebugger 6 | False 7 | None 8 | 9 | 10 | C:\Program Files (x86)\Windows Kits\10\Testing\Tests\Utilities\DefaultDriverPackageInstallationTask.dll 11 | Win10x64 12 | 13 | Microsoft.DriverKit.DefaultDriverPackageInstallationClass.PerformDefaultDriverPackageInstallation 14 | 15 | 16 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/sources: -------------------------------------------------------------------------------- 1 | MSC_WARNING_LEVEL=/W4 /WX 2 | 3 | TARGETNAME=KdControllerLib 4 | TARGETTYPE=LIBRARY 5 | 6 | !if "$(DBGSDK_REF_PATH)" == "" 7 | DBGSDK_REF_PATH=$(SDKTOOLS_REF_PATH) 8 | !endif 9 | 10 | USE_LIBCMT=1 11 | USE_NATIVE_EH=1 12 | USE_STL=1 13 | STL_VER=100 14 | 15 | SOURCES=\ 16 | AsynchronousKdController.cpp \ 17 | BufferedStreamReader.cpp \ 18 | KDController.cpp 19 | 20 | PASS0_BINPLACE = \ 21 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\KdControllerLib *.cpp \ 22 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\KdControllerLib *.h \ 23 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\KdControllerLib KDController.* \ 24 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\KdControllerLib KdControllerLib.* \ 25 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\KdControllerLib sources \ 26 | -------------------------------------------------------------------------------- /LiveCloudKdExample/README.md: -------------------------------------------------------------------------------- 1 | Demo project with next functions of LiveCloudKdSdk: 2 | 3 | (Before compiling check include and library directories, that must point to LiveCloudKdSdkPublic.h and LiveCloudKdSdk.lib, which can be taken from LiveCloudKdSdk project) 4 | 5 | - read physical memory 6 | - read virtual memory 7 | - suspend VM (need Powershell Hyper-V modules, for Windows containers have to use SuspendResumeWriteSpecRegister SUSPEND_RESUME_METHOD parameter) 8 | - resume VM (need Powershell Hyper-V modules, for Windows containers have to use SuspendResumeWriteSpecRegister SUSPEND_RESUME_METHOD parameter) 9 | - dump VM to file 10 | 11 | Demo1 function uses full PHVDD_PARTITION structure for working with partition. 12 | Demo2 using more simple HANDLE structures for using with non-C languages. (ULONG, PVOID, WCHAR types only). For using it include LiveCloudKdSdkHandle.h instead LiveCloudKdSdkPublic.h in your project. 13 | 14 | ![](./images/Demo.png) 15 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/ExceptionHelpers.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // ExceptionHandlers.h 4 | // 5 | // Auxiliary definitions used to handle exceptions. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | 13 | #include 14 | #include 15 | 16 | #define CATCH_AND_RETURN_HRESULT \ 17 | catch(_com_error const &error) \ 18 | { \ 19 | return error.Error(); \ 20 | } \ 21 | catch(std::bad_alloc const &) \ 22 | { \ 23 | return E_OUTOFMEMORY; \ 24 | } \ 25 | catch (...) \ 26 | { \ 27 | return E_FAIL; \ 28 | } 29 | -------------------------------------------------------------------------------- /ExdiKdSample/KernelConnect0198271677.debugTarget: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 15 | 18 | 21 | 22 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/GeneratedSources/dlldata.c: -------------------------------------------------------------------------------- 1 | /********************************************************* 2 | DllData file -- generated by MIDL compiler 3 | 4 | DO NOT ALTER THIS FILE 5 | 6 | This file is regenerated by MIDL on every IDL file compile. 7 | 8 | To completely reconstruct this file, delete it and rerun MIDL 9 | on all the IDL files in this DLL, specifying this file for the 10 | /dlldata command line option 11 | 12 | *********************************************************/ 13 | 14 | 15 | #include 16 | 17 | #ifdef __cplusplus 18 | extern "C" { 19 | #endif 20 | 21 | EXTERN_PROXY_FILE( ExdiKdSample ) 22 | 23 | 24 | PROXYFILE_LIST_START 25 | /* Start of list */ 26 | REFERENCE_PROXY_FILE( ExdiKdSample ), 27 | /* End of list */ 28 | PROXYFILE_LIST_END 29 | 30 | 31 | DLLDATA_ROUTINES( aProxyFileList, GET_DLL_CLSID ) 32 | 33 | #ifdef __cplusplus 34 | } /*extern "C" */ 35 | #endif 36 | 37 | /* end of generated dlldata file */ 38 | -------------------------------------------------------------------------------- /LiveCloudKdPy/Example.py: -------------------------------------------------------------------------------- 1 | # 2 | # hvlib.py examples 3 | # GPL3 License 4 | # version 1.0.0 5 | # 6 | 7 | 8 | from hvlib import * 9 | 10 | def get_vm_id(): 11 | print("Please select the ID of the virtual machine") 12 | vm_id = int(input('').split(" ")[0]) 13 | return vm_id 14 | 15 | objHvlib = hvlib("") 16 | 17 | if objHvlib == None: 18 | exit 19 | 20 | # Set logging level 21 | vm_ops = objHvlib.GetPreferredSettings() 22 | vm_ops.LogLevel = 1 23 | 24 | bResult = objHvlib.EnumPartitions(vm_ops) 25 | 26 | if bResult == False: 27 | exit 28 | 29 | vm_id = get_vm_id() 30 | 31 | page_size = 0x1000 32 | phys_address = 0x10000 33 | 34 | vm_handle = objHvlib.SelectPartition(vm_id) 35 | buffer1 = objHvlib.ReadPhysicalMemoryBlock(vm_handle, phys_address, page_size) 36 | KernelBase = objHvlib.GetData(vm_handle, HvddInformationClass.HvddKernelBase) 37 | objHvlib.PrintHex(KernelBase) 38 | buffer2 = objHvlib.ReadVirtualMemoryBlock(vm_handle, KernelBase, page_size) 39 | 40 | bResult = objHvlib.WriteVirtualMemoryBlock(vm_handle, KernelBase, buffer2) 41 | bResult = objHvlib.WritePhysicalMemoryBlock(vm_handle,phys_address, buffer1) -------------------------------------------------------------------------------- /LiveCloudKdExample/LiveCloudKdExample/LiveCloudKdExample.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | 23 | 24 | Header Files 25 | 26 | 27 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ExdiKdSample.idl: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // ExdiKdSample.idl 4 | // 5 | // Copyright (c) Microsoft. All rights reserved. 6 | // 7 | //---------------------------------------------------------------------------- 8 | 9 | import "oaidl.idl"; 10 | import "ocidl.idl"; 11 | #include "exdi3.idl" 12 | 13 | //Used for internal synchronization 14 | [object, oleautomation, uuid(650FE759-CC39-49A8-8BBA-13DE47107B98)] 15 | interface IAsynchronousCommandNotificationReceiver : IUnknown 16 | { 17 | HRESULT OnAsynchronousCommandCompleted(); 18 | HRESULT PerformKeepaliveChecks(); 19 | } 20 | 21 | [ 22 | uuid(FEA1B500-2641-4B1D-88A3-E795429C842B), 23 | version(1.0), 24 | ] 25 | library ExdiKdSampleLib 26 | { 27 | importlib("stdole2.tlb"); 28 | [ 29 | uuid(53838F70-0936-44A9-AB4E-ABB568401508) 30 | ] 31 | coclass StaticExdiSampleServer 32 | { 33 | [default] interface IeXdiServer3; 34 | interface IeXdiARM4Context3; 35 | interface IeXdiX86_64Context3; 36 | interface IeXdiArmV8Arch64Context3; 37 | }; 38 | 39 | [ 40 | uuid(67030926-1754-4FDA-9788-7F731CBDAE42) 41 | ] 42 | coclass LiveExdiSampleServer 43 | { 44 | [default] interface IeXdiServer3; 45 | interface IeXdiARM4Context3; 46 | interface IeXdiX86_64Context3; 47 | interface IeXdiArmV8Arch64Context3; 48 | interface IAsynchronousCommandNotificationReceiver; 49 | }; 50 | }; 51 | 52 | import "shobjidl.idl"; 53 | -------------------------------------------------------------------------------- /LiveCloudKdExample/LiveCloudKdExample/LiveCloudKdExample.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.29009.5 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LiveCloudKdExample", "LiveCloudKdExample\LiveCloudKdExample.vcxproj", "{A9DBACD3-577B-4533-82E9-37EAB201F756}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Debug|x64.ActiveCfg = Debug|x64 17 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Debug|x64.Build.0 = Debug|x64 18 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Debug|x86.ActiveCfg = Debug|Win32 19 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Debug|x86.Build.0 = Debug|Win32 20 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Release|x64.ActiveCfg = Release|x64 21 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Release|x64.Build.0 = Release|x64 22 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Release|x86.ActiveCfg = Release|Win32 23 | {A9DBACD3-577B-4533-82E9-37EAB201F756}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {77C6CCFC-CE30-48E6-BB77-970A62AD41B8} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /leechcore_device_hvmm/leechcore_device_hvmm.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Header Files 20 | 21 | 22 | Header Files 23 | 24 | 25 | 26 | 27 | Source Files 28 | 29 | 30 | Source Files 31 | 32 | 33 | Source Files 34 | 35 | 36 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ExdiKdSample.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | C:\Distr\Test\WinDBG101903x64\kd.exe 5 | -kx exdi:CLSID={53838F70-0936-44A9-AB4E-ABB568401508},Kd=VerAddr:123456 6 | RemoteWithoutAuthentication 7 | WindowsRemoteDebugger 8 | C:\Distr\Test\WinDBG101903x64\ 9 | 192.168.174.130 10 | C:\Distr\Test\WinDBG101903x64\ 11 | 12 | 13 | WindowsRemoteDebugger 14 | C:\Windows\system32\DllHost.exe 15 | /Processid:{B1C91B48-34B6-406F-9481-FFB6A16D4C4F} 16 | C:\Distr\Test\WinDBG101903x64\ 17 | 192.168.174.130 18 | RemoteWithoutAuthentication 19 | C:\Distr\Test\WinDBG101903x64\ 20 | 21 | -------------------------------------------------------------------------------- /ExdiKdSample/Readme.md: -------------------------------------------------------------------------------- 1 | This project is modified EXDPlugins example from WinDBG SDK 2 | (C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sdk\samples\exdi\ExdiKdSample) 3 | 4 | It uses LiveCloudKdSdk library for reading and writing memory operations, get registers. 5 | 6 | There is readme.docx in ExdiKdSample project in WinDBG SDK directory, which describe architecture of EXDi interface. If shortly, 7 | EXDI is an interface that allows extending WinDBG by adding support for hardware debuggers. We haven't hardware debuggers for Hyper-V, but we can add LiveCloudKdSdk functions calling to EXDi interface. 8 | 9 | ![](./images/EXDi.png) 10 | 11 | For installation: 12 | 13 | 1. Copy LiveCloudKd.exe, hvlib.dll, hvmm.sys and ExdiKdSample.dll to WinDBG x64 directory 14 | 2. Register ExdiKdSample.dll using regsvr32.exe ExdiKdSample.dll command 15 | 3. Start LiveCloudKd with /w option: LiveCloudKd.exe /w. It is automatically launch WinDBG with EXDi interface. 16 | 17 | ![](./images/EXDi2.png) 18 | 19 | You can use WinDBG Preview with EXDi plugin too. But WinDBG Preview has bug with automatically starting EXDi plugin from command line, therefore it must be start manually. 20 | 21 | 1. Launch LiveCloudKd.exe /x. 22 | 2. Copy string, which provided by LiveCloudKd. 23 | 24 | ![](./images/EXDi3.png) 25 | 26 | 3. Start WinDBGX, go to File-Start debugging-Attach to Kernel, open EXDi tab and paste string to field. 27 | 28 | ![](./images/EXDi4.png) 29 | 30 | 4. You can read\write to guest OS memory and execute WinDBG commands, that work for dump files. Remember, that it is static plugin example, and you can't do single step (F11, F8) or running commands (F5). 31 | 32 | ![](./images/EXDi5.png) 33 | 34 | Detailed information about live debugging you can find on [this page](LiveDebugging.md) 35 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/AsynchronousKDController.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // AsynchronousKdController.h 4 | // 5 | // An extension of the KDController class that allows running certain commands 6 | // (e.g. running target) asynchronously. 7 | // 8 | // Copyright (c) Microsoft. All rights reserved. 9 | // 10 | //---------------------------------------------------------------------------- 11 | 12 | #pragma once 13 | #include 14 | 15 | #include "KDController.h" 16 | 17 | namespace KDControllerLib 18 | { 19 | class AsynchronousKDController : public KDController 20 | { 21 | public: 22 | static AsynchronousKDController *Create(_In_ LPCTSTR pDebuggingToolsPath, 23 | _In_ LPCTSTR pConnectionArguments); 24 | 25 | virtual std::string ExecuteCommand(_In_ LPCSTR pCommand) override; 26 | 27 | void StartAsynchronousCommand(_In_ LPCSTR pCommand); 28 | bool IsAsynchronousCommandInProgress(); 29 | bool GetAsynchronousCommandResult(_In_ DWORD timeoutInMilliseconds, _Out_opt_ std::string *pResult); 30 | 31 | //High-level commands 32 | void StartStepCommand(unsigned processorNumber); 33 | void StartRunCommand(); 34 | 35 | unsigned CreateCodeBreakpoint(_In_ AddressType address); 36 | void DeleteCodeBreakpoint(_In_ unsigned breakpointNumber); 37 | 38 | ~AsynchronousKDController(); 39 | protected: 40 | AsynchronousKDController(_In_ HANDLE processHandle, _In_ HANDLE stdInput, _In_ HANDLE stdOutput); 41 | 42 | private: 43 | HANDLE m_asynchronousCommandThread; 44 | std::string m_currentAsynchronousCommand; 45 | std::string m_currentAsynchronousCommandResult; 46 | 47 | static DWORD CALLBACK AsynchronousCommandThreadBody(LPVOID p); 48 | 49 | std::vector m_breakpointSlots; 50 | }; 51 | } -------------------------------------------------------------------------------- /LiveCloudKdExample/LiveCloudKdExample/LiveCloudKdExample.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | C:\Distr\Test\WinDBG101903x64\LiveCloudKdExample.exe 5 | WindowsRemoteDebugger 6 | C:\Distr\Test\WinDBG1022H2x64\LiveCloudKdExample.exe 7 | C:\Distr\Test\WinDBG1022H2x64 8 | 192.168.1.114 9 | C:\Distr\Test\WinDBG1022H2x64 10 | F:\Projects\HyperVDebug\files\hvlib.dll 11 | RemoteWithoutAuthentication 12 | true 13 | 14 | 15 | C:\Distr\Test\WinDBG101903x64\LiveCloudKdExample.exe 16 | WindowsRemoteDebugger 17 | C:\Distr\Test\WinDBG1022H2x64\LiveCloudKdExample.exe 18 | C:\Distr\Test\WinDBG1022H2x64 19 | 192.168.1.114 20 | C:\Distr\Test\WinDBG1022H2x64 21 | F:\Projects\HyperVDebug\files\hvlib.dll 22 | RemoteWithoutAuthentication 23 | true 24 | 25 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/BufferedStreamReader.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // BufferedStreamReader.h 4 | // 5 | // A class used to read a stream line-by-line with an arbitrary delimiter. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | 13 | #include 14 | #include 15 | #include 16 | #include "BufferWrapper.h" 17 | 18 | namespace KDControllerLib 19 | { 20 | //This class is used to read a given stream (represented by a HANDLE) on a line-by-line basis, where 21 | //the 'line delimiter' is an arbitrary-length string. 22 | //It is used by KDController to read the entire response of kd.exe up until the '\r\nkd> ' sequence. 23 | //NOTE: The class does not own the handle. 24 | //NOTE: This class is optimized for simplicity, not performance. Do not use it in performance-critical code. 25 | class BufferedStreamReader final 26 | { 27 | public: 28 | typedef std::vector MatchCollection; 29 | 30 | BufferedStreamReader(_In_ HANDLE stream); 31 | ~BufferedStreamReader(); 32 | 33 | std::string Read(_In_ const std::regex &delimiter, _Out_opt_ MatchCollection *pRegexMatchesExcept0 = nullptr); 34 | 35 | private: 36 | static size_t const c_readChunkSize = 65536; 37 | 38 | HANDLE m_stream; 39 | 40 | //Contains the data already read from the stream but not returned to client yet. 41 | SimpleCharBuffer m_internalBuffer; 42 | size_t m_frontGapSize; 43 | 44 | //Returns false when no buffered data is available and a normal read should be performed 45 | bool TryReadBufferedData(_Inout_ std::string *pBuffer, 46 | _In_ const std::regex &delimiter, 47 | _Out_opt_ MatchCollection *pRegexMatchesExcept0); 48 | 49 | void RemoveFrontGapInBuffer(); 50 | }; 51 | } -------------------------------------------------------------------------------- /hvmm/hvmm/mDbgPrint.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | #define DBG_PRINT_LEVEL DPFLTR_ERROR_LEVEL 5 | #define DbgLog(format, ...) { DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_PRINT_LEVEL,"%-50s [%08X]\n", format, __VA_ARGS__ ); } 6 | #define DbgLog16(format, value) { DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_PRINT_LEVEL,"%-50s [%016I64X]\n", format, value ); } 7 | //#define DbgTraceLog(value) { DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_PRINT_LEVEL,"%08X:\n", value ); } 8 | #define DbgPrintString(value) { DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_PRINT_LEVEL,"%s \n", value ); } 9 | #define DbgPrintUStringString(value1,value2) { DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_PRINT_LEVEL,"%s %wZ \n", value1, value2); } 10 | 11 | // 12 | //Enable additional debug logs 13 | // 14 | 15 | #define DBG_PRINT_STRINGS 16 | 17 | __forceinline void KDbgPrintString(PCSTR value) { 18 | /* print_##type will be replaced with print_int or print_double */ 19 | #ifdef DBG_PRINT_STRINGS 20 | DbgPrintString(value); 21 | #else 22 | UNREFERENCED_PARAMETER(value); 23 | #endif 24 | } 25 | 26 | 27 | //__forceinline void KDbgLog(PCSTR format, ...) { 28 | //#ifdef DBG_PRINT_STRINGS 29 | // va_list vl; 30 | // va_start(vl, format); 31 | // DbgLog(format, vl); 32 | // //va_end(vl); 33 | //#else 34 | // UNREFERENCED_PARAMETER(format); 35 | //#endif 36 | //} 37 | 38 | __forceinline void KDbgLog(PCSTR format, ULONG value) { 39 | #ifdef DBG_PRINT_STRINGS 40 | DbgLog(format, value); 41 | //va_end(vl); 42 | #else 43 | UNREFERENCED_PARAMETER(format); 44 | UNREFERENCED_PARAMETER(value); 45 | #endif 46 | } 47 | 48 | __forceinline void KDbgLog16(PCSTR format, ULONG64 value) { 49 | #ifdef DBG_PRINT_STRINGS 50 | DbgLog16(format, value); 51 | //va_end(vl); 52 | #else 53 | UNREFERENCED_PARAMETER(format); 54 | UNREFERENCED_PARAMETER(value); 55 | #endif 56 | } 57 | 58 | 59 | //__forceinline void KDbgLog16(PCSTR format, ...) { 60 | //#ifdef DBG_PRINT_STRINGS 61 | // va_list vl; 62 | // va_start(vl, format); 63 | // DbgLog16(format, vl); 64 | // //va_end(vl); 65 | //#else 66 | // UNREFERENCED_PARAMETER(format); 67 | //#endif 68 | //} -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/sources: -------------------------------------------------------------------------------- 1 | MSC_WARNING_LEVEL=/W4 /WX 2 | 3 | TARGETNAME=ExdiKdSample 4 | TARGETTYPE=DYNLINK 5 | 6 | MIDL_FLAGS=$(MIDL_FLAGS) /I ..\..\..\..\external\exdi 7 | 8 | _NT_TARGET_VERSION=$(_NT_TARGET_VERSION_WIN7) 9 | 10 | USE_LIBCMT=1 11 | USE_NATIVE_EH=1 12 | USE_STL=1 13 | STL_VER=100 14 | 15 | USE_ATL=1 16 | ATL_VER=70 17 | !if "$(DBGSDK_REF_PATH)" == "" 18 | DBGSDK_REF_PATH=$(SDKTOOLS_REF_PATH) 19 | !endif 20 | 21 | SOURCES=\ 22 | dllmain.cpp \ 23 | ExdiKdSample.idl \ 24 | ExdiKdSample.cpp \ 25 | LiveExdiSampleServer.cpp \ 26 | StaticExdiSampleServer.cpp \ 27 | $(O)\ExdiKdSample_i.c \ 28 | ExdiKdSample.rc 29 | 30 | TARGETLIBS=\ 31 | $(SDK_LIB_PATH)\kernel32.lib \ 32 | $(SDK_LIB_PATH)\user32.lib \ 33 | $(SDK_LIB_PATH)\advapi32.lib \ 34 | $(SDK_LIB_PATH)\ole32.lib \ 35 | $(SDK_LIB_PATH)\oleaut32.lib \ 36 | $(SDK_LIB_PATH)\uuid.lib \ 37 | $(PROJECT_OBJ_ROOT)\debuggers\samples\exdi\ExdiKdSample\KdControllerLib\$(O)\KdControllerLib.lib 38 | 39 | INCLUDES = \ 40 | ..\KDControllerLib; \ 41 | $(INCLUDES) 42 | 43 | # We ship samples as source code projects. Need to binplace in test dir to support running funcional tests 44 | # against these samples. 45 | PASS2_BINPLACE=\ 46 | -:DEST dbg\test $(OBJ_PATH)\$(O)\$(TARGETNAME).dll \ 47 | 48 | PASS0_BINPLACE = \ 49 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\ExdiKdSample *.cpp \ 50 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\ExdiKdSample *.h \ 51 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\ExdiKdSample *.rgs \ 52 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\ExdiKdSample *.txt \ 53 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\ExdiKdSample ExdiKdSample.* \ 54 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\ExdiKdSample product.* \ 55 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample\ExdiKdSample sources \ 56 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample ..\dirs \ 57 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample ..\ExdiKdSample.sln \ 58 | -:DEST $(DBG_PRI_LAYOUT)\sdk\samples\exdi\ExdiKdSample ..\readme.docx \ 59 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ExdiKdSample.cpp: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // ExdiKdSample.cpp 4 | // 5 | // Contains exported functions required by COM. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #include "stdafx.h" 12 | #include "resource.h" 13 | #include "ExdiKdSample.h" 14 | #include "dllmain.h" 15 | 16 | using namespace ATL; 17 | 18 | // Used to determine whether the DLL can be unloaded by OLE. 19 | STDAPI DllCanUnloadNow(void) 20 | { 21 | return _AtlModule.DllCanUnloadNow(); 22 | } 23 | 24 | // Returns a class factory to create an object of the requested type. 25 | STDAPI DllGetClassObject(_In_ REFCLSID rclsid, _In_ REFIID riid, _Outptr_ LPVOID* ppv) 26 | { 27 | return _AtlModule.DllGetClassObject(rclsid, riid, ppv); 28 | } 29 | 30 | // DllRegisterServer - Adds entries to the system registry. 31 | STDAPI DllRegisterServer(void) 32 | { 33 | // registers object, typelib and all interfaces in typelib 34 | HRESULT hr = _AtlModule.DllRegisterServer(); 35 | return hr; 36 | } 37 | 38 | // DllUnregisterServer - Removes entries from the system registry. 39 | STDAPI DllUnregisterServer(void) 40 | { 41 | HRESULT hr = _AtlModule.DllUnregisterServer(); 42 | return hr; 43 | } 44 | 45 | // DllInstall - Adds/Removes entries to the system registry per user per machine. 46 | STDAPI DllInstall(BOOL bInstall, _In_opt_ LPCWSTR pszCmdLine) 47 | { 48 | HRESULT hr = E_FAIL; 49 | #if _ATL_VER >= 0x0B00 //11.00 50 | static const wchar_t szUserSwitch[] = L"user"; 51 | 52 | if (pszCmdLine != NULL) 53 | { 54 | if (_wcsnicmp(pszCmdLine, szUserSwitch, _countof(szUserSwitch)) == 0) 55 | { 56 | ATL::AtlSetPerUserRegistration(true); 57 | } 58 | } 59 | #else 60 | UNREFERENCED_PARAMETER(pszCmdLine); 61 | #endif 62 | 63 | if (bInstall) 64 | { 65 | hr = DllRegisterServer(); 66 | if (FAILED(hr)) 67 | { 68 | DllUnregisterServer(); 69 | } 70 | } 71 | else 72 | { 73 | hr = DllUnregisterServer(); 74 | } 75 | 76 | return hr; 77 | } 78 | 79 | 80 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/KDCommandLogger.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // KDCommandLogger.h 4 | // 5 | // A helper class that shows KD.EXE commands being executed. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | #include "KDController.h" 13 | 14 | class KDCommandLogger : public KDControllerLib::IKDTextHandler 15 | { 16 | public: 17 | KDCommandLogger(bool allocateConsole) 18 | : m_consoleAllocated(allocateConsole) 19 | { 20 | if (allocateConsole) 21 | { 22 | AllocConsole(); 23 | } 24 | 25 | SetConsoleCP(CP_ACP); 26 | m_standardOutput = GetStdHandle(STD_OUTPUT_HANDLE); 27 | SetConsoleTitle(_T("Blind KD - please close when done debugging")); 28 | 29 | COORD newConsoleSize = {100, SHRT_MAX - 1}; 30 | SetConsoleScreenBufferSize(m_standardOutput, newConsoleSize); 31 | 32 | SMALL_RECT windowSize = {0, 0, newConsoleSize.X - 1, 49}; 33 | SetConsoleWindowInfo(m_standardOutput, TRUE, &windowSize); 34 | } 35 | 36 | ~KDCommandLogger() 37 | { 38 | if (m_consoleAllocated) 39 | { 40 | FreeConsole(); 41 | } 42 | } 43 | 44 | public: 45 | void HandleText(KDControllerLib::KDTextType textType, _In_z_ const char *pText) 46 | { 47 | if (textType == KDControllerLib::KDTextType::Command) 48 | { 49 | SetConsoleTextAttribute(m_standardOutput, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_INTENSITY); 50 | } 51 | else 52 | { 53 | SetConsoleTextAttribute(m_standardOutput, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE); 54 | } 55 | 56 | assert(pText != nullptr); 57 | DWORD done; 58 | WriteFile(m_standardOutput, pText, static_cast(strlen(pText)), &done, nullptr); 59 | assert(done == strlen(pText)); 60 | WriteFile(m_standardOutput, "\n", 1, &done, nullptr); 61 | assert(done == 1); 62 | } 63 | 64 | 65 | private: 66 | bool m_consoleAllocated; 67 | HANDLE m_standardOutput; 68 | }; -------------------------------------------------------------------------------- /hvmm/hvmm/hvmm.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Header Files\Driver Files 24 | 25 | 26 | 27 | 28 | Source Files 29 | 30 | 31 | Source Files 32 | 33 | 34 | Source Files 35 | 36 | 37 | Source Files 38 | 39 | 40 | Source Files 41 | 42 | 43 | 44 | 45 | Header Files 46 | 47 | 48 | Header Files 49 | 50 | 51 | Header Files 52 | 53 | 54 | Header Files 55 | 56 | 57 | 58 | 59 | Source Files 60 | 61 | 62 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/InterfaceMarshalHelper.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // InterfaceMarshalHelper.h 4 | // 5 | // A simple wrapper class that helps marshalling COM interfaces across apartments. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | #include 13 | #include 14 | #include 15 | 16 | template class InterfaceMarshalHelper 17 | { 18 | public: 19 | InterfaceMarshalHelper(_In_ TInterface *pInterface, DWORD marshalFlags) //flags such as MSHLFLAGS_TABLESTRONG 20 | { 21 | m_creatorThreadId = GetCurrentThreadId(); 22 | 23 | HRESULT result = CreateStreamOnHGlobal(NULL, TRUE, &m_pStream); 24 | if (FAILED(result)) 25 | { 26 | throw std::exception("Failed to create a global stream"); 27 | } 28 | 29 | result = CoMarshalInterface(m_pStream, __uuidof(TInterface), pInterface, MSHCTX_INPROC, NULL, marshalFlags); 30 | if (FAILED(result)) 31 | { 32 | throw std::exception("Failed to marshal the interface"); 33 | } 34 | 35 | InitializeCriticalSection(&m_criticalSection); 36 | } 37 | 38 | ~InterfaceMarshalHelper() 39 | { 40 | assert(m_creatorThreadId == GetCurrentThreadId()); 41 | if (m_pStream != nullptr) 42 | { 43 | m_pStream->Seek(LARGE_INTEGER(), SEEK_SET, NULL); 44 | CoReleaseMarshalData(m_pStream); 45 | 46 | m_pStream->Release(); 47 | m_pStream = nullptr; 48 | } 49 | DeleteCriticalSection(&m_criticalSection); 50 | } 51 | 52 | TInterface *TryUnmarshalInterfaceForCurrentThread() 53 | { 54 | EnterCriticalSection(&m_criticalSection); 55 | m_pStream->Seek(LARGE_INTEGER(), SEEK_SET, NULL); 56 | TInterface *pInterface = nullptr; 57 | HRESULT result = CoUnmarshalInterface(m_pStream, __uuidof(TInterface), reinterpret_cast(&pInterface)); 58 | LeaveCriticalSection(&m_criticalSection); 59 | 60 | if (FAILED(result)) 61 | { 62 | pInterface = nullptr; 63 | } 64 | 65 | return pInterface; 66 | } 67 | 68 | private: 69 | IStream *m_pStream; 70 | CRITICAL_SECTION m_criticalSection; 71 | DWORD m_creatorThreadId; 72 | }; 73 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/KdControllerLib.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Header Files 20 | 21 | 22 | Header Files 23 | 24 | 25 | Header Files 26 | 27 | 28 | Header Files 29 | 30 | 31 | Header Files 32 | 33 | 34 | Header Files 35 | 36 | 37 | Header Files 38 | 39 | 40 | Header Files 41 | 42 | 43 | Header Files 44 | 45 | 46 | 47 | 48 | Source Files 49 | 50 | 51 | Source Files 52 | 53 | 54 | Source Files 55 | 56 | 57 | Source Files 58 | 59 | 60 | -------------------------------------------------------------------------------- /leechcore_device_hvmm/leechcore_device_hvmm.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | C:\Distr\Test\MemProcFs\MemProcFs.exe 5 | -device hvmm://id=0,unix -v 6 | C:\Distr\Test\MemProcFs 7 | 192.168.174.130 8 | C:\Distr\Test\MemProcFs 9 | WindowsRemoteDebugger 10 | false 11 | RemoteWithoutAuthentication 12 | 13 | 14 | C:\Distr\Test\MemProcFs\MemProcFs.exe 15 | -device hvmm://id=0,unix -v 16 | C:\Distr\Test\MemProcFs 17 | 192.168.174.130 18 | C:\Distr\Test\MemProcFs 19 | WindowsRemoteDebugger 20 | false 21 | RemoteWithoutAuthentication 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | WindowsRemoteDebugger 35 | true 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | WindowsRemoteDebugger 44 | true 45 | 46 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/HandleHelpers.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // HandleHelpers.h 4 | // 5 | // Wrapper classes for the system handles. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | 13 | namespace KDControllerLib 14 | { 15 | class HandleWrapper 16 | { 17 | public: 18 | HandleWrapper() 19 | : m_handle(INVALID_HANDLE_VALUE) 20 | { 21 | } 22 | 23 | HandleWrapper(_In_ HANDLE handle) 24 | : m_handle(handle) 25 | { 26 | } 27 | 28 | ~HandleWrapper() 29 | { 30 | Close(); 31 | } 32 | 33 | HANDLE Detach() 34 | { 35 | HANDLE handle = m_handle; 36 | m_handle = INVALID_HANDLE_VALUE; 37 | return handle; 38 | } 39 | 40 | HANDLE Get() const 41 | { 42 | return m_handle; 43 | } 44 | 45 | bool IsValid() const 46 | { 47 | return m_handle != INVALID_HANDLE_VALUE; 48 | } 49 | 50 | HANDLE *operator&() 51 | { 52 | //Used to pass to a _Out_ PHANDLE argument. Similar to CComPtr in ATL. 53 | //If the handle is already valid, such use case will lead to a handle leak. 54 | assert(m_handle == INVALID_HANDLE_VALUE); 55 | return &m_handle; 56 | } 57 | 58 | void Close() 59 | { 60 | if (m_handle == INVALID_HANDLE_VALUE) 61 | { 62 | return; 63 | } 64 | 65 | CloseHandle(m_handle); 66 | m_handle = INVALID_HANDLE_VALUE; 67 | } 68 | 69 | void Attach(_In_ HANDLE handle) 70 | { 71 | Close(); 72 | m_handle = handle; 73 | } 74 | 75 | static void CloseAndInvalidate(_Inout_ HANDLE *pHandle) 76 | { 77 | //assert(pHandle != nullptr); 78 | //CloseHandle(*pHandle); 79 | *pHandle = INVALID_HANDLE_VALUE; 80 | } 81 | 82 | private: 83 | HANDLE m_handle; 84 | 85 | HandleWrapper(_In_ const HandleWrapper &anotherHandleWrapper); 86 | void operator=(_In_ const HandleWrapper &anotherHandleWrapper); 87 | }; 88 | 89 | class ValidHandleWrapper : public HandleWrapper 90 | { 91 | public: 92 | ValidHandleWrapper(_In_ HANDLE handle) 93 | : HandleWrapper(handle) 94 | { 95 | assert(handle != INVALID_HANDLE_VALUE); 96 | } 97 | }; 98 | 99 | } -------------------------------------------------------------------------------- /hvmm/hvmm/AMD64.asm: -------------------------------------------------------------------------------- 1 | 2 | EXTERN pPsGetCurrentProcessOrig:QWORD 3 | EXTERN pAddrOfArchNewPsGetCurrentProcess:QWORD 4 | EXTERN pHandleOfLiveCloudKd:QWORD 5 | EXTERN pHandleOfVmwp:QWORD 6 | EXTERN VidPsProcessCheckWorker:NEAR 7 | 8 | mPUSHAD MACRO 9 | push rax 10 | push rbx 11 | push rcx 12 | push rdx 13 | push rdi 14 | push rsi 15 | push r8 16 | push r9 17 | push r10 18 | push r11 19 | push r12 20 | push r13 21 | push r14 22 | push r15 23 | ENDM 24 | 25 | mPOPAD MACRO 26 | pop r15 27 | pop r14 28 | pop r13 29 | pop r12 30 | pop r11 31 | pop r10 32 | pop r9 33 | pop r8 34 | pop rsi 35 | pop rdi 36 | pop rdx 37 | pop rcx 38 | pop rbx 39 | pop rax 40 | ENDM 41 | 42 | .CODE 43 | 44 | ModCR0 PROC 45 | cli 46 | push rsi 47 | push rdi 48 | push rbx 49 | xor rdx,rdx 50 | xor rbx,rbx 51 | xor rsi,rsi 52 | xor rdi,rdi 53 | mov rax, cr0 54 | mov rbx, 10000h 55 | not rbx 56 | and rax, rbx 57 | mov cr0, rax 58 | pop rbx 59 | pop rdi 60 | pop rsi 61 | sti 62 | ret 63 | ModCR0 ENDP 64 | 65 | ArchReadMsr PROC 66 | rdmsr 67 | shl rdx, 20h 68 | or rax,rdx 69 | ret 70 | ArchReadMSR ENDP 71 | 72 | ArchNewPsGetCurrentProcess02 PROC 73 | ;int 3 74 | mov rax, qword ptr gs:[188h] 75 | mov rax,qword ptr [rax+0B8h] 76 | mov rcx, rax 77 | mov rdx, qword ptr [rsp+8] 78 | call VidPsProcessCheckWorker 79 | ;mov qword ptr [rsp], rdx 80 | add rsp, 8 81 | ret 82 | ArchNewPsGetCurrentProcess02 ENDP 83 | 84 | ArchNewPsGetCurrentProcess PROC 85 | mov rax, qword ptr gs:[188h] 86 | mov rax,qword ptr [rax+0B8h] 87 | cmp rax, pHandleOfLiveCloudKd 88 | jne @label1 89 | mov rcx, [rsp+8] 90 | mov rdx, 0FFFFF801440D23A5h 91 | cmp rcx, rdx 92 | je @label2 93 | mov rdx, 0fffff801440d6847h 94 | cmp rcx, rdx 95 | je @label2 96 | mov rdx, 0fffff801440fb79fh 97 | cmp rcx, rdx 98 | je @label2 99 | mov rdx, 0fffff801440f5012h 100 | cmp rcx, rdx 101 | ;je @label2 102 | ; mov rdx, 0fffff801440de272h 103 | ; cmp rcx, rdx 104 | jne @label1 105 | @label2: 106 | mov rax, pHandleOfVmwp 107 | @label1: 108 | ret 109 | ArchNewPsGetCurrentProcess ENDP 110 | 111 | 112 | ArchPsGetCurrentProcess PROC 113 | mov rax, qword ptr gs:[188h] 114 | mov rax,qword ptr [rax+0B8h] 115 | mov rcx, 0FFFFF78000000000h 116 | mov rcx, qword ptr [rcx] 117 | call rcx 118 | ret 119 | ArchPsGetCurrentProcess ENDP 120 | 121 | ArchmReplacePsGetCurrentProcess PROC 122 | mov [rdx],rcx 123 | ret 124 | ArchmReplacePsGetCurrentProcess ENDP 125 | 126 | ArchInt3 PROC 127 | int 3 128 | ret 129 | ArchInt3 ENDP 130 | 131 | END 132 | -------------------------------------------------------------------------------- /LiveCloudKd/LiveCloudKd.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | C:\Distr\Test\WinDBG101903x64\LiveCloudKd.exe 5 | C:\Distr\Test\WinDBG101903x64 6 | 192.168.174.132 7 | RemoteWithoutAuthentication 8 | NativeOnly 9 | C:\Distr\Test\WinDBG101903x64 10 | WindowsRemoteDebugger 11 | D:\Projects\HyperVDebug\files\LiveCloudKdSdk.dll; 12 | 13 | 14 | 15 | 16 | C:\Distr\Test\LiveCloudKd2.exe 17 | C:\Distr\Test 18 | 192.168.1.44 19 | RemoteWithoutAuthentication 20 | NativeOnly 21 | C:\Distr\Test 22 | WindowsRemoteDebugger 23 | 24 | 25 | C:\Distr\Test\WinDBG6.12\LiveCloudKd2.exe 26 | C:\Distr\Test\WinDBG6.12 27 | WindowsRemoteDebugger 28 | C:\Distr\Test\WinDBG101903x64\LiveCloudKd.exe 29 | 192.168.174.130 30 | C:\Distr\Test\WinDBG101903x64 31 | NativeOnly 32 | C:\Distr\Test\WinDBG101903x64 33 | RemoteWithoutAuthentication 34 | D:\Projects\HyperVDebug\files\LiveCloudKdSdk.dll 35 | 36 | 37 | 38 | -------------------------------------------------------------------------------- /LiveCloudKd/file.c: -------------------------------------------------------------------------------- 1 | /*++ 2 | Microsoft Hyper-V Virtual Machine Physical Memory Dumper 3 | Copyright (C) Matt Suiche. All rights reserved. 4 | 5 | Module Name: 6 | 7 | - file.c 8 | 9 | Abstract: 10 | 11 | - This header file contains definition used by LiveCloudKd (2010) and open-sourced in December 2018 after 12 | collaborating with Arthur Khudyaev (@gerhart_x) to revive the project. 13 | 14 | More information can be found on the original repository: https://github.com/comaeio/LiveCloudKd 15 | 16 | Original 2010 blogpost: https://blogs.technet.microsoft.com/markrussinovich/2010/10/09/livekd-for-virtual-machine-debugging/ 17 | 18 | Environment: 19 | 20 | - User mode 21 | 22 | Revision History: 23 | 24 | - Arthur Khudyaev (@gerhart_x) - 18-Apr-2019 - Add additional methods (using Microsoft winhv.sys and own hvmm.sys driver) for reading guest memory 25 | - Arthur Khudyaev (@gerhart_x) - 20-Feb-2019 - Migrate parto of code to LiveCloudKd plugin 26 | - Arthur Khudyaev (@gerhart_x) - 26-Jan-2019 - Migration to MemProcFS/LeechCore 27 | - Matthieu Suiche (@msuiche) 11-Dec-2018 - Open-sourced LiveCloudKd in December 2018 on GitHub 28 | - Arthur Khudyaev (@gerhart_x) - 28-Oct-2018 - Add partial Windows 10 support 29 | - Matthieu Suiche (@msuiche) 09-Dec-2010 - Initial version from LiveCloudKd and presented at BlueHat 2010 30 | 31 | --*/ 32 | #include "hvdd.h" 33 | 34 | BOOL 35 | CreateDestinationFile(LPCWSTR Filename, 36 | PHANDLE Handle) 37 | { 38 | *Handle = CreateFile(Filename, 39 | GENERIC_WRITE, 40 | 0, 41 | NULL, 42 | CREATE_ALWAYS, 43 | FILE_FLAG_NO_BUFFERING, 44 | NULL); 45 | 46 | if (Handle == INVALID_HANDLE_VALUE) return FALSE; 47 | 48 | return TRUE; 49 | } 50 | 51 | BOOL 52 | WriteFileSynchronous( 53 | HANDLE Handle, 54 | PVOID Buffer, 55 | ULONG NbOfBytesToWrite 56 | ) 57 | /*++ 58 | 59 | Routine Description: 60 | 61 | Desc. 62 | 63 | Arguments: 64 | 65 | Arg1 - Desc. 66 | 67 | Arg2 - Desc. 68 | 69 | Arg3 - Desc. 70 | 71 | Return Value: 72 | 73 | Ret1 - Desc. 74 | 75 | Ret2 - Desc. 76 | 77 | --*/ 78 | { 79 | DWORD WrittenBytes; 80 | BOOL Ret; 81 | 82 | WrittenBytes = 0; 83 | Ret = FALSE; 84 | 85 | Ret = WriteFile(Handle, Buffer, NbOfBytesToWrite, &WrittenBytes, NULL); 86 | if ((Ret == FALSE) && (GetLastError() == ERROR_IO_PENDING)) 87 | { 88 | do 89 | { 90 | Ret = WaitForSingleObjectEx(Handle, INFINITE, TRUE); 91 | } while (Ret == WAIT_IO_COMPLETION); 92 | } 93 | 94 | if (WrittenBytes == NbOfBytesToWrite) 95 | { 96 | Ret = TRUE; 97 | } 98 | 99 | return Ret; 100 | } -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/BasicExdiBreakpoint.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // BasicExdiBreakpoint.h 4 | // 5 | // A sample implementation of the IeXdiCodeBreakpoint interface used to represent 6 | // breakpoints maintained by EXDI servers. 7 | // 8 | // Copyright (c) Microsoft. All rights reserved. 9 | // 10 | //---------------------------------------------------------------------------- 11 | 12 | #pragma once 13 | #include "ExdiKdSample.h" 14 | 15 | interface DECLSPEC_UUID("8EC0B42F-9B46-4674-AC60-64105713BB35") IBasicExdiBreakpoint : public IUnknown 16 | { 17 | public: 18 | virtual unsigned GetBreakpointNumber() = 0; 19 | }; 20 | 21 | class BasicExdiBreakpoint : public CComObjectRootEx, 22 | public IeXdiCodeBreakpoint3, 23 | public IBasicExdiBreakpoint 24 | { 25 | public: 26 | BasicExdiBreakpoint() 27 | : m_address(0) 28 | , m_breakpointNumber(0) 29 | { 30 | } 31 | 32 | BEGIN_COM_MAP(BasicExdiBreakpoint) 33 | COM_INTERFACE_ENTRY(IeXdiCodeBreakpoint3) 34 | COM_INTERFACE_ENTRY(IBasicExdiBreakpoint) 35 | END_COM_MAP() 36 | 37 | virtual unsigned GetBreakpointNumber() 38 | { 39 | return m_breakpointNumber; 40 | } 41 | 42 | void Initialize(ULONGLONG address, unsigned breakpointNumber) 43 | { 44 | m_address = address; 45 | m_breakpointNumber = breakpointNumber; 46 | } 47 | 48 | virtual HRESULT STDMETHODCALLTYPE GetAttributes( 49 | /* [out] */ PADDRESS_TYPE pAddress, 50 | /* [out] */ PCBP_KIND pcbpk, 51 | /* [out] */ PMEM_TYPE pmt, 52 | /* [out] */ DWORD *pdwExecMode, 53 | /* [out] */ DWORD *pdwTotalBypassCount, 54 | /* [out] */ DWORD *pdwBypassedOccurences, 55 | /* [out] */ BOOL *pfEnabled) 56 | { 57 | if (pAddress == nullptr || pcbpk == nullptr || pmt == nullptr || pdwExecMode == nullptr || 58 | pdwTotalBypassCount == nullptr || pdwBypassedOccurences == nullptr || pfEnabled == nullptr) 59 | { 60 | return E_POINTER; 61 | } 62 | 63 | *pAddress = m_address; 64 | *pcbpk = cbptSW; 65 | *pmt = mtVirtual; 66 | 67 | *pdwExecMode = 0; 68 | *pdwTotalBypassCount = 0; 69 | *pdwBypassedOccurences = 0; 70 | *pfEnabled = TRUE; 71 | return S_OK; 72 | } 73 | 74 | virtual HRESULT STDMETHODCALLTYPE SetState( 75 | /* [in] */ BOOL fEnabled, 76 | /* [in] */ BOOL fResetBypassedOccurences) 77 | { 78 | UNREFERENCED_PARAMETER(fResetBypassedOccurences); 79 | 80 | if (!fEnabled) 81 | { 82 | return E_NOTIMPL; 83 | } 84 | 85 | return S_OK; 86 | } 87 | 88 | private: 89 | ULONGLONG m_address; 90 | unsigned m_breakpointNumber; 91 | }; -------------------------------------------------------------------------------- /LiveCloudKd/LiveCloudKd.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.27703.2018 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LiveCloudKd", "LiveCloudKd.vcxproj", "{92504F8B-8817-49A7-89D3-7DF94E485FB4}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM = Debug|ARM 11 | Debug|ARM64 = Debug|ARM64 12 | Debug|x64 = Debug|x64 13 | Debug|x86 = Debug|x86 14 | Debug2016|ARM = Debug2016|ARM 15 | Debug2016|ARM64 = Debug2016|ARM64 16 | Debug2016|x64 = Debug2016|x64 17 | Debug2016|x86 = Debug2016|x86 18 | Release|ARM = Release|ARM 19 | Release|ARM64 = Release|ARM64 20 | Release|x64 = Release|x64 21 | Release|x86 = Release|x86 22 | EndGlobalSection 23 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 24 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug|ARM.ActiveCfg = Debug|Win32 25 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug|ARM64.ActiveCfg = Debug|Win32 26 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug|x64.ActiveCfg = Debug|x64 27 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug|x64.Build.0 = Debug|x64 28 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug|x64.Deploy.0 = Debug|x64 29 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug|x86.ActiveCfg = Debug|Win32 30 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug|x86.Build.0 = Debug|Win32 31 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug2016|ARM.ActiveCfg = Debug2016|Win32 32 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug2016|ARM64.ActiveCfg = Debug2016|Win32 33 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug2016|x64.ActiveCfg = Debug2016|x64 34 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug2016|x64.Build.0 = Debug2016|x64 35 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug2016|x64.Deploy.0 = Debug2016|x64 36 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug2016|x86.ActiveCfg = Debug2016|Win32 37 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Debug2016|x86.Build.0 = Debug2016|Win32 38 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Release|ARM.ActiveCfg = Release|Win32 39 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Release|ARM64.ActiveCfg = Release|Win32 40 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Release|x64.ActiveCfg = Release|x64 41 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Release|x64.Build.0 = Release|x64 42 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Release|x64.Deploy.0 = Release|x64 43 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Release|x86.ActiveCfg = Release|Win32 44 | {92504F8B-8817-49A7-89D3-7DF94E485FB4}.Release|x86.Build.0 = Release|Win32 45 | EndGlobalSection 46 | GlobalSection(SolutionProperties) = preSolution 47 | HideSolutionNode = FALSE 48 | EndGlobalSection 49 | GlobalSection(ExtensibilityGlobals) = postSolution 50 | SolutionGuid = {1C9086E4-DFC1-4BD6-9C59-D3108D239908} 51 | EndGlobalSection 52 | EndGlobal 53 | -------------------------------------------------------------------------------- /hvmm/hvmm.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.27703.2018 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hvmm", "hvmm\hvmm.vcxproj", "{B277739E-4630-4282-8229-53CDCD176655}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM = Debug|ARM 11 | Debug|ARM64 = Debug|ARM64 12 | Debug|x64 = Debug|x64 13 | Debug|x86 = Debug|x86 14 | Release|ARM = Release|ARM 15 | Release|ARM64 = Release|ARM64 16 | Release|x64 = Release|x64 17 | Release|x86 = Release|x86 18 | EndGlobalSection 19 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 20 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|ARM.ActiveCfg = Debug|ARM 21 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|ARM.Build.0 = Debug|ARM 22 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|ARM.Deploy.0 = Debug|ARM 23 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|ARM64.ActiveCfg = Debug|ARM64 24 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|ARM64.Build.0 = Debug|ARM64 25 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|ARM64.Deploy.0 = Debug|ARM64 26 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|x64.ActiveCfg = Debug|x64 27 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|x64.Build.0 = Debug|x64 28 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|x64.Deploy.0 = Debug|x64 29 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|x86.ActiveCfg = Debug|Win32 30 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|x86.Build.0 = Debug|Win32 31 | {B277739E-4630-4282-8229-53CDCD176655}.Debug|x86.Deploy.0 = Debug|Win32 32 | {B277739E-4630-4282-8229-53CDCD176655}.Release|ARM.ActiveCfg = Release|ARM 33 | {B277739E-4630-4282-8229-53CDCD176655}.Release|ARM.Build.0 = Release|ARM 34 | {B277739E-4630-4282-8229-53CDCD176655}.Release|ARM.Deploy.0 = Release|ARM 35 | {B277739E-4630-4282-8229-53CDCD176655}.Release|ARM64.ActiveCfg = Release|ARM64 36 | {B277739E-4630-4282-8229-53CDCD176655}.Release|ARM64.Build.0 = Release|ARM64 37 | {B277739E-4630-4282-8229-53CDCD176655}.Release|ARM64.Deploy.0 = Release|ARM64 38 | {B277739E-4630-4282-8229-53CDCD176655}.Release|x64.ActiveCfg = Release|x64 39 | {B277739E-4630-4282-8229-53CDCD176655}.Release|x64.Build.0 = Release|x64 40 | {B277739E-4630-4282-8229-53CDCD176655}.Release|x64.Deploy.0 = Release|x64 41 | {B277739E-4630-4282-8229-53CDCD176655}.Release|x86.ActiveCfg = Release|Win32 42 | {B277739E-4630-4282-8229-53CDCD176655}.Release|x86.Build.0 = Release|Win32 43 | {B277739E-4630-4282-8229-53CDCD176655}.Release|x86.Deploy.0 = Release|Win32 44 | EndGlobalSection 45 | GlobalSection(SolutionProperties) = preSolution 46 | HideSolutionNode = FALSE 47 | EndGlobalSection 48 | GlobalSection(ExtensibilityGlobals) = postSolution 49 | SolutionGuid = {32BFED71-B486-48C9-BF4F-2D706124B971} 50 | EndGlobalSection 51 | EndGlobal 52 | -------------------------------------------------------------------------------- /LiveCloudKd/LiveCloudKd.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {03b94e68-4d08-4a5c-8f49-e5779cf6ba31} 18 | 19 | 20 | 21 | 22 | Header Files 23 | 24 | 25 | Header Files 26 | 27 | 28 | Header Files 29 | 30 | 31 | Header Files 32 | 33 | 34 | Header Files 35 | 36 | 37 | Header Files 38 | 39 | 40 | Header Files\HyperV 41 | 42 | 43 | Header Files\HyperV 44 | 45 | 46 | Header Files\HyperV 47 | 48 | 49 | Header Files 50 | 51 | 52 | Header Files 53 | 54 | 55 | 56 | 57 | Source Files 58 | 59 | 60 | Source Files 61 | 62 | 63 | Source Files 64 | 65 | 66 | Source Files 67 | 68 | 69 | Source Files 70 | 71 | 72 | Source Files 73 | 74 | 75 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 2012 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "KdControllerLib", "KdControllerLib\KdControllerLib.vcxproj", "{F864C8F4-8773-4B37-8DD9-E48514D3733B}" 5 | EndProject 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ExdiKdSample", "ExdiKdSample\ExdiKdSample.vcxproj", "{96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Win32 = Debug|Win32 11 | Debug|x64 = Debug|x64 12 | Release|Win32 = Release|Win32 13 | Release|x64 = Release|x64 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Debug|Win32.ActiveCfg = Debug|Win32 17 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Debug|Win32.Build.0 = Debug|Win32 18 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Debug|Win32.Deploy.0 = Debug|Win32 19 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Debug|x64.ActiveCfg = Debug|x64 20 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Debug|x64.Build.0 = Debug|x64 21 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Release|Win32.ActiveCfg = Release|Win32 22 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Release|Win32.Build.0 = Release|Win32 23 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Release|Win32.Deploy.0 = Release|Win32 24 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Release|x64.ActiveCfg = Release|x64 25 | {F864C8F4-8773-4B37-8DD9-E48514D3733B}.Release|x64.Build.0 = Release|x64 26 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Debug|Win32.ActiveCfg = Debug|Win32 27 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Debug|Win32.Build.0 = Debug|Win32 28 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Debug|Win32.Deploy.0 = Debug|Win32 29 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Debug|x64.ActiveCfg = Debug|x64 30 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Debug|x64.Build.0 = Debug|x64 31 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Release|Win32.ActiveCfg = Release|Win32 32 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Release|Win32.Build.0 = Release|Win32 33 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Release|Win32.Deploy.0 = Release|Win32 34 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Release|x64.ActiveCfg = Release|x64 35 | {96C3D2FC-5BE0-4B23-B8BD-50C33B6CFA34}.Release|x64.Build.0 = Release|x64 36 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Debug|Win32.ActiveCfg = Debug|Win32 37 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Debug|Win32.Build.0 = Debug|Win32 38 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Debug|Win32.Deploy.0 = Debug|Win32 39 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Debug|x64.ActiveCfg = Debug|Win32 40 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Release|Win32.ActiveCfg = Release|Win32 41 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Release|Win32.Build.0 = Release|Win32 42 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Release|Win32.Deploy.0 = Release|Win32 43 | {CECA0D2D-EA3A-4C65-B96A-AF3F1271F8D0}.Release|x64.ActiveCfg = Release|Win32 44 | EndGlobalSection 45 | GlobalSection(SolutionProperties) = preSolution 46 | HideSolutionNode = FALSE 47 | EndGlobalSection 48 | EndGlobal 49 | -------------------------------------------------------------------------------- /leechcore_device_hvmm/leechcore_device_hvmm.h: -------------------------------------------------------------------------------- 1 | // device_hvmm.h : definitions related the Hyper-V live memory diving. 2 | // 3 | // (c) Ulf Frisk, 2018 4 | // Author: Ulf Frisk, pcileech@frizk.net 5 | // 6 | // (c) Arthur Khudyaev, 2020 7 | // Author: Arthur Khudyaev, @gerhart_x 8 | // 9 | 10 | #ifndef __DEVICE_HVMM_H__ 11 | #define __DEVICE_HVMM_H__ 12 | #include "HvlibHandle.h" 13 | #include 14 | #include "leechcore_device.h" 15 | #include "conio.h" 16 | #include "shlwapi.h" 17 | 18 | // 19 | // The number of runs may vary if Dynamic Memory is enabled inside the Hyper-V virtual machine. 20 | // 21 | 22 | #define MAX_NUMBER_OF_RUNS MAX_NUMBER_OF_RUNS_BYTES / sizeof(PHYSICAL_MEMORY_RANGE) //correlation with MAX_NUMBER_OF_RUNS_BYTES from LiveCloudKdSdkMisc.h 23 | 24 | #define HVMM_PROBE_MAXPAGES 0x1 25 | 26 | // 27 | // hvmm driver definitions 28 | // 29 | 30 | #define DEVICEHVMM_SERVICENAME "hvmm" 31 | #define DEVICEHVMM_OBJECT "\\\\.\\hvmm" 32 | #define DEVICEHVMM_DRIVERFILE "hvmm.sys" 33 | 34 | // 35 | // MemProcFs param values 36 | // 37 | 38 | #define HVMM_ID_PARAM_NAME "id=" 39 | #define HVMM_PARAM_NAME "hvmm://" 40 | #define HVMM_PARAM_DELIMITER "," 41 | 42 | #define HVMM_LISTVM_PARAM_NAME "listvm" 43 | #define HVMM_UNIX_PARAM_NAME "unix" 44 | #define HVMM_LOGLEVEL_PARAM_NAME "loglevel" 45 | #define HVMM_ENUM_GUEST_OS_BUILD_PARAM_NAME "enumguestosbuild" 46 | 47 | typedef struct pmem_info_runs { 48 | __int64 start; 49 | __int64 length; 50 | } PHYSICAL_MEMORY_RANGE; 51 | 52 | struct PmemMemoryInfo { 53 | LARGE_INTEGER CR3; 54 | LARGE_INTEGER NtBuildNumber; 55 | LARGE_INTEGER KernBase; 56 | LARGE_INTEGER KDBG; 57 | LARGE_INTEGER KPCR[MAX_PROCESSORS]; 58 | LARGE_INTEGER PfnDataBase; 59 | LARGE_INTEGER PsLoadedModuleList; 60 | LARGE_INTEGER PsActiveProcessHead; 61 | LARGE_INTEGER NtBuildNumberAddr; 62 | LARGE_INTEGER Padding[0xfe]; 63 | LARGE_INTEGER NumberOfRuns; 64 | PHYSICAL_MEMORY_RANGE Run[MAX_NUMBER_OF_RUNS]; 65 | }; 66 | 67 | typedef struct tdDEVICE_CONTEXT_HVMM { 68 | HANDLE hFile; 69 | ULONG64 Partition; 70 | QWORD paMax; 71 | ULONG Vmid; 72 | BOOLEAN VmidPreselected; 73 | BOOLEAN ListVm; 74 | BOOLEAN SimpleMemory; 75 | ULONG LogLevel; 76 | BOOLEAN EnumGuestOsBuild; 77 | BOOLEAN RemoteMode; 78 | LPWSTR szVmNamesList; 79 | struct PmemMemoryInfo MemoryInfo; 80 | } DEVICE_CONTEXT_HVMM, *PDEVICE_CONTEXT_HVMM; 81 | 82 | /* 83 | * Open a "connection" to the Hyper-V partition. 84 | * -- result 85 | */ 86 | 87 | BOOL HVMMStart(_Inout_ PLC_CONTEXT ctxLC); 88 | BOOLEAN HVMM_ReadFile( 89 | ULONG64 PartitionHandle, 90 | UINT64 StartPosition, 91 | PVOID lpBuffer, 92 | UINT64 nNumberOfBytesToRead 93 | ); 94 | 95 | BOOLEAN HVMM_WriteFile( 96 | ULONG64 PartitionHandle, 97 | UINT64 StartPosition, 98 | PVOID lpBuffer, 99 | UINT64 nNumberOfBytesToRead 100 | ); 101 | 102 | BOOL IsDigital(PLC_CONTEXT ctxLC, PCHAR str, ULONG64 len); 103 | 104 | #endif -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/KDController.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // KDController.cpp 4 | // 5 | // A class allowing running KD.EXE and sending commands to it. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | #pragma once 11 | #include "BufferedStreamReader.h" 12 | #include 13 | #include 14 | #include 15 | #include "HandleHelpers.h" 16 | #include "LiveCloudKdSdkPublic.h" 17 | 18 | 19 | namespace KDControllerLib 20 | { 21 | enum class KDTextType 22 | { 23 | Command, 24 | CommandOutput, 25 | }; 26 | 27 | class IKDTextHandler 28 | { 29 | public: 30 | virtual void HandleText(_In_ KDTextType textType, _In_z_ const char *pText)=0; 31 | virtual ~IKDTextHandler(){} 32 | }; 33 | 34 | class KDController 35 | { 36 | public: 37 | virtual ~KDController(); 38 | 39 | typedef ULONGLONG AddressType; 40 | 41 | //The class will own the text handler 42 | void SetTextHandler(_In_ IKDTextHandler *pHandler); 43 | 44 | virtual std::string ExecuteCommand(_In_ LPCSTR pCommand); 45 | 46 | //Specify -1 to use 'current' processor as defined by KD 47 | std::map QueryAllRegisters(_In_ unsigned processorNumber); 48 | void SetRegisters(_In_ unsigned processorNumber, _In_ const std::map ®isterValues); 49 | 50 | SimpleCharBuffer ReadMemory(_In_ AddressType address, _In_ size_t size); 51 | BOOLEAN WriteMemory(_In_ AddressType address, _In_ PVOID pRawBuffer, _In_ size_t size); 52 | 53 | unsigned GetProcessorCount(); 54 | AddressType GetKPCRAddress(_In_ unsigned processorNumber); 55 | 56 | static ULONGLONG ParseRegisterValue(_In_ const std::string& stringValue); 57 | static ULONGLONG GetRegisterValue(_In_ HV_REGISTER_NAME, _In_ DWORD ProcessorNumber); 58 | static BOOLEAN SetRegisterValue(_In_ DWORD ProcessorNumber, _In_ HV_REGISTER_NAME RegisterName, _In_ ULONG64 RegisterValue); 59 | 60 | std::string GetEffectiveMachine(_Out_opt_ std::string * pTargetResponse, _In_ PHVDD_PARTITION PartitionEntry); 61 | 62 | unsigned GetLastKnownActiveCpu() { return m_lastKnownActiveCpu; } 63 | 64 | void ShutdownKD(); 65 | 66 | protected: 67 | //Initializes the KD Controller given handles to a running KD.EXE process. 68 | //Do not invoke directly. Use Create() method instead. 69 | //NOTE: The created object will own the handles. 70 | KDController(_In_ HANDLE processHandle, _In_ HANDLE stdInput, _In_ HANDLE stdOutput); 71 | 72 | void WaitForInitialPrompt(); 73 | 74 | private: 75 | HandleWrapper m_jobHandle; 76 | ValidHandleWrapper m_processHandle; 77 | ValidHandleWrapper m_stdInput; 78 | ValidHandleWrapper m_stdOutput; 79 | 80 | BufferedStreamReader m_stdoutReader; 81 | 82 | IKDTextHandler *m_pTextHandler; 83 | 84 | std::regex m_kdPromptRegex; 85 | 86 | unsigned m_cachedProcessorCount; 87 | unsigned m_lastKnownActiveCpu; 88 | 89 | std::string ReadStdoutUntilDelimiter(); 90 | }; 91 | } 92 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/BufferWrapper.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // BufferWrapper.h 4 | // 5 | // A class encapsulating a memory buffer with length and capacity. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | #include 13 | 14 | namespace KDControllerLib 15 | { 16 | //This is a lightweight typed buffer. It encapsulates a pointer and information about how many 17 | //elements have been allocated and actually used. The class does not throw any exceptions. 18 | //NOTE: TElementType should be a plain data type without any constructors. E.g. char or wchar_t. 19 | template class BufferWrapper 20 | { 21 | public: 22 | BufferWrapper() 23 | : m_pBuffer(nullptr) 24 | , m_capacity(0) 25 | , m_length(0) 26 | { 27 | } 28 | 29 | ~BufferWrapper() 30 | { 31 | if (m_pBuffer != nullptr) 32 | { 33 | free(m_pBuffer); 34 | } 35 | } 36 | 37 | bool TryEnsureCapacity(_In_ size_t newElementCount) 38 | { 39 | if (newElementCount == 0) 40 | { 41 | return true; 42 | } 43 | 44 | TElementType *pNewBuffer = static_cast(realloc(m_pBuffer, 45 | newElementCount * sizeof(TElementType))); 46 | if (pNewBuffer == nullptr) 47 | { 48 | return false; 49 | } 50 | 51 | m_pBuffer = pNewBuffer; 52 | m_capacity = newElementCount; 53 | return true; 54 | } 55 | 56 | TElementType *GetInternalBuffer() 57 | { 58 | return m_pBuffer; 59 | } 60 | 61 | TElementType *GetEndOfData() const 62 | { 63 | assert(m_length <= m_capacity); 64 | return m_pBuffer + m_length; 65 | } 66 | 67 | size_t GetLength() const 68 | { 69 | return m_length; 70 | } 71 | 72 | void SetLength(_In_ size_t newLength) 73 | { 74 | assert(newLength <= m_capacity); 75 | m_length = newLength; 76 | } 77 | 78 | size_t GetCapacity() const 79 | { 80 | return m_capacity; 81 | } 82 | 83 | TElementType &operator[](_In_ size_t index) 84 | { 85 | assert(index < m_length); 86 | assert(m_pBuffer != nullptr); 87 | return m_pBuffer[index]; 88 | } 89 | 90 | //C++11 move constructor. See http://msdn.microsoft.com/en-us/library/dd293665.aspx for explanation. 91 | BufferWrapper(_Inout_ BufferWrapper &&anotherBuffer) 92 | { 93 | m_pBuffer = anotherBuffer.m_pBuffer; 94 | m_capacity = anotherBuffer.m_capacity; 95 | m_length = anotherBuffer.m_length; 96 | 97 | anotherBuffer.m_capacity = anotherBuffer.m_length = 0; 98 | anotherBuffer.m_pBuffer = nullptr; 99 | } 100 | 101 | private: 102 | TElementType *m_pBuffer; 103 | size_t m_capacity; 104 | size_t m_length; 105 | 106 | BufferWrapper(_In_ const BufferWrapper &anotherBuffer); 107 | void operator=(_In_ BufferWrapper &anotherBuffer); 108 | }; 109 | 110 | typedef BufferWrapper SimpleCharBuffer; 111 | } -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/ArgumentHelpers.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // ArgumentHelpers.h 4 | // 5 | // Helper methods used to validate and reset output arguments. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #pragma once 12 | #include 13 | 14 | template void CheckAndZeroOutArgs(_Out_ T1 *pArg1) 15 | { 16 | if (pArg1 != nullptr) 17 | { 18 | *pArg1 = T1(); 19 | } 20 | if (pArg1 == nullptr) 21 | { 22 | throw _com_error(E_POINTER); 23 | } 24 | } 25 | 26 | template void CheckAndZeroOutArgs(_Out_ T1 *pArg1, _Out_ T2 *pArg2) 27 | { 28 | if (pArg1 != nullptr) 29 | { 30 | *pArg1 = T1(); 31 | } 32 | if (pArg2 != nullptr) 33 | { 34 | *pArg2 = T2(); 35 | } 36 | 37 | if (pArg1 == nullptr || pArg2 == nullptr) 38 | { 39 | throw _com_error(E_POINTER); 40 | } 41 | } 42 | 43 | template void CheckAndZeroOutArgs(_Out_ T1 *pArg1, _Out_ T2 *pArg2, _Out_ T3 *pArg3) 44 | { 45 | if (pArg1 != nullptr) 46 | { 47 | *pArg1 = T1(); 48 | } 49 | if (pArg2 != nullptr) 50 | { 51 | *pArg2 = T2(); 52 | } 53 | if (pArg3 != nullptr) 54 | { 55 | *pArg3 = T3(); 56 | } 57 | 58 | if (pArg1 == nullptr || pArg2 == nullptr || pArg3 == nullptr) 59 | { 60 | throw _com_error(E_POINTER); 61 | } 62 | } 63 | 64 | template void CheckAndZeroOutArgs(_Out_ T1 *pArg1, 65 | _Out_ T2 *pArg2, 66 | _Out_ T3 *pArg3, 67 | _Out_ T4 *pArg4) 68 | { 69 | if (pArg1 != nullptr) 70 | { 71 | *pArg1 = T1(); 72 | } 73 | if (pArg2 != nullptr) 74 | { 75 | *pArg2 = T2(); 76 | } 77 | if (pArg3 != nullptr) 78 | { 79 | *pArg3 = T3(); 80 | } 81 | if (pArg4 != nullptr) 82 | { 83 | *pArg4 = T4(); 84 | } 85 | 86 | if (pArg1 == nullptr || pArg2 == nullptr || pArg3 == nullptr || pArg4 == nullptr) 87 | { 88 | throw _com_error(E_POINTER); 89 | } 90 | } 91 | 92 | template void CheckAndZeroOutArgs(_Out_ T1 *pArg1, 93 | _Out_ T2 *pArg2, 94 | _Out_ T3 *pArg3, 95 | _Out_ T4 *pArg4, 96 | _Out_ T5 *pArg5) 97 | { 98 | if (pArg1 != nullptr) 99 | { 100 | *pArg1 = T1(); 101 | } 102 | if (pArg2 != nullptr) 103 | { 104 | *pArg2 = T2(); 105 | } 106 | if (pArg3 != nullptr) 107 | { 108 | *pArg3 = T3(); 109 | } 110 | if (pArg4 != nullptr) 111 | { 112 | *pArg4 = T4(); 113 | } 114 | if (pArg5 != nullptr) 115 | { 116 | *pArg5 = T5(); 117 | } 118 | 119 | if (pArg1 == nullptr || pArg2 == nullptr || pArg3 == nullptr || pArg4 == nullptr || pArg5 == nullptr) 120 | { 121 | throw _com_error(E_POINTER); 122 | } 123 | } -------------------------------------------------------------------------------- /LiveCloudKd/hvdd.h: -------------------------------------------------------------------------------- 1 | /*++ 2 | Microsoft Hyper-V Virtual Machine Physical Memory Dumper 3 | Copyright (C) 2010 MoonSols SARL. All rights reserved. 4 | 5 | Module Name: 6 | 7 | - hvdd.h 8 | 9 | Abstract: 10 | 11 | - 12 | 13 | 14 | Environment: 15 | 16 | - User mode 17 | 18 | Revision History: 19 | 20 | - Matthieu Suiche 21 | 22 | --*/ 23 | #include "LiveCloudKdSdkPublic.h" 24 | 25 | #define _AMD64_ 26 | 27 | //#define WIN32_NO_STATUS /* Tell Windows headers you'll use ntstatus.s from NDK */ 28 | //#include /* Declare Windows Headers like you normally would */ 29 | //#include "ntdefs.h" 30 | 31 | //#include 32 | //#include 33 | //#include 34 | #include 35 | 36 | #include 37 | //#include 38 | //#include "dbg.h" 39 | //#include "vid.h" 40 | 41 | #include "hooker.h" 42 | #include "misc.h" 43 | #include "dmp.h" 44 | 45 | 46 | #define BLOCK_SIZE (1024 * 1024) 47 | 48 | #define WINDBG_FT_TABLE_PAGE_COUNT 0x270 49 | 50 | // 51 | //limitation for max virtual dump size in hooker.c. Doesn't need anymore 52 | // 53 | //#define MAX_HIGH_FILE_OFFSET 0xFF 54 | 55 | 56 | //from Bin2Dmp 57 | //#define PRO_EDITION 58 | //#define FORCE_DEBUG_MODE 1 59 | 60 | #if defined(PRO_EDITION) 61 | #define DEBUG_ENABLED FORCE_DEBUG_MODE 62 | #elif defined(COMMUNITY_EDITION) 63 | #define DEBUG_ENABLED 0 64 | #else 65 | #define DEBUG_ENABLED 1 66 | #endif 67 | // 68 | // KDBG cyphered or not 69 | // 70 | 71 | //#define HYPERV_CONTAINER TRUE 72 | 73 | // 74 | //If you define USE_VIDDLL_FUNCTIONS, LiveCloudKd start using vid.dll functions, but it need ntoskrnl.exe life time patching 75 | //therefore it is not safe because of Patch Guard 76 | // 77 | 78 | //#define USE_VIDDLL_FUNCTIONS 79 | 80 | 81 | #define DUMP_COMMENT_STRING "Hyper-V Memory Dump. (c) 2010 MoonSols SARL " 82 | 83 | 84 | // 85 | // memoryblock.c 86 | // 87 | 88 | BOOL 89 | MmWriteVirtualAddress( 90 | PHVDD_PARTITION PartitionEntry, 91 | ULONG64 Va, 92 | PVOID Buffer, 93 | ULONG Size 94 | ); 95 | 96 | // 97 | // dump.c 98 | // 99 | BOOLEAN 100 | DumpVirtualMachine( 101 | _In_ PHVDD_PARTITION PartitionEntry, 102 | _In_ LPCWSTR DestinationFile 103 | ); 104 | 105 | BOOLEAN 106 | DumpLiveVirtualMachine( 107 | _In_ PHVDD_PARTITION PartitionEntry 108 | ); 109 | 110 | BOOLEAN 111 | DumpCrashVirtualMachine( 112 | _In_ PHVDD_PARTITION PartitionEntry, 113 | _In_ LPCWSTR DestinationFile 114 | ); 115 | 116 | // 117 | // file.c 118 | // 119 | BOOL 120 | CreateDestinationFile( 121 | LPCWSTR Filename, 122 | PHANDLE Handle 123 | ); 124 | 125 | BOOL 126 | WriteFileSynchronous( 127 | HANDLE Handle, 128 | PVOID Buffer, 129 | ULONG NbOfBytesToWrite 130 | ); 131 | 132 | // 133 | // kd.c 134 | // 135 | 136 | 137 | BOOL 138 | LaunchKd( 139 | LPCWSTR DumpFile, 140 | PHVDD_PARTITION PartitionEntry 141 | ); 142 | 143 | BOOLEAN 144 | LaunchWinDbg( 145 | PHVDD_PARTITION PartitionEntry 146 | ); 147 | 148 | BOOLEAN 149 | LaunchWinDbgX( 150 | PHVDD_PARTITION PartitionEntry 151 | ); 152 | 153 | // 154 | // misc.c 155 | // 156 | 157 | BOOL 158 | GetMmNonPagedPoolLimit( 159 | PULONG64 MmNonPagedPoolStart, 160 | PULONG64 MmNonPagedPoolEnd 161 | ); 162 | 163 | VOID 164 | White( 165 | LPCWSTR Format, 166 | ... 167 | ); 168 | 169 | VOID 170 | Red( 171 | LPCWSTR Format, 172 | ... 173 | ); 174 | 175 | VOID 176 | Green( 177 | LPCWSTR Format, 178 | ... 179 | ); 180 | 181 | USHORT 182 | GetConsoleTextAttribute( 183 | HANDLE hConsole 184 | ); 185 | 186 | // 187 | // dump.c 188 | // 189 | 190 | PDUMP_HEADER64 191 | DumpFillHeader64( 192 | PHVDD_PARTITION PartitionEntry 193 | ); 194 | 195 | BOOLEAN 196 | DumpFillHeader( 197 | PHVDD_PARTITION PartitionEntry, 198 | PVOID *Header, 199 | PULONG HeaderSize 200 | ); 201 | 202 | // 203 | //hooker.c 204 | // 205 | 206 | BOOL 207 | HookKd( 208 | HANDLE ProcessHandle, 209 | ULONG ProcessId, 210 | PHVDD_PARTITION PartitionEntry 211 | ); 212 | 213 | extern BOOLEAN UseWinDbg; 214 | extern BOOLEAN UseWinDbgX; 215 | extern BOOLEAN UseEXDi; -------------------------------------------------------------------------------- /LiveCloudKd/misc.h: -------------------------------------------------------------------------------- 1 | #ifndef __MISC_H__ 2 | #define __MISC_H__ 3 | 4 | typedef struct tdVIDDLL_FUNCTIONS { 5 | BOOL 6 | (WINAPI *VidReadMemoryBlockPageRange)( 7 | __in PT_HANDLE Partition, 8 | __in MB_HANDLE MemoryBlock, 9 | __in MB_PAGE_INDEX StartMbp, 10 | __in UINT64 MbpCount, 11 | __out_bcount(BufferSize) 12 | PVOID ClientBuffer, 13 | __in UINT64 BufferSize 14 | ); 15 | 16 | BOOL 17 | (WINAPI *VidWriteMemoryBlockPageRange)( 18 | __in PT_HANDLE Partition, 19 | __in MB_HANDLE MemoryBlock, 20 | __in MB_PAGE_INDEX StartMbp, 21 | __in UINT64 MbpCount, 22 | __in_bcount(BufferSize) 23 | PVOID ClientBuffer, 24 | __in UINT64 BufferSize 25 | ); 26 | 27 | BOOL 28 | (WINAPI *VidTranslateGvaToGpa)( 29 | __in PT_HANDLE Partition, 30 | __in HV_VP_INDEX VpIndex, 31 | __in HV_TRANSLATE_GVA_CONTROL_FLAGS ControlFlags, 32 | __in HV_GVA_PAGE_NUMBER GvaPage, 33 | __out PHV_TRANSLATE_GVA_RESULT TranslationResult, 34 | __out PHV_GPA_PAGE_NUMBER GpaPage, 35 | __out PVOID* MmioContext, 36 | __out PVOID* MemoryBlockContext, 37 | __out UINT64* MemoryBlockPageIndex, 38 | __out UINT64* MemoryBlockGpaRangeFlags 39 | ); 40 | 41 | BOOL 42 | (WINAPI *VidGetVirtualProcessorState)( 43 | __in PT_HANDLE Partition, 44 | __in VID_PROCESSOR_INDEX ProcessorIndex, 45 | __in_ecount(ProcessorStateCodeCount) 46 | VID_VP_STATE_CODE* ProcessorStateCodeArray, 47 | __in UINT8 ProcessorStateCodeCount, 48 | __out_ecount(ProcessorStateCodeCount) 49 | VID_VP_STATE_VALUE* ProcessorStateOutputArray 50 | ); 51 | 52 | BOOL 53 | (WINAPI * VidGetHvPartitionId)( 54 | __in PT_HANDLE Partition, 55 | __out PHV_PARTITION_ID PartitionId 56 | ); 57 | 58 | BOOL 59 | (WINAPI *VidGetPartitionFriendlyName)( 60 | __in PT_HANDLE PartitionHandle, 61 | __out_ecount(FriendlyNameLengthInChars) WCHAR* FriendlyName, 62 | __in UINT32 FriendlyNameLengthInChars 63 | ); 64 | } VIDDLL_FUNCTIONS, *PVIDDLL_FUNCTIONS; 65 | 66 | typedef struct tdNTDDLL_FUNCTIONS { 67 | NTSTATUS 68 | (NTAPI *NtQuerySystemInformation)( 69 | _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, 70 | _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation, 71 | _In_ ULONG SystemInformationLength, 72 | _Out_opt_ PULONG ReturnLength 73 | ); 74 | 75 | NTSTATUS 76 | (NTAPI *NtOpenProcess)( 77 | _Out_ PHANDLE ProcessHandle, 78 | _In_ ACCESS_MASK DesiredAccess, 79 | _In_ POBJECT_ATTRIBUTES ObjectAttributes, 80 | _In_opt_ PCLIENT_ID ClientId 81 | ); 82 | 83 | NTSTATUS 84 | (NTAPI *NtDuplicateObject)( 85 | _In_ HANDLE SourceProcessHandle, 86 | _In_ HANDLE SourceHandle, 87 | _In_opt_ HANDLE TargetProcessHandle, 88 | _Out_opt_ PHANDLE TargetHandle, 89 | _In_ ACCESS_MASK DesiredAccess, 90 | _In_ ULONG HandleAttributes, 91 | _In_ ULONG Options 92 | ); 93 | 94 | NTSTATUS 95 | (NTAPI *NtQueryObject)( 96 | _In_opt_ HANDLE Handle, 97 | _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass, 98 | _Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation, 99 | _In_ ULONG ObjectInformationLength, 100 | _Out_opt_ PULONG ReturnLength 101 | ); 102 | 103 | NTSTATUS 104 | (NTAPI *NtAllocateVirtualMemory)( 105 | _In_ HANDLE ProcessHandle, 106 | _Inout_ _At_(*BaseAddress, _Readable_bytes_(*RegionSize) _Writable_bytes_(*RegionSize) _Post_readable_byte_size_(*RegionSize)) PVOID *BaseAddress, 107 | _In_ ULONG_PTR ZeroBits, 108 | _Inout_ PSIZE_T RegionSize, 109 | _In_ ULONG AllocationType, 110 | _In_ ULONG Protect 111 | ); 112 | } NTDDLL_FUNCTIONS, *PNTDDLL_FUNCTIONS; 113 | 114 | BOOLEAN 115 | ImportGlobalFunctions( 116 | VOID 117 | ); 118 | 119 | extern VIDDLL_FUNCTIONS g_VidDll; 120 | extern NTDDLL_FUNCTIONS g_NtDll; 121 | 122 | #endif -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/GeneratedSources/ExdiKdSample_i.c: -------------------------------------------------------------------------------- 1 | 2 | 3 | /* this ALWAYS GENERATED file contains the IIDs and CLSIDs */ 4 | 5 | /* link this file in with the server and any clients */ 6 | 7 | 8 | /* File created by MIDL compiler version 8.01.0622 */ 9 | /* at Tue Jan 19 06:14:07 2038 10 | */ 11 | /* Compiler settings for ExdiKdSample.idl: 12 | Oicf, W1, Zp8, env=Win64 (32b run), target_arch=AMD64 8.01.0622 13 | protocol : all , ms_ext, c_ext, robust 14 | error checks: allocation ref bounds_check enum stub_data 15 | VC __declspec() decoration level: 16 | __declspec(uuid()), __declspec(selectany), __declspec(novtable) 17 | DECLSPEC_UUID(), MIDL_INTERFACE() 18 | */ 19 | /* @@MIDL_FILE_HEADING( ) */ 20 | 21 | 22 | 23 | #ifdef __cplusplus 24 | extern "C"{ 25 | #endif 26 | 27 | 28 | #include 29 | #include 30 | 31 | #ifdef _MIDL_USE_GUIDDEF_ 32 | 33 | #ifndef INITGUID 34 | #define INITGUID 35 | #include 36 | #undef INITGUID 37 | #else 38 | #include 39 | #endif 40 | 41 | #define MIDL_DEFINE_GUID(type,name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) \ 42 | DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) 43 | 44 | #else // !_MIDL_USE_GUIDDEF_ 45 | 46 | #ifndef __IID_DEFINED__ 47 | #define __IID_DEFINED__ 48 | 49 | typedef struct _IID 50 | { 51 | unsigned long x; 52 | unsigned short s1; 53 | unsigned short s2; 54 | unsigned char c[8]; 55 | } IID; 56 | 57 | #endif // __IID_DEFINED__ 58 | 59 | #ifndef CLSID_DEFINED 60 | #define CLSID_DEFINED 61 | typedef IID CLSID; 62 | #endif // CLSID_DEFINED 63 | 64 | #define MIDL_DEFINE_GUID(type,name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) \ 65 | EXTERN_C __declspec(selectany) const type name = {l,w1,w2,{b1,b2,b3,b4,b5,b6,b7,b8}} 66 | 67 | #endif // !_MIDL_USE_GUIDDEF_ 68 | 69 | MIDL_DEFINE_GUID(IID, IID_IeXdiServerFactory3,0x22EFA264,0x6FD7,0x4992,0x94,0x27,0x12,0x5B,0x51,0x1A,0x47,0x7C); 70 | 71 | 72 | MIDL_DEFINE_GUID(IID, IID_IeXdiServer3,0x2E501506,0x9703,0x4B6F,0x9D,0x0D,0x6B,0x42,0xB0,0xE4,0x1E,0x6F); 73 | 74 | 75 | MIDL_DEFINE_GUID(IID, IID_IeXdiCodeBreakpoint3,0x386D8BCB,0x9D1E,0x4BF4,0xBE,0x90,0x90,0xD7,0x80,0x25,0x45,0xFE); 76 | 77 | 78 | MIDL_DEFINE_GUID(IID, IID_IeXdiDataBreakpoint3,0xFC90E444,0x6E23,0x40C1,0xA8,0xD0,0x12,0x03,0xC8,0xAD,0xB3,0x24); 79 | 80 | 81 | MIDL_DEFINE_GUID(IID, IID_IeXdiX86Context3,0xEBBBE2D6,0x9B1E,0x4F35,0xB9,0x56,0x28,0xA7,0x8C,0x34,0x8F,0x0F); 82 | 83 | 84 | MIDL_DEFINE_GUID(IID, IID_IeXdiX86ExContext3,0x3F2A6A8A,0xD56B,0x4605,0x8A,0x93,0xAC,0x1C,0x9B,0x7E,0x63,0x18); 85 | 86 | 87 | MIDL_DEFINE_GUID(IID, IID_IeXdiARM4Context3,0x25A27A99,0xC6F7,0x4A27,0x87,0x49,0xFA,0x7E,0xA6,0x38,0xAD,0xB5); 88 | 89 | 90 | MIDL_DEFINE_GUID(IID, IID_IeXdiArmV8Arch64Context3,0x2146BE85,0x7866,0x4309,0xB9,0x73,0xF9,0x65,0x0D,0x1A,0xA8,0x86); 91 | 92 | 93 | MIDL_DEFINE_GUID(IID, IID_IeXdiX86_64Context3,0x3A5BF3FF,0x8CDA,0x4789,0x83,0x23,0xBE,0x04,0xA9,0x70,0xD0,0x06); 94 | 95 | 96 | MIDL_DEFINE_GUID(IID, IID_IeXdiIA64Context3,0x24C6A990,0x780C,0x428E,0xBE,0x5B,0xE2,0x7E,0x2C,0xAE,0xA0,0x5A); 97 | 98 | 99 | MIDL_DEFINE_GUID(IID, IID_IeXdiEBCContext3,0x6C4E5523,0x3AC1,0x4014,0xB4,0x54,0xE5,0x4E,0x18,0x0A,0xBD,0x8E); 100 | 101 | 102 | MIDL_DEFINE_GUID(IID, IID_IeXdiClientNotifyRunChg3,0xCEC95378,0x3797,0x4079,0x9C,0x70,0xA4,0x5A,0xB2,0xF8,0x52,0x78); 103 | 104 | 105 | MIDL_DEFINE_GUID(IID, IID_IeXdiKeepaliveInterface3,0x2AD8BA47,0xDE4D,0x47E2,0xA9,0x22,0x78,0xE5,0x79,0x0A,0x0E,0x0A); 106 | 107 | 108 | MIDL_DEFINE_GUID(IID, IID_IeXdiControlComponentFunctions,0x630e91f3,0xdfe2,0x49c8,0xb2,0x74,0x28,0x43,0x59,0x5a,0x4f,0xa6); 109 | 110 | 111 | MIDL_DEFINE_GUID(IID, IID_IAsynchronousCommandNotificationReceiver,0x650FE759,0xCC39,0x49A8,0x8B,0xBA,0x13,0xDE,0x47,0x10,0x7B,0x98); 112 | 113 | 114 | MIDL_DEFINE_GUID(IID, LIBID_ExdiKdSampleLib,0xFEA1B500,0x2641,0x4B1D,0x88,0xA3,0xE7,0x95,0x42,0x9C,0x84,0x2B); 115 | 116 | 117 | MIDL_DEFINE_GUID(CLSID, CLSID_StaticExdiSampleServer,0x53838F70,0x0936,0x44A9,0xAB,0x4E,0xAB,0xB5,0x68,0x40,0x15,0x08); 118 | 119 | 120 | MIDL_DEFINE_GUID(CLSID, CLSID_LiveExdiSampleServer,0x67030926,0x1754,0x4FDA,0x97,0x88,0x7F,0x73,0x1C,0xBD,0xAE,0x42); 121 | 122 | #undef MIDL_DEFINE_GUID 123 | 124 | #ifdef __cplusplus 125 | } 126 | #endif 127 | 128 | 129 | 130 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/BufferedStreamReader.cpp: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // BufferedStreamReader.cpp 4 | // 5 | // A class used to read a stream line-by-line with an arbitrary delimiter. 6 | // 7 | // Copyright (c) Microsoft. All rights reserved. 8 | // 9 | //---------------------------------------------------------------------------- 10 | 11 | #include "stdafx.h" 12 | #include "BufferedStreamReader.h" 13 | #include "ExceptionHelpers.h" 14 | #include 15 | 16 | using namespace KDControllerLib; 17 | 18 | BufferedStreamReader::BufferedStreamReader(_In_ HANDLE stream) 19 | : m_stream(stream) 20 | , m_frontGapSize(0) 21 | { 22 | assert(stream != INVALID_HANDLE_VALUE); 23 | } 24 | 25 | BufferedStreamReader::~BufferedStreamReader() 26 | { 27 | } 28 | 29 | std::string BufferedStreamReader::Read(_In_ const std::regex &delimiter, _Out_opt_ MatchCollection *pRegexMatches) 30 | { 31 | std::string result; 32 | 33 | for (;;) 34 | { 35 | if (TryReadBufferedData(&result, delimiter, pRegexMatches)) 36 | { 37 | return result; 38 | } 39 | 40 | RemoveFrontGapInBuffer(); 41 | 42 | if (!m_internalBuffer.TryEnsureCapacity(m_internalBuffer.GetLength() + c_readChunkSize)) 43 | { 44 | throw _com_error(E_OUTOFMEMORY); 45 | } 46 | 47 | size_t availableSize = m_internalBuffer.GetCapacity() - m_internalBuffer.GetLength(); 48 | assert(availableSize >= c_readChunkSize); 49 | 50 | DWORD bytesRead; 51 | 52 | if (!ReadFile(m_stream, 53 | m_internalBuffer.GetInternalBuffer() + m_internalBuffer.GetLength(), 54 | (availableSize > MAXDWORD) ? MAXDWORD : static_cast(availableSize), 55 | &bytesRead, 56 | nullptr)) 57 | { 58 | throw _com_error(HRESULT_FROM_WIN32(GetLastError())); 59 | } 60 | 61 | if (bytesRead == 0) 62 | { 63 | throw _com_error(E_FAIL); 64 | } 65 | 66 | m_internalBuffer.SetLength(m_internalBuffer.GetLength() + bytesRead); 67 | } 68 | } 69 | 70 | void BufferedStreamReader::RemoveFrontGapInBuffer() 71 | { 72 | if (m_frontGapSize != 0) 73 | { 74 | assert(m_frontGapSize <= m_internalBuffer.GetLength()); 75 | 76 | memmove(m_internalBuffer.GetInternalBuffer(), 77 | m_internalBuffer.GetInternalBuffer() + m_frontGapSize, 78 | m_internalBuffer.GetLength() - m_frontGapSize); 79 | 80 | m_internalBuffer.SetLength(m_internalBuffer.GetLength() - m_frontGapSize); 81 | m_frontGapSize = 0; 82 | } 83 | } 84 | 85 | 86 | bool BufferedStreamReader::TryReadBufferedData(_Inout_ std::string *pBuffer, 87 | _In_ const std::regex &delimiter, 88 | _Out_opt_ MatchCollection *pRegexMatches) 89 | { 90 | assert(pBuffer != nullptr); 91 | assert(m_frontGapSize <= m_internalBuffer.GetLength()); 92 | pBuffer->clear(); 93 | 94 | if (m_internalBuffer.GetLength() == m_frontGapSize) 95 | { 96 | return false; 97 | } 98 | 99 | char *pEndOfSearchedBuffer = m_internalBuffer.GetEndOfData(); 100 | std::cmatch matches; 101 | 102 | if (!std::regex_search(m_internalBuffer.GetInternalBuffer() + m_frontGapSize, 103 | pEndOfSearchedBuffer, 104 | matches, 105 | delimiter)) 106 | { 107 | return false; 108 | } 109 | 110 | if (matches.empty()) 111 | { 112 | assert(!"Unexpected zero-length matches returned by regex_search()"); 113 | return false; 114 | } 115 | 116 | size_t delimiterOffset = matches[0].first - m_internalBuffer.GetInternalBuffer(); 117 | assert(delimiterOffset < m_internalBuffer.GetLength()); 118 | 119 | pBuffer->assign(m_internalBuffer.GetInternalBuffer() + m_frontGapSize, delimiterOffset - m_frontGapSize); 120 | 121 | m_frontGapSize = delimiterOffset + matches[0].length(); 122 | assert(m_frontGapSize <= m_internalBuffer.GetLength()); 123 | 124 | if (pRegexMatches != nullptr) 125 | { 126 | pRegexMatches->clear(); 127 | for (size_t i = 1; i < matches.size(); i++) 128 | { 129 | pRegexMatches->push_back(matches[i].str()); 130 | } 131 | } 132 | 133 | return true; 134 | } 135 | -------------------------------------------------------------------------------- /LiveCloudKdSdk/public/HvlibEnumPublic.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #ifndef __SDKENUMP_H__ 4 | #define __SDKENUMP_H__ 5 | 6 | #ifdef __cplusplus 7 | extern "C" { 8 | #endif 9 | 10 | #define PAGE_SIZE 0x1000 11 | #define MAX_PROCESSORS 256 //use for host and guest OS processor's count limitation 12 | #define MAX_NUMBER_OF_RUNS_BYTES 0x4000 //also used in MAX_NUMBER_OF_RUNS calc in device_hvmm.c 13 | #define KD_DEBUGGER_BLOCK_PAGE_SIZE 0x500 //correlation with KDDEBUGGER_DATA64 struct size 14 | #define ROUND_PAGE(x) ((x + PAGE_SIZE) & ~(PAGE_SIZE - 1)) 15 | #define MZ_HEADER 0x905A4D 16 | #define MAX_FILE_SOURCE_DMP_PATH 0x50 17 | 18 | typedef enum _GUEST_TYPE { 19 | MmUknown, 20 | MmStandard, // standard Windows with KDBG structure 21 | MmNonKdbgPartition, // for hvix memory area, and, probably, isloated securekernel, if needed 22 | MmHyperV // Special for hvix/hvax memory 23 | } GUEST_TYPE; 24 | 25 | typedef enum _MEMORY_ACCESS_TYPE { 26 | MmPhysicalMemory, 27 | MmVirtualMemory, 28 | MmAccessRtCore64, 29 | } MEMORY_ACCESS_TYPE; 30 | 31 | typedef enum _VTL_LEVEL { 32 | Vtl0 = 0, 33 | Vtl1 = 1, 34 | BadVtl = 2 35 | } VTL_LEVEL, *PVTL_LEVEL; 36 | 37 | typedef enum _MACHINE_TYPE { 38 | MACHINE_UNKNOWN = 0, 39 | MACHINE_X86 = 1, 40 | MACHINE_AMD64 = 2 41 | } MACHINE_TYPE, *PMACHINE_TYPE; 42 | 43 | typedef enum _HVMM_INFORMATION_CLASS { 44 | InfoKdbgData, //0. Return pointer to PKDDEBUGGER_DATA64 45 | InfoPartitionFriendlyName, //1. Return pointer to WCHAR Partition friendly name 46 | InfoPartitionId, //2. Return pointer to ULONG64 PartitionId 47 | InfoVmtypeString, //3. Return pointer to WCHAR VmTypeString 48 | InfoStructure, //4. Return pointer to PHVMM_PARTITION 49 | InfoKiProcessorBlock, //5. Return pointer to ULONG64 PHVMM_PARTITION-EXCALIBUR_DATA.KiProcessorBlock 50 | InfoMmMaximumPhysicalPage, //6. Return pointer to ULONG64 PHVMM_PARTITION-EXCALIBUR_DATA.MmMaximumPhysicalPage 51 | InfoKPCR, //7. Return pointer to array KiExcaliburData.KPCRVa. It contains array of KPCR for every logical processor 52 | InfoNumberOfCPU, //8. Return PHVMM_PARTITION-EXCALIBUR_DATA.NumberProcessors 53 | InfoKDBGPa, //9. Return PartitionEntry->KiExcaliburData.KdDebuggerDataBlockPa.QuadPart 54 | InfoNumberOfRuns, //10. PartitionEntry->KiExcaliburData.KernelBase 55 | InfoKernelBase, 56 | InfoMmPfnDatabase, 57 | InfoPsLoadedModuleList, 58 | InfoPsActiveProcessHead, 59 | InfoNtBuildNumber, 60 | InfoNtBuildNumberVA, 61 | InfoDirectoryTableBase, 62 | InfoRun, 63 | InfoKdbgDataBlockArea, 64 | InfoVmGuidString, 65 | InfoPartitionHandle, 66 | InfoKdbgContext, 67 | InfoKdVersionBlock, 68 | InfoMmPhysicalMemoryBlock, 69 | InfoNumberOfPages, 70 | InfoIdleKernelStack, 71 | InfoSizeOfKdDebuggerData, 72 | InfoCpuContextVa, 73 | InfoSize, 74 | InfoMemoryBlockCount, 75 | InfoSuspendedCores, 76 | InfoSuspendedWorker, 77 | InfoIsContainer, 78 | InfoIsNeedVmwpSuspend, 79 | InfoGuestOsType, 80 | InfoSettingsCrashDumpEmulation, 81 | InfoSettingsUseDecypheredKdbg, 82 | InfoBuilLabBuffer, 83 | //Special set values 84 | InfoSetMemoryBlock, 85 | InfoEnlVmcsPointer 86 | } HVMM_INFORMATION_CLASS; 87 | 88 | typedef enum _VM_STATE_ACTION { 89 | SuspendVm, 90 | ResumeVm 91 | } VM_STATE_ACTION; 92 | 93 | typedef enum _SUSPEND_RESUME_METHOD { 94 | SuspendResumeUnsupported, 95 | SuspendResumePowershell, 96 | SuspendResumeWriteSpecRegister 97 | } SUSPEND_RESUME_METHOD; 98 | 99 | typedef enum _WRITE_MEMORY_METHOD { 100 | WriteInterfaceWinHv, //0 101 | WriteInterfaceHvmmDrvInternal, //1 102 | WriteInterfaceUnsupported //2 103 | } WRITE_MEMORY_METHOD; 104 | 105 | typedef enum _READ_MEMORY_METHOD { 106 | ReadInterfaceWinHv, //0 107 | ReadInterfaceHvmmDrvInternal, //1 108 | ReadInterfaceUnsupported //2 109 | } READ_MEMORY_METHOD; 110 | 111 | 112 | typedef struct _VM_OPERATIONS_CONFIG { 113 | READ_MEMORY_METHOD ReadMethod; 114 | WRITE_MEMORY_METHOD WriteMethod; 115 | SUSPEND_RESUME_METHOD SuspendMethod; 116 | ULONG64 LogLevel; 117 | BOOLEAN ForceFreezeCPU; 118 | BOOLEAN PausePartition; 119 | HANDLE ExdiConsoleHandle; 120 | BOOLEAN ReloadDriver; 121 | BOOLEAN PFInjection; 122 | BOOLEAN NestedScan; 123 | BOOLEAN UseDebugApiStopProcess; 124 | BOOLEAN SimpleMemory; 125 | BOOLEAN ReplaceDecypheredKDBG; 126 | BOOLEAN FullCrashDumpEmulation; 127 | BOOLEAN EnumGuestOsBuild; 128 | } VM_OPERATIONS_CONFIG, * PVM_OPERATIONS_CONFIG; 129 | 130 | // 131 | // Read memory method for all operations. Must be defined in SdkGetPartitions call. 132 | // 133 | 134 | 135 | #ifdef __cplusplus 136 | }; 137 | #endif 138 | 139 | #endif //#ifndef __SDKPUBLIC_H__ -------------------------------------------------------------------------------- /hvmm/hvmm/misc.c: -------------------------------------------------------------------------------- 1 | #include "hvmm.h" 2 | 3 | //https://github.com/Zer0Mem0ry/KernelBhop/blob/master/Driver/Driver.c 4 | //https://github.com/Zer0Mem0ry/KernelReadWriteMemory/blob/master/ReadWrite.c 5 | 6 | 7 | 8 | NTSTATUS KeReadProcessMemory(PEPROCESS Process, PVOID SourceAddress, PVOID TargetAddress, SIZE_T Size) 9 | { 10 | NTSTATUS Status; 11 | // Since the process we are reading from is the input process, we set 12 | // the source process variable for that. 13 | PEPROCESS SourceProcess = Process; 14 | // Since the "process" we read the output to is this driver 15 | // we set the target process as the current module. 16 | PEPROCESS TargetProcess = PsGetCurrentProcess(); 17 | SIZE_T Result; 18 | 19 | Status = MmCopyVirtualMemory(SourceProcess, SourceAddress, TargetProcess, TargetAddress, Size, KernelMode, &Result); 20 | 21 | return Status; 22 | //if (NT_SUCCESS()) 23 | // return STATUS_SUCCESS; // operation was successful 24 | //else 25 | // return STATUS_ACCESS_DENIED; 26 | } 27 | 28 | //http://alter.org.ua/en/docs/nt_kernel/procaddr/ 29 | PVOID 30 | KernelGetProcAddress( 31 | PVOID ModuleBase, 32 | PCHAR pFunctionName 33 | ) 34 | { 35 | PVOID pFunctionAddress = NULL; 36 | 37 | __try 38 | { 39 | ULONG size = 0; 40 | PIMAGE_EXPORT_DIRECTORY exports = (PIMAGE_EXPORT_DIRECTORY) 41 | RtlImageDirectoryEntryToData(ModuleBase, TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &size); 42 | 43 | PUCHAR addr = (PUCHAR)((ULONG64)exports - (ULONG64)ModuleBase); 44 | PULONG functions = (PULONG)((ULONG64)ModuleBase + exports->AddressOfFunctions); 45 | PSHORT ordinals = (PSHORT)((ULONG64)ModuleBase + exports->AddressOfNameOrdinals); 46 | PULONG names = (PULONG)((ULONG64)ModuleBase + exports->AddressOfNames); 47 | ULONG max_name = exports->NumberOfNames; 48 | ULONG max_func = exports->NumberOfFunctions; 49 | 50 | ULONG i; 51 | 52 | for (i = 0; i < max_name; i++) 53 | { 54 | ULONG ord = ordinals[i]; 55 | if (i >= max_name || ord >= max_func) { 56 | return NULL; 57 | } 58 | if (functions[ord] < (ULONG64)addr || functions[ord] >= (ULONG64)addr + size) 59 | { 60 | if (strcmp((PCHAR)ModuleBase + names[i], pFunctionName) == 0) 61 | { 62 | pFunctionAddress = (PVOID)((PCHAR)ModuleBase + functions[ord]); 63 | break; 64 | } 65 | } 66 | } 67 | } 68 | __except (EXCEPTION_EXECUTE_HANDLER) 69 | { 70 | pFunctionAddress = NULL; 71 | } 72 | 73 | return pFunctionAddress; 74 | } // end KernelGetProcAddress() 75 | 76 | 77 | PVOID FindDrvBaseAddress(PCHAR pModuleName) 78 | { 79 | ULONG i, ModuleCount; 80 | PSYSTEM_MODULE_INFORMATION pSystemModuleInformation = NULL; 81 | ULONG Len = 0; 82 | PVOID pBuffer; 83 | PVOID pRet = NULL; 84 | PVOID pBaseAddress = NULL; 85 | //const char *sDriverName = "winhv.sys"; 86 | ZwQuerySystemInformation(SystemModuleInformation, &pSystemModuleInformation, 0, &Len); 87 | KDbgLog("Length ", Len); 88 | pBuffer = MmAllocateNonCachedMemory(Len); 89 | KDbgLog16("pBuffer ", (ULONG64)pBuffer); 90 | if (!pBuffer) 91 | { 92 | KDbgPrintString("WindowsGetDriverCodeSection. pBuffer allocation failed"); 93 | return pRet; 94 | } 95 | 96 | if (ZwQuerySystemInformation(SystemModuleInformation, pBuffer, Len, &Len)) { 97 | KDbgPrintString("WindowsGetDriverCodeSection. ZwQuerySystemInformation failed"); 98 | MmFreeNonCachedMemory(pBuffer, Len); 99 | return pRet; 100 | } 101 | 102 | ModuleCount = *(UINT32*)pBuffer; 103 | KDbgLog("ModuleCount ", ModuleCount); 104 | pSystemModuleInformation = (PSYSTEM_MODULE_INFORMATION)((unsigned char*)pBuffer + sizeof(size_t)); 105 | for (i = 0; i < ModuleCount; i++) { 106 | //DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_PRINT_LEVEL,"pSystemModuleInformation->ImageName = %s\n",pSystemModuleInformation->Module->ImageName); 107 | if (strstr(pSystemModuleInformation->Module->ImageName, pModuleName)) //driver name is case-sensitive 108 | { 109 | DbgPrintEx(DPFLTR_IHVDRIVER_ID, DBG_PRINT_LEVEL, "Driver found = %s\n", pSystemModuleInformation->Module->ImageName); 110 | pBaseAddress = pSystemModuleInformation->Module->Base; 111 | KDbgLog16("Base address is ", (ULONG64)pBaseAddress); 112 | pRet = pBaseAddress; 113 | break; 114 | } 115 | pSystemModuleInformation++; 116 | } 117 | MmFreeNonCachedMemory(pBuffer, Len); 118 | return pRet; 119 | } -------------------------------------------------------------------------------- /LiveCloudKdSdk/public/HvlibHandle.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #ifndef __SDKHANDLE_H__ 4 | #define __SDKHANDLE_H__ 5 | 6 | #ifdef __cplusplus 7 | extern "C" { 8 | #endif 9 | 10 | #ifdef LIVECLOUDKDSDK_EXPORTS 11 | #define FUNCTION_TYPE DLLEXPORT 12 | #else 13 | #define FUNCTION_TYPE DECLSPEC_IMPORT 14 | #endif 15 | 16 | #include 17 | #include "HvlibEnumPublic.h" 18 | #include "HyperV\vid.h" 19 | 20 | 21 | // 22 | //Next functions are wrappers for non-C languages 23 | // 24 | 25 | // 26 | //Get preferred memory operations for different OS. 27 | // 28 | 29 | FUNCTION_TYPE 30 | BOOLEAN 31 | SdkGetDefaultConfig(_Inout_ PVM_OPERATIONS_CONFIG VmOperationsConfig); 32 | 33 | // 34 | //Get current VTL (for live debugging purposes) 35 | // 36 | 37 | FUNCTION_TYPE 38 | VTL_LEVEL 39 | SdkGetCurrentVtl(_In_ ULONG64 PartitionHandle, _In_ ULONG64 Va); 40 | 41 | // 42 | //Enumerate active Hyper-V partitions, table of handles is returned 43 | // 44 | 45 | FUNCTION_TYPE PULONG64 46 | SdkEnumPartitions(_Inout_ PULONG64 PartitionTableCount, _In_ PVM_OPERATIONS_CONFIG VmOpsConfig); 47 | 48 | // 49 | //Get information about partition object, using handle 50 | // 51 | 52 | FUNCTION_TYPE BOOLEAN SdkGetData(_In_ ULONG64 PartitionHandle, _In_ HVMM_INFORMATION_CLASS HvmmInformationClass, _Inout_ PVOID InfoInformation); 53 | FUNCTION_TYPE ULONG64 SdkGetData2(_In_ ULONG64 PartitionHandle, _In_ HVMM_INFORMATION_CLASS HvmmInformationClass); 54 | FUNCTION_TYPE ULONG64 SdkSetData(_In_ ULONG64 PartitionHandle, _In_ HVMM_INFORMATION_CLASS HvmmInformationClass, _In_ ULONG64 InfoInformation); 55 | 56 | // 57 | //Select current partition object, fill it with additional guest os info. 58 | // 59 | 60 | FUNCTION_TYPE BOOLEAN SdkSelectPartition(_In_ ULONG64 PartitionHandle); 61 | 62 | // 63 | //Read bytes from guest physical address (GPA) to (ClientBuffer) 64 | // 65 | 66 | FUNCTION_TYPE BOOLEAN SdkReadPhysicalMemory(_In_ ULONG64 PartitionHandle, _In_ UINT64 StartPosition, _In_ UINT64 ReadByteCount, _Inout_ PVOID ClientBuffer, _In_ READ_MEMORY_METHOD Method); 67 | 68 | // 69 | //Write bytes from buffer (ClientBuffer) to guest OS physical address space (GPA) 70 | // 71 | 72 | FUNCTION_TYPE BOOLEAN SdkWritePhysicalMemory(_In_ ULONG64 PartitionHandle, _In_ UINT64 StartPosition, _In_ UINT64 WriteBytesCount, _In_ PVOID ClientBuffer, _In_ WRITE_MEMORY_METHOD Method); 73 | 74 | // 75 | //Read bytes from guest virtual address (GVA) to (Buffer) 76 | // 77 | 78 | FUNCTION_TYPE BOOLEAN SdkReadVirtualMemory(_In_ ULONG64 PartitionHandle, _In_ ULONG64 Va, _Out_ PVOID Buffer, _In_ ULONG Size); 79 | 80 | // 81 | //Write bytes from buffer (ClientBuffer) to guest OS virtual address space (GVA) 82 | // 83 | 84 | FUNCTION_TYPE BOOLEAN SdkWriteVirtualMemory(_In_ ULONG64 PartitionHandle, _In_ ULONG64 Va, _In_ PVOID Buffer, _In_ ULONG Size); 85 | 86 | 87 | // 88 | // Resume or suspending VM (Action is SuspendVm or ResumeVm) 89 | // ActionMethod is SuspendResumePowershell or SuspendResumeWriteSpecRegister 90 | // 91 | 92 | FUNCTION_TYPE BOOLEAN SdkControlVmState(_In_ ULONG64 PartitionHandle, _In_ VM_STATE_ACTION Action, _In_ SUSPEND_RESUME_METHOD ActionMethod, _In_ BOOLEAN ManageWorkerProcess); 93 | 94 | // 95 | //Get physical address for specifying GVA 96 | // 97 | 98 | FUNCTION_TYPE ULONG64 SdkGetPhysicalAddress(_In_ ULONG64 PartitionHandle, _In_ ULONG64 Va, _In_ MEMORY_ACCESS_TYPE MmAccess); 99 | 100 | // 101 | // Get architecture of guest VM (x86 or AMD64). Plugin supports only AMD64 guest VMs 102 | // 103 | 104 | FUNCTION_TYPE MACHINE_TYPE SdkGetMachineType(_In_ ULONG64 PartitionHandle); 105 | 106 | // 107 | // Read guest OS registers. 108 | // 109 | 110 | FUNCTION_TYPE BOOLEAN SdkWriteVpRegister(_In_ ULONG64 PartitionHandle, _In_ HV_VP_INDEX VpIndex, _In_ VTL_LEVEL InputVtl, _In_ HV_REGISTER_NAME RegisterCode, _In_ PHV_REGISTER_VALUE RegisterValue); 111 | 112 | // 113 | // Write guest OS registers. 114 | // 115 | 116 | FUNCTION_TYPE BOOLEAN SdkReadVpRegister(_In_ ULONG64 PartitionHandle, _In_ HV_VP_INDEX VpIndex, _In_ VTL_LEVEL InputVtl, _In_ HV_REGISTER_NAME RegisterCode, _Inout_ PHV_REGISTER_VALUE RegisterValue); 117 | 118 | // 119 | //Close and free all objects, when program is closing 120 | // 121 | 122 | FUNCTION_TYPE BOOLEAN SdkCloseAllPartitions(); 123 | 124 | // 125 | // Close one partition object. Can be used if multiple instances are opened 126 | // 127 | 128 | FUNCTION_TYPE VOID SdkClosePartition(ULONG64 Handle); 129 | 130 | // 131 | // Read bytes from guest physical address (GPA) to (ClientBuffer) 132 | // 133 | 134 | FUNCTION_TYPE BOOLEAN SdkNumberToString(_In_ WCHAR* Str1, _In_ WCHAR* Str2, _In_ ULONG Num1, _In_ ULONG Num2); 135 | 136 | #ifdef __cplusplus 137 | }; 138 | #endif 139 | 140 | #endif //#ifndef __SDKPUBLIC_H__ -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/LiveExdiSampleServer.h: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // LiveExdiSampleServer.h 4 | // 5 | // A sample EXDI server class with support for setting breakpoints, stepping 6 | // and continuing execution. 7 | // 8 | // Copyright (c) Microsoft. All rights reserved. 9 | // 10 | //---------------------------------------------------------------------------- 11 | 12 | #pragma once 13 | #include "resource.h" // main symbols 14 | 15 | #include "ExdiKdSample.h" 16 | #include "StaticExdiSampleServer.h" 17 | #include "InterfaceMarshalHelper.h" 18 | 19 | #if defined(_WIN32_WCE) && !defined(_CE_DCOM) && !defined(_CE_ALLOW_SINGLE_THREADED_OBJECTS_IN_MTA) 20 | #error "Single-threaded COM objects are not properly supported on Windows CE platform, such as the Windows Mobile platforms that do not include full DCOM support. Define _CE_ALLOW_SINGLE_THREADED_OBJECTS_IN_MTA to force ATL to support creating single-thread COM object's and allow use of it's single-threaded COM object implementations. The threading model in your rgs file was set to 'Free' as that is the only threading model supported in non DCOM Windows CE platforms." 21 | #endif 22 | 23 | using namespace ATL; 24 | 25 | 26 | // CLiveExdiSampleServer 27 | 28 | class ATL_NO_VTABLE CLiveExdiSampleServer : 29 | public CComCoClass, 30 | public CStaticExdiSampleServer, 31 | public IAsynchronousCommandNotificationReceiver 32 | { 33 | public: 34 | CLiveExdiSampleServer() 35 | : m_pSelfReferenceForNotificationThread(nullptr) 36 | , m_notificationThread(nullptr) 37 | , m_notificationSemaphore(nullptr) 38 | , m_terminating(false) 39 | , m_lastResumingCommandWasStep(false) 40 | , m_targetIsRunning(false) 41 | , m_timerId(0) 42 | { 43 | } 44 | 45 | ~CLiveExdiSampleServer() 46 | { 47 | assert(m_terminating); 48 | } 49 | 50 | DECLARE_REGISTRY_RESOURCEID(IDR_LIVEEXDISAMPLESERVER) 51 | DECLARE_NOT_AGGREGATABLE(CLiveExdiSampleServer) 52 | 53 | BEGIN_COM_MAP(CLiveExdiSampleServer) 54 | COM_INTERFACE_ENTRY(IeXdiServer3) 55 | COM_INTERFACE_ENTRY(IeXdiARM4Context3) 56 | COM_INTERFACE_ENTRY(IeXdiX86_64Context3) 57 | COM_INTERFACE_ENTRY(IeXdiArmV8Arch64Context3) 58 | COM_INTERFACE_ENTRY(IAsynchronousCommandNotificationReceiver) 59 | END_COM_MAP() 60 | 61 | virtual HRESULT FinalConstruct() override; 62 | virtual void FinalRelease() override; 63 | 64 | virtual HRESULT STDMETHODCALLTYPE DoSingleStep(DWORD dwProcessorNumber) override; 65 | virtual HRESULT STDMETHODCALLTYPE Run(void) override; 66 | virtual HRESULT STDMETHODCALLTYPE Halt(void) override; 67 | 68 | virtual HRESULT STDMETHODCALLTYPE StartNotifyingRunChg( 69 | /* [in] */ IeXdiClientNotifyRunChg3 *pieXdiClientNotifyRunChg, 70 | /* [out] */ DWORD *pdwConnectionCookie) override; 71 | 72 | virtual HRESULT STDMETHODCALLTYPE StopNotifyingRunChg( 73 | /* [in] */ DWORD dwConnectionCookie) override; 74 | 75 | virtual HRESULT STDMETHODCALLTYPE SetContextEx(_In_ DWORD processorNumber, _In_ const CONTEXT_ARM4 *pContext) override; 76 | virtual HRESULT STDMETHODCALLTYPE SetContextEx(_In_ DWORD processorNumber, _In_ const CONTEXT_X86_64 *pContext) override; 77 | 78 | virtual HRESULT STDMETHODCALLTYPE GetRunStatus( 79 | /* [out] */ PRUN_STATUS_TYPE persCurrent, 80 | /* [out] */ PHALT_REASON_TYPE pehrCurrent, 81 | /* [out] */ ADDRESS_TYPE *pCurrentExecAddress, 82 | /* [out] */ DWORD *pdwExceptionCode, 83 | /* [out] */ DWORD *pdwProcessorNumberOfLastEvent) override; 84 | 85 | virtual HRESULT STDMETHODCALLTYPE AddCodeBreakpoint( 86 | /* [in] */ ADDRESS_TYPE Address, 87 | /* [in] */ CBP_KIND cbpk, 88 | /* [in] */ MEM_TYPE mt, 89 | /* [in] */ DWORD dwExecMode, 90 | /* [in] */ DWORD dwTotalBypassCount, 91 | /* [out] */ IeXdiCodeBreakpoint3 **ppieXdiCodeBreakpoint) override; 92 | 93 | virtual HRESULT STDMETHODCALLTYPE DelCodeBreakpoint( 94 | /* [in] */ IeXdiCodeBreakpoint3 *pieXdiCodeBreakpoint) override; 95 | 96 | virtual HRESULT STDMETHODCALLTYPE SetKeepaliveInterface( 97 | /* [in] */ IeXdiKeepaliveInterface3 *pKeepalive); 98 | 99 | virtual HRESULT STDMETHODCALLTYPE OnAsynchronousCommandCompleted(void); 100 | virtual HRESULT STDMETHODCALLTYPE PerformKeepaliveChecks(void); 101 | 102 | virtual HRESULT STDMETHODCALLTYPE SetContextEx(_In_ DWORD processorNumber, _In_ const CONTEXT_ARMV8ARCH64 * pContext) override; 103 | 104 | private: 105 | CComPtr m_pRunNotificationListener; 106 | 107 | InterfaceMarshalHelper *m_pSelfReferenceForNotificationThread; 108 | HANDLE m_notificationThread; 109 | HANDLE m_notificationSemaphore; 110 | bool m_terminating; 111 | bool m_lastResumingCommandWasStep; 112 | bool m_targetIsRunning; 113 | UINT_PTR m_timerId; 114 | CComPtr m_pKeepaliveInterface; 115 | 116 | static DWORD CALLBACK NotificationThreadBody(LPVOID p); 117 | 118 | static VOID CALLBACK SampleTimerCallback(_In_ HWND hwnd, _In_ UINT uMsg, _In_ UINT_PTR idEvent, _In_ DWORD dwTime); 119 | }; 120 | 121 | OBJECT_ENTRY_AUTO(__uuidof(LiveExdiSampleServer), CLiveExdiSampleServer) 122 | -------------------------------------------------------------------------------- /ExdiKdSample/ExdiKdSample/dbgeng_exdi_io.h: -------------------------------------------------------------------------------- 1 | // 2 | // Copyright (C) Microsoft. All rights reserved. 3 | // 4 | //---------------------------------------------------------------------------- 5 | // 6 | // Debug engine Ioctls for extending EXDI. 7 | // Covers: 8 | // Read/write MSRs. 9 | // Multiprocessor description and control. 10 | // Determination of what breakpoint was hit for hrBp. 11 | // 12 | //---------------------------------------------------------------------------- 13 | 14 | #ifndef __DBGENG_EXDI_IO_H__ 15 | #define __DBGENG_EXDI_IO_H__ 16 | 17 | // 18 | // Specific Ioctl operations. 19 | // All Ioctl structures must have the Ioctl code as the first member. 20 | // 21 | 22 | typedef enum 23 | { 24 | // Marker for the beginning of the enum. Start at 25 | // a value other than zero to prevent obvious collisions 26 | // with other Ioctl codes. 27 | DBGENG_EXDI_IOC_BEFORE_FIRST = 0x8664, 28 | 29 | DBGENG_EXDI_IOC_IDENTIFY, 30 | DBGENG_EXDI_IOC_READ_MSR, 31 | DBGENG_EXDI_IOC_WRITE_MSR, 32 | DBGENG_EXDI_IOC_IDENTIFY_PROCESSORS, 33 | DBGENG_EXDI_IOC_GET_CURRENT_PROCESSOR, 34 | DBGENG_EXDI_IOC_SET_CURRENT_PROCESSOR, 35 | DBGENG_EXDI_IOC_GET_BREAKPOINT_HIT, 36 | DBGENG_EXDI_IOC_GET_KPCR, //Gets the KPCR pointer for the current thread (e.g. from the TPIDRPRW register on ARM) 37 | 38 | // Marker for the end of the enum. 39 | DBGENG_EXDI_IOC_AFTER_LAST 40 | } DBGENG_EXDI_IOCTL_CODE; 41 | 42 | // This is the next set of IOCTL codes used for exdiV3 43 | typedef enum 44 | { 45 | DBGENG_EXDI_IOCTL_V3_FIRST = DBGENG_EXDI_IOC_AFTER_LAST + 1, 46 | // Get KPCR from the GDTR field for the current thread/processor. 47 | DBGENG_EXDI_IOCTL_V3_GET_KSPECIAL_REG_DESCRIPTOR, 48 | // Store the KPCR value for later usage. 49 | DBGENG_EXDI_IOCTL_V3_STORE_KPCR_VALUE, 50 | // Get the NT base address obtained by the COM server 51 | DBGENG_EXDI_IOCTL_V3_GET_NT_BASE_ADDRESS_VALUE, 52 | // Get the Special registers memory content. 53 | DBGENG_EXDI_IOCTL_V3_GET_SPECIAL_REGISTER_VALUE, 54 | // Get Supervisor/System mode memory content 55 | DBGENG_EXDI_IOCTL_V3_GET_SUPERVISOR_MODE_MEM_VALUE, 56 | // Get Hypervisor mode memory content 57 | DBGENG_EXDI_IOCTL_V3_GET_HYPERVISOR_MODE_MEM_VALUE, 58 | 59 | DBGENG_EXDI_IOCTL_V3_LAST 60 | } DBGENG_EXDI_IOCTL_CODE_V3_EX; 61 | 62 | // Store the kpcr offset. 63 | typedef struct 64 | { 65 | DBGENG_EXDI_IOCTL_CODE_V3_EX code; 66 | ULONG processorNumber; 67 | ULONG64 kpcrOffset; 68 | } DBGENG_EXDI_IOCTL_STORE_KPCR_V3_EX_IN; 69 | 70 | // Special register content request 71 | typedef struct 72 | { 73 | DBGENG_EXDI_IOCTL_CODE_V3_EX code; 74 | ADDRESS_TYPE address; 75 | ULONG bytesToRead; 76 | } DBGENG_EXDI_IOCTL_READ_SPECIAL_MEMORY_EX_IN; 77 | 78 | // 79 | // Basic Ioctl containing only a code for the Ioctl input. 80 | // 81 | 82 | typedef struct _DBGENG_EXDI_IOCTL_BASE_IN 83 | { 84 | DBGENG_EXDI_IOCTL_CODE Code; 85 | } DBGENG_EXDI_IOCTL_BASE_IN; 86 | 87 | // 88 | // IDENTIFY - Verify and describe Ioctl support. 89 | // 90 | 91 | #define DBGENG_EXDI_IOCTL_IDENTIFY_SIGNATURE '468E' 92 | 93 | typedef struct _DBGENG_EXDI_IOCTL_IDENTIFY_OUT 94 | { 95 | ULONG Signature; 96 | DBGENG_EXDI_IOCTL_CODE BeforeFirst; 97 | DBGENG_EXDI_IOCTL_CODE AfterLast; 98 | } DBGENG_EXDI_IOCTL_IDENTIFY_OUT; 99 | 100 | // 101 | // {READ|WRITE}_MSR - Access processor MSRs. 102 | // 103 | 104 | // Input structure is used for both read and write. 105 | typedef struct _DBGENG_EXDI_IOCTL_MSR_IN 106 | { 107 | DBGENG_EXDI_IOCTL_CODE Code; 108 | ULONG Index; 109 | // Value is only used for write. 110 | ULONG64 Value; 111 | } DBGENG_EXDI_IOCTL_MSR_IN; 112 | 113 | typedef struct _DBGENG_EXDI_IOCTL_READ_MSR_OUT 114 | { 115 | ULONG64 Value; 116 | } DBGENG_EXDI_IOCTL_READ_MSR_OUT; 117 | 118 | // 119 | // Multiprocessor support. Basic EXDI doesn't support 120 | // multiprocessor machines so add Ioctls to query and 121 | // control a "current" processor that the EXDI methods 122 | // apply to. 123 | // 124 | 125 | // 126 | // IDENTIFY_PROCESSORS - Used to query the processor configuration. 127 | // Currently only the count is used. Other fields are zeroed. 128 | // 129 | 130 | typedef struct _DBGENG_EXDI_IOCTL_IDENTIFY_PROCESSORS_OUT 131 | { 132 | ULONG Flags; 133 | ULONG NumberProcessors; 134 | ULONG64 Reserved[7]; 135 | } DBGENG_EXDI_IOCTL_IDENTIFY_PROCESSORS_OUT; 136 | 137 | // 138 | // {GET|SET}_CURRENT_PROCESSOR - Current processor control. 139 | // 140 | 141 | typedef struct _DBGENG_EXDI_IOCTL_GET_CURRENT_PROCESSOR_OUT 142 | { 143 | ULONG Processor; 144 | } DBGENG_EXDI_IOCTL_GET_CURRENT_PROCESSOR_OUT; 145 | 146 | typedef struct _DBGENG_EXDI_IOCTL_SET_CURRENT_PROCESSOR_IN 147 | { 148 | DBGENG_EXDI_IOCTL_CODE Code; 149 | ULONG Processor; 150 | } DBGENG_EXDI_IOCTL_SET_CURRENT_PROCESSOR_IN; 151 | 152 | // 153 | // GET_BREAKPOINT_HIT - Determine which breakpoint was hit 154 | // after a breakpoint halt reason. 155 | // 156 | 157 | #define DBGENG_EXDI_IOCTL_BREAKPOINT_NONE 0 158 | #define DBGENG_EXDI_IOCTL_BREAKPOINT_CODE 1 159 | #define DBGENG_EXDI_IOCTL_BREAKPOINT_DATA 2 160 | 161 | typedef struct _DBGENG_EXDI_IOCTL_GET_BREAKPOINT_HIT_OUT 162 | { 163 | ADDRESS_TYPE Address; 164 | ULONG AccessWidth; 165 | DATA_ACCESS_TYPE AccessType; 166 | ULONG Type; 167 | } DBGENG_EXDI_IOCTL_GET_BREAKPOINT_HIT_OUT, *PDBGENG_EXDI_IOCTL_GET_BREAKPOINT_HIT_OUT; 168 | 169 | struct DBGENG_EXDI_IOC_GET_KPCR_IN 170 | { 171 | DBGENG_EXDI_IOCTL_CODE Code; 172 | ULONG ProcessorNumber; 173 | }; 174 | 175 | //Output for DBGENG_EXDI_IOC_GET_KPCR is PULONG64 176 | 177 | #endif // #ifndef __DBGENG_EXDI_IO_H__ 178 | -------------------------------------------------------------------------------- /LiveCloudKd/misc.c: -------------------------------------------------------------------------------- 1 | /*++ 2 | Microsoft Hyper-V Virtual Machine Physical Memory Dumper 3 | Copyright (C) Matt Suiche. All rights reserved. 4 | 5 | Module Name: 6 | 7 | - misc.c 8 | 9 | Abstract: 10 | 11 | - This header file contains definition used by LiveCloudKd (2010) and open-sourced in December 2018 after 12 | collaborating with Arthur Khudyaev (@gerhart_x) to revive the project. 13 | 14 | More information can be found on the original repository: https://github.com/comaeio/LiveCloudKd 15 | 16 | Original 2010 blogpost: https://blogs.technet.microsoft.com/markrussinovich/2010/10/09/livekd-for-virtual-machine-debugging/ 17 | 18 | Environment: 19 | 20 | - User mode 21 | 22 | Revision History: 23 | 24 | - Arthur Khudyaev (@gerhart_x) - 18-Apr-2019 - Add additional methods (using Microsoft winhv.sys and own hvmm.sys driver) for reading guest memory 25 | - Arthur Khudyaev (@gerhart_x) - 20-Feb-2019 - Migrate parto of code to LiveCloudKd plugin 26 | - Arthur Khudyaev (@gerhart_x) - 26-Jan-2019 - Migration to MemProcFS/LeechCore 27 | - Matthieu Suiche (@msuiche) 11-Dec-2018 - Open-sourced LiveCloudKd in December 2018 on GitHub 28 | - Arthur Khudyaev (@gerhart_x) - 28-Oct-2018 - Add partial Windows 10 support 29 | - Matthieu Suiche (@msuiche) 09-Dec-2010 - Initial version from LiveCloudKd and presented at BlueHat 2010 30 | 31 | --*/ 32 | 33 | #include "hvdd.h" 34 | 35 | VIDDLL_FUNCTIONS g_VidDll = { 0 }; 36 | NTDDLL_FUNCTIONS g_NtDll = { 0 }; 37 | 38 | BOOLEAN 39 | ImportGlobalFunctions( 40 | VOID 41 | ) { 42 | HMODULE hVid = LoadLibrary(L"vid.dll"); 43 | if (!hVid) { 44 | Red(L"ERROR: Can't load vid.dll.\n"); 45 | return FALSE; 46 | } 47 | 48 | (FARPROC)g_VidDll.VidGetVirtualProcessorState = GetProcAddress(hVid, "VidGetVirtualProcessorState"); 49 | (FARPROC)g_VidDll.VidReadMemoryBlockPageRange = GetProcAddress(hVid, "VidReadMemoryBlockPageRange"); 50 | (FARPROC)g_VidDll.VidTranslateGvaToGpa = GetProcAddress(hVid, "VidTranslateGvaToGpa"); 51 | (FARPROC)g_VidDll.VidWriteMemoryBlockPageRange = GetProcAddress(hVid, "VidWriteMemoryBlockPageRange"); 52 | (FARPROC)g_VidDll.VidGetHvPartitionId = GetProcAddress(hVid, "VidGetHvPartitionId"); 53 | (FARPROC)g_VidDll.VidGetPartitionFriendlyName = GetProcAddress(hVid, "VidGetPartitionFriendlyName"); 54 | 55 | if (!g_VidDll.VidGetVirtualProcessorState || !g_VidDll.VidReadMemoryBlockPageRange || 56 | !g_VidDll.VidTranslateGvaToGpa || !g_VidDll.VidWriteMemoryBlockPageRange || 57 | !g_VidDll.VidGetHvPartitionId) { 58 | 59 | Red(L"ERROR: Can't import any of the VID.dll functions.\n"); 60 | return FALSE; 61 | } 62 | 63 | HMODULE hNtdll = LoadLibrary(L"ntdll.dll"); 64 | if (!hNtdll) { 65 | Red(L"ERROR: Can't load NTDLL.dll.\n"); 66 | return FALSE; 67 | } 68 | 69 | (FARPROC)g_NtDll.NtAllocateVirtualMemory = GetProcAddress(hNtdll, "NtAllocateVirtualMemory"); 70 | (FARPROC)g_NtDll.NtDuplicateObject = GetProcAddress(hNtdll, "NtDuplicateObject"); 71 | (FARPROC)g_NtDll.NtOpenProcess = GetProcAddress(hNtdll, "NtOpenProcess"); 72 | (FARPROC)g_NtDll.NtQueryObject = GetProcAddress(hNtdll, "NtQueryObject"); 73 | (FARPROC)g_NtDll.NtQuerySystemInformation = GetProcAddress(hNtdll, "NtQuerySystemInformation"); 74 | 75 | if (!g_NtDll.NtAllocateVirtualMemory || !g_NtDll.NtDuplicateObject || !g_NtDll.NtOpenProcess || 76 | !g_NtDll.NtQueryObject || !g_NtDll.NtQuerySystemInformation) { 77 | Red(L"ERROR: Can't import any of the NTDLL.dll functions.\n"); 78 | return FALSE; 79 | } 80 | 81 | return TRUE; 82 | } 83 | 84 | BOOL 85 | GetMmNonPagedPoolLimit(PULONG64 MmNonPagedPoolStart, 86 | PULONG64 MmNonPagedPoolEnd) 87 | { 88 | SYSTEM_BASIC_INFORMATION SystemInfo; 89 | ULONG64 PfnAllocation; 90 | NTSTATUS NtStatus; 91 | BOOL Ret; 92 | 93 | Ret = FALSE; 94 | 95 | RtlZeroMemory(&SystemInfo, sizeof(SYSTEM_BASIC_INFORMATION)); 96 | NtStatus = g_NtDll.NtQuerySystemInformation(SystemBasicInformation, &SystemInfo, sizeof(SYSTEM_BASIC_INFORMATION), NULL); 97 | if (NtStatus != STATUS_SUCCESS) goto Exit; 98 | 99 | PfnAllocation = (SystemInfo.HighestPhysicalPageNumber + 1) * 0x30; // sizeof(MMPFN); 100 | PfnAllocation = ((PfnAllocation + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1)); 101 | 102 | *MmNonPagedPoolStart = 0xFFFFFA8000000000ULL + PfnAllocation; 103 | *MmNonPagedPoolEnd = *MmNonPagedPoolStart + ((ULONG64)8 * 1024 * 1024 * 1024); 104 | 105 | Ret = TRUE; 106 | 107 | Exit: 108 | return Ret; 109 | } 110 | 111 | USHORT 112 | GetConsoleTextAttribute(HANDLE hConsole) 113 | { 114 | CONSOLE_SCREEN_BUFFER_INFO csbi; 115 | 116 | GetConsoleScreenBufferInfo(hConsole, &csbi); 117 | return(csbi.wAttributes); 118 | } 119 | 120 | VOID 121 | White(LPCWSTR Format, ...) 122 | { 123 | HANDLE Handle; 124 | USHORT Color; 125 | va_list va; 126 | 127 | Handle = GetStdHandle(STD_OUTPUT_HANDLE); 128 | 129 | Color = GetConsoleTextAttribute(Handle); 130 | 131 | SetConsoleTextAttribute(Handle, 0xF); 132 | va_start(va, Format); 133 | vwprintf(Format, va); 134 | va_end(va); 135 | 136 | SetConsoleTextAttribute(Handle, Color); 137 | } 138 | 139 | VOID 140 | Red(LPCWSTR Format, ...) 141 | { 142 | HANDLE Handle; 143 | USHORT Color; 144 | va_list va; 145 | 146 | Handle = GetStdHandle(STD_OUTPUT_HANDLE); 147 | 148 | Color = GetConsoleTextAttribute(Handle); 149 | 150 | SetConsoleTextAttribute(Handle, FOREGROUND_RED | FOREGROUND_INTENSITY); 151 | va_start(va, Format); 152 | vwprintf(Format, va); 153 | va_end(va); 154 | 155 | SetConsoleTextAttribute(Handle, Color); 156 | } 157 | 158 | VOID 159 | Green(LPCWSTR Format, ...) 160 | { 161 | HANDLE Handle; 162 | USHORT Color; 163 | va_list va; 164 | 165 | Handle = GetStdHandle(STD_OUTPUT_HANDLE); 166 | 167 | Color = GetConsoleTextAttribute(Handle); 168 | 169 | SetConsoleTextAttribute(Handle, FOREGROUND_GREEN | FOREGROUND_INTENSITY); 170 | va_start(va, Format); 171 | vwprintf(Format, va); 172 | va_end(va); 173 | 174 | SetConsoleTextAttribute(Handle, Color); 175 | } -------------------------------------------------------------------------------- /LiveCloudKdPy/README.md: -------------------------------------------------------------------------------- 1 | This is description for Python API wrappers for hvlib.dll library 2 | Main library file is hvlib.py. Texted on Python 3.x 3 | See Example.py for detailed information - [Example.py](https://github.com/gerhart01/LiveCloudKd/blob/master/LiveCloudKdPy/Example.py) 4 | 5 | Also there is good example of Python API wrappers usage is Hyper-V memory manager plugin for [volatility plugin](https://github.com/gerhart01/Hyper-V-Tools/tree/main/Plugin_for_volatility) 6 | 7 | - [1. GetPreferredSettings](#1-getpreferredsettings) 8 | - [2. EnumPartitions](#2-enumpartitions) 9 | - [3. GetData](#3-getdata) 10 | - [4. SelectPartition](#4-selectpartition) 11 | - [5. ReadPhysicalMemoryBlock](#5-readphysicalmemoryblock) 12 | - [6. ReadVirtualMemoryBlock](#6-readvirtualmemoryblock) 13 | - [7. WritePhysicalMemoryBlock](#7-writephysicalmemoryblock) 14 | - [8. WriteVirtualMemoryBlock](#8-writevirtualmemoryblock) 15 | 16 | Library installation: 17 | 18 | Copy hvlib.py, hvlib.dll and hvmm.sys from [latest](https://github.com/gerhart01/LiveCloudKd/releases) LiveCloudKd distributive to \Lib\site-packages (f.e. C:\Python312x64\Lib\site-packages). 19 | If you use some python virtual environment plugins, you need to copy files inside it. 20 | For example to "directory_name\venv\Lib\site-packages" for virtualenv 21 | 22 | # 1. GetPreferredSettings 23 | 24 | Description: Get default plugin configuration. 25 | 26 | ```python 27 | CfgParameters GetPreferredSettings() 28 | ``` 29 | 30 | Current configuration options: 31 | 32 | **"ReadMethod"** - memory reading method for driver. Class ReadMemoryMethod 33 | **"WriteMethod"** - memory writing method for driver. Class WriteMemoryMethod 34 | **"PauseMethod"** - method of suspend VM. Class SuspendResumeMethod 35 | **"LogLevel"** - log level. Integer [0..4] 36 | **"ForceFreezeCPU"** - boolean. FreezeCPU using virtual VM registers when suspend VM 37 | **"PausePartition"** - boolean. VM was suspended when SdkSelectPartition will be executed 38 | **"ReloadDriver"** - boolean. Reload driver when starting plugin. Need in some cases when service is not deleted correctly 39 | **"SimpleMemory"** - boolean. Uses for Linux VM memory scanning. 40 | 41 | Example: 42 | 43 | ```python 44 | vm_ops = objHvlib.GetPreferredSettings() 45 | vm_ops.LogLevel = 1 46 | ``` 47 | 48 | result: CfgParameters object 49 | 50 | # 2. EnumPartitions 51 | 52 | Description: Hyper-V active partitions enumerations 53 | 54 | ```python 55 | EnumPartitions(vm_ops) 56 | ``` 57 | 58 | parameters: 59 | 60 | * **vm_ops** - CfgParameters structure, where you can modify one or more parameter 61 | 62 | Example: 63 | ```python 64 | objHvlib = hvlib("") 65 | 66 | if objHvlib == None: 67 | exit 68 | 69 | # Set logging level 70 | vm_ops = objHvlib.vm_ops 71 | vm_ops.LogLevel = 1 72 | 73 | bResult = objHvlib.EnumPartitions(vm_ops) 74 | ``` 75 | 76 | result type: boolean 77 | 78 | 79 | # 3. GetData 80 | 81 | Description: get specific data from partition 82 | 83 | ```python 84 | integer GetData(HvddInformationClass param1) 85 | ``` 86 | 87 | parameters: 88 | 89 | * **PartitionHandle** - handle of partition 90 | * **HvddInformationClass** - PartitionClass 91 | 92 | available values: 93 | 94 | ```python 95 | HvddPartitionFriendlyName = 1 96 | HvddPartitionId = 2 97 | HvddVmtypeString = 3 98 | HvddMmMaximumPhysicalPage = 6 99 | HvddKernelBase = 11 100 | HvddVmGuidString = 20 101 | ``` 102 | 103 | Example: 104 | 105 | ```python 106 | KernelBase = objHvlib.GetData(vm_handle, HvddInformationClass.HvddKernelBase) 107 | ``` 108 | 109 | result - integer 110 | 111 | # 4. SelectPartition 112 | 113 | Description: select one of partitions, which were gotten from EnumPartitions 114 | 115 | ```python 116 | SelectPartition(CurrentPartition) 117 | ``` 118 | 119 | Parameters: 120 | 121 | * **CurrentPartition** - partition handle 122 | 123 | Example: 124 | 125 | ```python 126 | vm_handle = objHvlib.SelectPartition(vm_id) 127 | ``` 128 | 129 | result - handle of virtual machine or 0 if, active virtual machines is not running on host 130 | 131 | # 5. ReadPhysicalMemoryBlock 132 | 133 | Description: Read memory block from specified physical address 134 | Parameters: 135 | * **vm_handle** - handle of virtual machine 136 | * **address** - physical memory address 137 | * **block_size** - size of memory block for reading 138 | 139 | ```python 140 | vm_handle = objHvlib.SelectPartition(vm_id) 141 | ReadPhysicalMemoryBlock(vm_handle, phys_address, buffer1) 142 | ``` 143 | 144 | Example: 145 | 146 | ```python 147 | buffer1 = objHvlib.ReadPhysicalMemoryBlock(vm_handle, phys_address, page_size) 148 | ``` 149 | 150 | result: boolean 151 | 152 | # 6. ReadVirtualMemoryBlock 153 | 154 | Description: Read memory block from specified virtual address 155 | 156 | Parameters: 157 | * **vm_handle** - handle of virtual machine 158 | * **address** - virtual memory address 159 | * **block_size** - size of memory block for reading 160 | 161 | Example: 162 | 163 | ```python 164 | KernelBase = objHvlib.GetData(vm_handle, HvddInformationClass.HvddKernelBase) 165 | objHvlib.PrintHex(KernelBase) 166 | buffer2 = objHvlib.ReadVirtualMemoryBlock(vm_handle, KernelBase, page_size) 167 | ``` 168 | 169 | result: boolean 170 | 171 | # 7. WritePhysicalMemoryBlock 172 | 173 | Description: Write data to specified physical address in virtual machine 174 | 175 | ```python 176 | WriteVirtualMemoryBlock(vm_handle, phys_address, buffer2) 177 | ``` 178 | 179 | Parameters: 180 | * **vm_handle** - handle of virtual machine 181 | * **address** - physical memory address 182 | * **block_size** - size of memory block for reading 183 | 184 | Example: 185 | 186 | ```python 187 | bResult = objHvlib.WritePhysicalMemoryBlock(vm_handle,phys_address, buffer1) 188 | ``` 189 | 190 | result: boolean 191 | 192 | # 8. WriteVirtualMemoryBlock 193 | 194 | Description: Write data to specified virtual address in virtual machine 195 | 196 | ```python 197 | WriteVirtualMemoryBlock(vm_handle, KernelBase, buffer2) 198 | ``` 199 | 200 | Parameters: 201 | * **vm_handle** - handle of virtual machine 202 | * **address** - virtual memory address 203 | * **block_size** - size of memory block for reading 204 | 205 | Example: 206 | 207 | ```python 208 | bResult = objHvlib.WriteVirtualMemoryBlock(vm_handle, KernelBase, buffer2) 209 | ``` 210 | 211 | result: boolean -------------------------------------------------------------------------------- /hvmm/hvmm/mWin.h: -------------------------------------------------------------------------------- 1 | typedef enum _SYSTEM_INFORMATION_CLASS { 2 | SystemBasicInformation, // 0 3 | SystemProcessorInformation, // 1 4 | SystemPerformanceInformation, // 2 5 | SystemTimeOfDayInformation, // 3 6 | SystemNotImplemented1, // 4 7 | SystemProcessesAndThreadsInformation, // 5 8 | SystemCallCounts, // 6 9 | SystemConfigurationInformation, // 7 10 | SystemProcessorTimes, // 8 11 | SystemGlobalFlag, // 9 12 | SystemNotImplemented2, // 10 13 | SystemModuleInformation, // 11 14 | SystemLockInformation, // 12 15 | SystemNotImplemented3, // 13 16 | SystemNotImplemented4, // 14 17 | SystemNotImplemented5, // 15 18 | SystemHandleInformation, // 16 19 | SystemObjectInformation, // 17 20 | SystemPagefileInformation, // 18 21 | SystemInstructionEmulationCounts, // 19 22 | SystemInvalidInfoClass1, // 20 23 | SystemCacheInformation, // 21 24 | SystemPoolTagInformation, // 22 25 | SystemProcessorStatistics, // 23 26 | SystemDpcInformation, // 24 27 | SystemNotImplemented6, // 25 28 | SystemLoadImage, // 26 29 | SystemUnloadImage, // 27 30 | SystemTimeAdjustment, // 28 31 | SystemNotImplemented7, // 29 32 | SystemNotImplemented8, // 30 33 | SystemNotImplemented9, // 31 34 | SystemCrashDumpInformation, // 32 35 | SystemExceptionInformation, // 33 36 | SystemCrashDumpStateInformation, // 34 37 | SystemKernelDebuggerInformation, // 35 38 | SystemContextSwitchInformation, // 36 39 | SystemRegistryQuotaInformation, // 37 40 | SystemLoadAndCallImage, // 38 41 | SystemPrioritySeparation, // 39 42 | SystemNotImplemented10, // 40 43 | SystemNotImplemented11, // 41 44 | SystemInvalidInfoClass2, // 42 45 | SystemInvalidInfoClass3, // 43 46 | SystemTimeZoneInformation, // 44 47 | SystemLookasideInformation, // 45 48 | SystemSetTimeSlipEvent, // 46 49 | SystemCreateSession, // 47 50 | SystemDeleteSession, // 48 51 | SystemInvalidInfoClass4, // 49 52 | SystemRangeStartInformation, // 50 53 | SystemVerifierInformation, // 51 54 | SystemAddVerifier, // 52 55 | SystemSessionProcessesInformation // 53 56 | } SYSTEM_INFORMATION_CLASS; 57 | 58 | #define SystemProcessAndThreadInformation 5 59 | 60 | typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY 61 | { 62 | ULONG Unknown1; 63 | ULONG Unknown2; 64 | //#ifdef _WIN64 65 | //ULONG Unknown3; 66 | //ULONG Unknown4; 67 | //#endif 68 | PVOID Base; 69 | ULONG Size; 70 | ULONG Flags; 71 | USHORT Index; 72 | USHORT NameLength; 73 | USHORT LoadCount; 74 | USHORT PathLength; 75 | CHAR ImageName[256]; 76 | } SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY; 77 | 78 | typedef struct _SYSTEM_MODULE_INFORMATION 79 | { 80 | ULONG Count; 81 | SYSTEM_MODULE_INFORMATION_ENTRY Module[1]; 82 | } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; 83 | 84 | 85 | typedef struct _HVMM_DEVICE_EXTENSION 86 | { 87 | PDEVICE_OBJECT fdo; 88 | UNICODE_STRING ustrSymLinkName; 89 | } HVMM_DEVICE_EXTENSION, *PHVMM_DEVICE_EXTENSION; 90 | 91 | typedef unsigned long DWORD; 92 | typedef unsigned short WORD; 93 | 94 | typedef struct _IMAGE_EXPORT_DIRECTORY { 95 | DWORD Characteristics; 96 | DWORD TimeDateStamp; 97 | WORD MajorVersion; 98 | WORD MinorVersion; 99 | DWORD Name; 100 | DWORD Base; 101 | DWORD NumberOfFunctions; 102 | DWORD NumberOfNames; 103 | DWORD AddressOfFunctions; // RVA from base of image 104 | DWORD AddressOfNames; // RVA from base of image 105 | DWORD AddressOfNameOrdinals; // RVA from base of image 106 | } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; 107 | 108 | 109 | typedef struct _SYSTEM_THREAD_INFORMATION 110 | { 111 | LARGE_INTEGER KernelTime; 112 | LARGE_INTEGER UserTime; 113 | LARGE_INTEGER CreateTime; 114 | ULONG WaitTime; 115 | PVOID StartAddress; 116 | CLIENT_ID ClientId; 117 | KPRIORITY Priority; 118 | LONG BasePriority; 119 | ULONG ContextSwitches; 120 | ULONG ThreadState; 121 | KWAIT_REASON WaitReason; 122 | }SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION; 123 | 124 | typedef struct _SYSTEM_PROCESS_INFORMATION 125 | { 126 | ULONG NextEntryOffset; 127 | ULONG NumberOfThreads; 128 | LARGE_INTEGER WorkingSetPrivateSize; 129 | ULONG HardFaultCount; 130 | ULONG NumberOfThreadsHighWatermark; 131 | ULONGLONG CycleTime; 132 | LARGE_INTEGER CreateTime; 133 | LARGE_INTEGER UserTime; 134 | LARGE_INTEGER KernelTime; 135 | UNICODE_STRING ImageName; 136 | KPRIORITY BasePriority; 137 | HANDLE UniqueProcessId; 138 | HANDLE InheritedFromUniqueProcessId; 139 | ULONG HandleCount; 140 | ULONG SessionId; 141 | ULONG_PTR UniqueProcessKey; 142 | SIZE_T PeakVirtualSize; 143 | SIZE_T VirtualSize; 144 | ULONG PageFaultCount; 145 | SIZE_T PeakWorkingSetSize; 146 | SIZE_T WorkingSetSize; 147 | SIZE_T QuotaPeakPagedPoolUsage; 148 | SIZE_T QuotaPagedPoolUsage; 149 | SIZE_T QuotaPeakNonPagedPoolUsage; 150 | SIZE_T QuotaNonPagedPoolUsage; 151 | SIZE_T PagefileUsage; 152 | SIZE_T PeakPagefileUsage; 153 | SIZE_T PrivatePageCount; 154 | LARGE_INTEGER ReadOperationCount; 155 | LARGE_INTEGER WriteOperationCount; 156 | LARGE_INTEGER OtherOperationCount; 157 | LARGE_INTEGER ReadTransferCount; 158 | LARGE_INTEGER WriteTransferCount; 159 | LARGE_INTEGER OtherTransferCount; 160 | SYSTEM_THREAD_INFORMATION Threads[1]; 161 | }SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION; 162 | 163 | NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation( 164 | IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 165 | IN OUT PVOID SystemInformation, 166 | IN ULONG SystemInformationLength, 167 | OUT PULONG ReturnLength OPTIONAL 168 | ); 169 | 170 | NTSYSAPI NTSTATUS NTAPI MmCopyVirtualMemory 171 | ( 172 | PEPROCESS SourceProcess, 173 | PVOID SourceAddress, 174 | PEPROCESS TargetProcess, 175 | PVOID TargetAddress, 176 | SIZE_T BufferSize, 177 | KPROCESSOR_MODE PreviousMode, 178 | PSIZE_T ReturnSize 179 | ); 180 | 181 | PVOID 182 | RtlImageDirectoryEntryToData( 183 | IN PVOID Base, 184 | IN BOOLEAN MappedAsImage, 185 | IN USHORT DirectoryEntry, 186 | OUT PULONG Size 187 | ); 188 | 189 | #define PAGE_SIZE 0x1000 190 | 191 | #define WIN101803_FRIENDLY_NAME_OFFSET 0x78 192 | #define WIN2016_FRIENDLY_NAME_OFFSET 0x70 -------------------------------------------------------------------------------- /LiveCloudKd/hooker.h: -------------------------------------------------------------------------------- 1 | typedef int (WINAPI *pMessageBox)(HWND, LPCWSTR, LPCWSTR, UINT); 2 | typedef int (WINAPI *pMessageBoxA)(HWND, LPCSTR, LPCSTR, UINT); 3 | typedef HMODULE (WINAPI *pLoadLibraryW)(LPCWSTR); 4 | typedef FARPROC (WINAPI *pGetProcAddress)(HMODULE, LPCSTR); 5 | typedef HANDLE (WINAPI *pCreateFileW)(LPCWSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE); 6 | typedef BOOL (WINAPI *pVidReadMemoryBlockPageRange)(HANDLE, PVOID, UINT64, UINT64, PVOID, UINT64); 7 | typedef BOOL (WINAPI *pVidWriteMemoryBlockPageRange)(HANDLE, PVOID, UINT64, UINT64, PVOID, UINT64); 8 | typedef DWORD (WINAPI *pSetFilePointer)(HANDLE, LONG, PLONG, DWORD); 9 | typedef LPVOID (WINAPI *pVirtualAlloc)(LPVOID, SIZE_T, DWORD, DWORD); 10 | typedef BOOL (WINAPI *pVirtualFree)(LPVOID, SIZE_T, DWORD); 11 | typedef BOOL (WINAPI *pVirtualProtect)(LPVOID, SIZE_T, DWORD, PDWORD); 12 | typedef HANDLE (WINAPI *pCreateFileMappingA)(HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCSTR); 13 | typedef HANDLE (WINAPI *pCreateFileMappingW)(HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCWSTR); 14 | typedef LPVOID (WINAPI *pMapViewOfFile)(HANDLE, DWORD, DWORD, DWORD, SIZE_T); 15 | typedef BOOL (WINAPI *pUnmapViewOfFile)(LPCVOID); 16 | typedef DWORD (WINAPI *pGetFileSize)(HANDLE, LPDWORD); 17 | typedef BOOL (WINAPI *pReadFile)(HANDLE, LPVOID, DWORD, LPDWORD, LPOVERLAPPED); 18 | typedef VOID (WINAPI *pSetLastError)(DWORD); 19 | 20 | typedef BOOLEAN(WINAPI *pSdkHvmmInternalReadMemory)(HANDLE, MB_PAGE_INDEX, UINT64, PVOID); 21 | typedef BOOLEAN (WINAPI *pSdkHvmmHvReadGPA)(ULONG64, MB_PAGE_INDEX, UINT64, PVOID); 22 | typedef BOOLEAN(WINAPI *pSdkHvmmGetMemoryBlockInfoFromGPA)(PVOID); 23 | typedef BOOLEAN(WINAPI *pSdkHvmmReadPhysicalMemory)(PVOID, MB_PAGE_INDEX, UINT64, PVOID, READ_MEMORY_METHOD); 24 | typedef BOOLEAN(WINAPI *pSdkHvmmPatchPsGetCurrentProcess)(UINT64, UINT64); 25 | typedef BOOLEAN(WINAPI *pSdkHvmmRestorePsGetCurrentProcess)(); 26 | 27 | // 28 | //Max file size of dmp file 29 | // 30 | #define MAX_HIGH_FILE_OFFSET 0xFF 31 | 32 | typedef struct _MAP_FILE { 33 | PVOID Va; 34 | PHYSICAL_ADDRESS Pa; 35 | ULONG Size; 36 | } MAP_FILE, *PMAP_FILE; 37 | 38 | typedef struct _FUNCTION_TABLE { 39 | pLoadLibraryW _LoadLibrary; 40 | pGetProcAddress _GetProcAddress; 41 | pMessageBox _MessageBoxW; 42 | pMessageBoxA _MessageBoxA; 43 | pCreateFileW _CreateFileW; 44 | pSetFilePointer _SetFilePointer; 45 | pVirtualAlloc _VirtualAlloc; 46 | pVirtualFree _VirtualFree; 47 | pVirtualProtect _VirtualProtect; 48 | pVidReadMemoryBlockPageRange _VidReadMemoryBlockPageRange; 49 | pVidWriteMemoryBlockPageRange _VidWriteMemoryBlockPageRange; 50 | pSdkHvmmInternalReadMemory _SdkHvmmInternalReadMemory; 51 | pSdkHvmmReadPhysicalMemory _SdkHvmmReadPhysicalMemory; 52 | pSdkHvmmHvReadGPA _SdkHvmmHvReadGPA; 53 | pSdkHvmmGetMemoryBlockInfoFromGPA _SdkHvmmGetMemoryBlockInfoFromGPA; 54 | pSdkHvmmPatchPsGetCurrentProcess _SdkHvmmPatchPsGetCurrentProcess; 55 | pSdkHvmmRestorePsGetCurrentProcess _SdkHvmmRestorePsGetCurrentProcess; 56 | pCreateFileMappingA _CreateFileMappingA; 57 | pCreateFileMappingW _CreateFileMappingW; 58 | pMapViewOfFile _MapViewOfFile; 59 | pUnmapViewOfFile _UnmapViewOfFile; 60 | pGetFileSize _GetFileSize; 61 | pSetLastError _SetLastError; 62 | pReadFile _ReadFile; 63 | LARGE_INTEGER FileSize; 64 | HANDLE CrashDumpHandle; 65 | PUCHAR Header; 66 | ULONG HeaderSize; 67 | ULONG64 ContextPageIndex; 68 | ULONG ContextOffsetLow; 69 | HANDLE PartitionHandle; 70 | HANDLE PartitionHandleConst; 71 | MB_HANDLE MemoryHandle; 72 | HV_PARTITION_ID PartitionId; 73 | MACHINE_TYPE MachineType; 74 | READ_MEMORY_METHOD ReadMemoryMethod; 75 | //MAP_FILE MapFile[30]; 76 | MAP_FILE MapFile[20]; 77 | ULONG MapIndex; 78 | BOOL IsDllLoad; 79 | PHYSICAL_ADDRESS KdDebuggerDataBlockPa; 80 | CHAR KdDebuggerDataBlockBlock[KD_DEBUGGER_BLOCK_PAGE_SIZE]; 81 | HVDD_PARTITION PartitionEntry; 82 | } FUNCTION_TABLE, *PFUNCTION_TABLE; 83 | 84 | //#define TABLE_OFFSET (PVOID)(NULL) 85 | #define TABLE_OFFSET (PVOID)(0xFFF000000) //random free address 86 | #define CREATEFILE_OFFSET (PVOID)((PUCHAR)TABLE_OFFSET + sizeof(FUNCTION_TABLE)) 87 | #define CREATEFILEMAPPINGA_OFFSET (PVOID)((PUCHAR)CREATEFILE_OFFSET + 0x300) 88 | #define CREATEFILEMAPPINGW_OFFSET (PVOID)((PUCHAR)CREATEFILEMAPPINGA_OFFSET + 0x100) 89 | #define MAPVIEWOFFILE_OFFSET (PVOID)((PUCHAR)CREATEFILEMAPPINGW_OFFSET + 0x100) 90 | #define UNMAPVIEWOFFILE_OFFSET (PVOID)((PUCHAR)MAPVIEWOFFILE_OFFSET + 0x1B00) 91 | #define GETFILESIZE_OFFSET (PVOID)((PUCHAR)UNMAPVIEWOFFILE_OFFSET + 0x100) 92 | #define READFILE_OFFSET (PVOID)((PUCHAR)GETFILESIZE_OFFSET + 0x100) 93 | #define VIRTUALPROTECT_OFFSET (PVOID)((PUCHAR)READFILE_OFFSET + 0x100) 94 | 95 | //#define CREATEFILE_OFFSET 0x2b0 96 | //#define CREATEFILEMAPPINGA_OFFSET CREATEFILE_OFFSET + 0x300 97 | //#define CREATEFILEMAPPINGW_OFFSET CREATEFILEMAPPINGA_OFFSET + 0x100 98 | //#define MAPVIEWOFFILE_OFFSET CREATEFILEMAPPINGW_OFFSET + 0x100 99 | //#define UNMAPVIEWOFFILE_OFFSET MAPVIEWOFFILE_OFFSET + 0x400 100 | //#define GETFILESIZE_OFFSET UNMAPVIEWOFFILE_OFFSET + 0x100 101 | //#define READFILE_OFFSET GETFILESIZE_OFFSET + 0x100 102 | //#define VIRTUALPROTECT_OFFSET READFILE_OFFSET + 0x100 103 | 104 | HANDLE WINAPI MyCreateFile( 105 | __in LPCWSTR lpFileName, 106 | __in DWORD dwDesiredAccess, 107 | __in DWORD dwShareMode, 108 | __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, 109 | __in DWORD dwCreationDisposition, 110 | __in DWORD dwFlagsAndAttributes, 111 | __in_opt HANDLE hTemplateFile 112 | ); 113 | 114 | LPVOID WINAPI MyMapViewOfFile( 115 | __in HANDLE hFileMappingObject, 116 | __in DWORD dwDesiredAccess, 117 | __in DWORD dwFileOffsetHigh, 118 | __in DWORD dwFileOffsetLow, 119 | __in SIZE_T dwNumberOfBytesToMap 120 | ); 121 | 122 | HANDLE WINAPI MyCreateFileMappingA( 123 | __in HANDLE hFile, 124 | __in_opt LPSECURITY_ATTRIBUTES lpAttributes, 125 | __in DWORD flProtect, 126 | __in DWORD dwMaximumSizeHigh, 127 | __in DWORD dwMaximumSizeLow, 128 | __in_opt LPCSTR lpName 129 | ); 130 | 131 | HANDLE WINAPI MyCreateFileMappingW( 132 | __in HANDLE hFile, 133 | __in_opt LPSECURITY_ATTRIBUTES lpAttributes, 134 | __in DWORD flProtect, 135 | __in DWORD dwMaximumSizeHigh, 136 | __in DWORD dwMaximumSizeLow, 137 | __in_opt LPCWSTR lpName 138 | ); 139 | 140 | BOOL WINAPI MyUnmapViewOfFile( 141 | __in LPCVOID lpBaseAddress 142 | ); 143 | 144 | DWORD WINAPI MyGetFileSize( 145 | __in HANDLE hFile, 146 | __out_opt LPDWORD lpFileSizeHigh 147 | ); 148 | 149 | BOOL WINAPI MyReadFile( 150 | __in HANDLE hFile, 151 | __out LPVOID lpBuffer, 152 | __in DWORD nNumberOfBytesToRead, 153 | __out_opt LPDWORD lpNumberOfBytesRead, 154 | __inout_opt LPOVERLAPPED lpOverlapped 155 | ); 156 | 157 | BOOL WINAPI MyVirtualProtect( 158 | __in LPVOID lpAddress, 159 | __in SIZE_T dwSize, 160 | __in DWORD flNewProtect, 161 | __out PDWORD lpflOldProtect 162 | ); -------------------------------------------------------------------------------- /hvmm/hvmm/lib/Win1017666/winhvr.def: -------------------------------------------------------------------------------- 1 | LIBRARY winhvr.sys 2 | EXPORTS 3 | DriverEntry = DriverEntry 4 | WinHvAcceptGpaPages = WinHvAcceptGpaPages 5 | WinHvAcquireSparseGpaPageHostAccess = WinHvAcquireSparseGpaPageHostAccess 6 | WinHvAcquireSparseSpaPageHostAccess = WinHvAcquireSparseSpaPageHostAccess 7 | WinHvAddLogicalProcessor = WinHvAddLogicalProcessor 8 | WinHvAllocateOverlayPages = WinHvAllocateOverlayPages 9 | WinHvAllocatePartitionSintIndex = WinHvAllocatePartitionSintIndex 10 | WinHvAllocatePortId = WinHvAllocatePortId 11 | WinHvAllocateSingleSintIndex = WinHvAllocateSingleSintIndex 12 | WinHvAssertDeviceInterrupt = WinHvAssertDeviceInterrupt 13 | WinHvAssertVirtualInterrupt = WinHvAssertVirtualInterrupt 14 | WinHvAttachDevice = WinHvAttachDevice 15 | WinHvCancelTimer = WinHvCancelTimer 16 | WinHvCancelVpDispatchLoop = WinHvCancelVpDispatchLoop 17 | WinHvCheckForIoIntercept = WinHvCheckForIoIntercept 18 | WinHvCheckSparseGpaPageVtlAccess = WinHvCheckSparseGpaPageVtlAccess 19 | WinHvClearVirtualInterrupt = WinHvClearVirtualInterrupt 20 | WinHvCompleteIntercept = WinHvCompleteIntercept 21 | WinHvConfigureProfiler = WinHvConfigureProfiler 22 | WinHvConfigureVirtualInterruptLine = WinHvConfigureVirtualInterruptLine 23 | WinHvConnectPort = WinHvConnectPort 24 | WinHvCreateCpuGroup = WinHvCreateCpuGroup 25 | WinHvCreateEventLogBuffer = WinHvCreateEventLogBuffer 26 | WinHvCreatePartition = WinHvCreatePartition 27 | WinHvCreatePort = WinHvCreatePort 28 | WinHvCreateTimer = WinHvCreateTimer 29 | WinHvCreateVp = WinHvCreateVp 30 | WinHvDeleteCpuGroup = WinHvDeleteCpuGroup 31 | WinHvDeleteEventLogBuffer = WinHvDeleteEventLogBuffer 32 | WinHvDeletePartition = WinHvDeletePartition 33 | WinHvDeletePort = WinHvDeletePort 34 | WinHvDeleteTimer = WinHvDeleteTimer 35 | WinHvDeleteVp = WinHvDeleteVp 36 | WinHvDepositMemory = WinHvDepositMemory 37 | WinHvDepositMemoryFromMdl = WinHvDepositMemoryFromMdl 38 | WinHvDetachDevice = WinHvDetachDevice 39 | WinHvDisablePartitionVtl = WinHvDisablePartitionVtl 40 | WinHvDisableVpVtl = WinHvDisableVpVtl 41 | WinHvDisconnectPort = WinHvDisconnectPort 42 | WinHvEnablePartitionVtl = WinHvEnablePartitionVtl 43 | WinHvEnableVpVtl = WinHvEnableVpVtl 44 | WinHvFinalizeEventLogBufferGroup = WinHvFinalizeEventLogBufferGroup 45 | WinHvFinalizePartition = WinHvFinalizePartition 46 | WinHvFlushEventLogBuffer = WinHvFlushEventLogBuffer 47 | WinHvForceSmallPages = WinHvForceSmallPages 48 | WinHvFreeOverlayPages = WinHvFreeOverlayPages 49 | WinHvFreePartitionSintIndex = WinHvFreePartitionSintIndex 50 | WinHvFreePortId = WinHvFreePortId 51 | WinHvFreeSingleSintIndex = WinHvFreeSingleSintIndex 52 | WinHvGetCpuGroupAffinity = WinHvGetCpuGroupAffinity 53 | WinHvGetCpuGroupProperty = WinHvGetCpuGroupProperty 54 | WinHvGetCurrentVpIndex = WinHvGetCurrentVpIndex 55 | WinHvGetLogicalProcessorProperty = WinHvGetLogicalProcessorProperty 56 | WinHvGetLogicalProcessorRegisters = WinHvGetLogicalProcessorRegisters 57 | WinHvGetLogicalProcessorRunTime = WinHvGetLogicalProcessorRunTime 58 | WinHvGetMemoryBalance = WinHvGetMemoryBalance 59 | WinHvGetNextChildPartition = WinHvGetNextChildPartition 60 | WinHvGetNextCpuGroup = WinHvGetNextCpuGroup 61 | WinHvGetNextCpuGroupPartition = WinHvGetNextCpuGroupPartition 62 | WinHvGetNextQueuedPort = WinHvGetNextQueuedPort 63 | WinHvGetPartitionId 64 | WinHvGetPartitionProperty = WinHvGetPartitionProperty 65 | WinHvGetPortProperty = WinHvGetPortProperty 66 | WinHvGetSintEventFlags = WinHvGetSintEventFlags 67 | WinHvGetSintMessage = WinHvGetSintMessage 68 | WinHvGetSystemInformation = WinHvGetSystemInformation 69 | WinHvGetVpRegisters = WinHvGetVpRegisters 70 | WinHvInitializeEventLogBufferGroup = WinHvInitializeEventLogBufferGroup 71 | WinHvInjectSyntheticMachineCheckEvent = WinHvInjectSyntheticMachineCheckEvent 72 | WinHvInstallIntercept = WinHvInstallIntercept 73 | WinHvLookupPortId = WinHvLookupPortId 74 | WinHvLowMemoryPolicyAutoDeposit = WinHvLowMemoryPolicyAutoDeposit 75 | WinHvLowMemoryPolicyReturnStatus = WinHvLowMemoryPolicyReturnStatus 76 | WinHvMapDeviceInterrupt = WinHvMapDeviceInterrupt 77 | WinHvMapDeviceInterruptEx = WinHvMapDeviceInterruptEx 78 | WinHvMapEventLogBuffer = WinHvMapEventLogBuffer 79 | WinHvMapGpaPages = WinHvMapGpaPages 80 | WinHvMapGpaPagesFromMbpArray = WinHvMapGpaPagesFromMbpArray 81 | WinHvMapGpaPagesFromMbpArrayScanLargePages = WinHvMapGpaPagesFromMbpArrayScanLargePages 82 | WinHvMapGpaPagesScanLargePages = WinHvMapGpaPagesScanLargePages 83 | WinHvMapGpaPagesSpecial = WinHvMapGpaPagesSpecial 84 | WinHvMapSparseGpaPages = WinHvMapSparseGpaPages 85 | WinHvMapStatsPage = WinHvMapStatsPage 86 | WinHvModifySparseGpaPages = WinHvModifySparseGpaPages 87 | WinHvModifySparseGpaPagesFromMbpArray = WinHvModifySparseGpaPagesFromMbpArray 88 | WinHvModifyVtlProtectionMask = WinHvModifyVtlProtectionMask 89 | WinHvModifyVtlProtectionMaskRange = WinHvModifyVtlProtectionMaskRange 90 | WinHvNotifyStandbyTransition = WinHvNotifyStandbyTransition 91 | WinHvNtProcessorToVpIndex = WinHvNtProcessorToVpIndex 92 | WinHvPostMessage = WinHvPostMessage 93 | WinHvPrecommitGpaPages = WinHvPrecommitGpaPages 94 | WinHvProcessorIndexToLpIndex = WinHvProcessorIndexToLpIndex 95 | WinHvProcessorNumberToVpIndex = WinHvProcessorNumberToVpIndex 96 | WinHvQueryInterceptIrql = WinHvQueryInterceptIrql 97 | WinHvQueryReferenceCounter = WinHvQueryReferenceCounter 98 | WinHvQueryVtlProtectionMaskRange = WinHvQueryVtlProtectionMaskRange 99 | WinHvReadGpa = WinHvReadGpa 100 | WinHvRegisterInterceptResult = WinHvRegisterInterceptResult 101 | WinHvReleaseEventLogBuffer = WinHvReleaseEventLogBuffer 102 | WinHvReleaseSparseGpaPageHostAccess = WinHvReleaseSparseGpaPageHostAccess 103 | WinHvReleaseSparseSpaPageHostAccess = WinHvReleaseSparseSpaPageHostAccess 104 | WinHvRemoveLogicalProcessor = WinHvRemoveLogicalProcessor 105 | WinHvReportPresentHypervisor = WinHvReportPresentHypervisor 106 | WinHvRestorePartitionState = WinHvRestorePartitionState 107 | WinHvRunVpDispatchLoop = WinHvRunVpDispatchLoop 108 | WinHvSavePartitionState = WinHvSavePartitionState 109 | WinHvScrubPartition = WinHvScrubPartition 110 | WinHvSetAbsoluteTimer = WinHvSetAbsoluteTimer 111 | WinHvSetCpuGroupProperty = WinHvSetCpuGroupProperty 112 | WinHvSetEndOfMessage = WinHvSetEndOfMessage 113 | WinHvSetEventLogCompletedNotificationRoutine = WinHvSetEventLogCompletedNotificationRoutine 114 | WinHvSetEventLogGranularSources = WinHvSetEventLogGranularSources 115 | WinHvSetEventLogGroupSources = WinHvSetEventLogGroupSources 116 | WinHvSetHvDebugProperty = WinHvSetHvDebugProperty 117 | WinHvSetInterceptRoutine = WinHvSetInterceptRoutine 118 | WinHvSetLogicalProcessorProperty = WinHvSetLogicalProcessorProperty 119 | WinHvSetLogicalProcessorRegisters = WinHvSetLogicalProcessorRegisters 120 | WinHvSetLowMemoryPolicyRoutine = WinHvSetLowMemoryPolicyRoutine 121 | WinHvSetPartitionProperty = WinHvSetPartitionProperty 122 | WinHvSetPortProperty = WinHvSetPortProperty 123 | WinHvSetSchedulerAssistData = WinHvSetSchedulerAssistData 124 | WinHvSetSchedulerNotificationRoutine = WinHvSetSchedulerNotificationRoutine 125 | WinHvSetSint = WinHvSetSint 126 | WinHvSetSintOnCurrentProcessor = WinHvSetSintOnCurrentProcessor 127 | WinHvSetVirtualInterruptLineState = WinHvConfigureVirtualInterruptLine 128 | WinHvSetVpRegisters = WinHvSetVpRegisters 129 | WinHvSignalEvent = WinHvSignalEvent 130 | WinHvTranslateVirtualAddress = WinHvTranslateVirtualAddress 131 | WinHvUncommitGpaPages = WinHvUncommitGpaPages 132 | WinHvUnmapDeviceInterrupt = WinHvUnmapDeviceInterrupt 133 | WinHvUnmapEventLogBuffer = WinHvUnmapEventLogBuffer 134 | WinHvUnmapGpaPages = WinHvUnmapGpaPages 135 | WinHvUnmapStatsPage = WinHvUnmapStatsPage 136 | WinHvUnregisterInterceptResult = WinHvUnregisterInterceptResult 137 | WinHvUpdateHvProcessorFeatures = WinHvUpdateHvProcessorFeatures 138 | WinHvWaitForInflightVpSignals = WinHvWaitForInflightVpSignals 139 | WinHvWithdrawAllMemory = WinHvWithdrawAllMemory 140 | WinHvWithdrawMemory = WinHvWithdrawMemory 141 | WinHvWriteGpa = WinHvWriteGpa 142 | 143 | 144 | 145 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/AsynchronousKdController.cpp: -------------------------------------------------------------------------------- 1 | //---------------------------------------------------------------------------- 2 | // 3 | // AsynchronousKdController.cpp 4 | // 5 | // An extension of the KDController class that allows running certain commands 6 | // (e.g. running target) asynchronously. 7 | // 8 | // Copyright (c) Microsoft. All rights reserved. 9 | // 10 | //---------------------------------------------------------------------------- 11 | 12 | #include "stdafx.h" 13 | #include "AsynchronousKDController.h" 14 | 15 | #include "KDController.h" 16 | #include "ExceptionHelpers.h" 17 | #include "HandleHelpers.h" 18 | 19 | using namespace KDControllerLib; 20 | 21 | AsynchronousKDController *AsynchronousKDController::Create(_In_ LPCTSTR pDebuggingToolsPath, 22 | _In_ LPCTSTR pConnectionArguments) 23 | { 24 | if (pDebuggingToolsPath == nullptr || pConnectionArguments == nullptr) 25 | { 26 | throw _com_error(E_POINTER); 27 | } 28 | 29 | TCHAR kdExe[MAX_PATH]; 30 | TCHAR kdCommandLine[MAX_PATH]; 31 | _sntprintf_s(kdExe, _TRUNCATE, _T("%s\\kd.exe"), pDebuggingToolsPath); 32 | _sntprintf_s(kdCommandLine, _TRUNCATE, _T("\"%s\\kd.exe\" %s"), pDebuggingToolsPath, pConnectionArguments); 33 | 34 | HandleWrapper stdInputHandle; 35 | HandleWrapper stdOutputHandle; 36 | 37 | HandleWrapper remoteStdInputHandle; 38 | HandleWrapper remoteStdOutputHandle; 39 | 40 | SECURITY_ATTRIBUTES allowHandleInheritanceAttributes = {sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE}; 41 | 42 | if (!CreatePipe(&remoteStdInputHandle, &stdInputHandle, &allowHandleInheritanceAttributes, 0)) 43 | { 44 | throw _com_error(HRESULT_FROM_WIN32(GetLastError())); 45 | } 46 | 47 | if (!CreatePipe(&stdOutputHandle, &remoteStdOutputHandle, &allowHandleInheritanceAttributes, 0)) 48 | { 49 | throw _com_error(HRESULT_FROM_WIN32(GetLastError())); 50 | } 51 | 52 | STARTUPINFO startupInformation = {sizeof(STARTUPINFO)}; 53 | startupInformation.wShowWindow = SW_MINIMIZE; 54 | startupInformation.dwFlags = STARTF_USESHOWWINDOW; 55 | PROCESS_INFORMATION processInformation; 56 | 57 | startupInformation.dwFlags |= STARTF_USESTDHANDLES; 58 | startupInformation.hStdError = INVALID_HANDLE_VALUE; 59 | 60 | startupInformation.hStdInput = remoteStdInputHandle.Get(); 61 | startupInformation.hStdOutput = remoteStdOutputHandle.Get(); 62 | 63 | //if (!CreateProcess(nullptr, kdCommandLine, nullptr, nullptr, TRUE, CREATE_SUSPENDED, 64 | // nullptr, nullptr, &startupInformation, &processInformation)) 65 | //{ 66 | // throw _com_error(HRESULT_FROM_WIN32(GetLastError())); 67 | //} 68 | 69 | HandleWrapper::CloseAndInvalidate(&processInformation.hThread); 70 | 71 | AsynchronousKDController *pResult = new AsynchronousKDController(processInformation.hProcess, stdInputHandle.Detach(), stdOutputHandle.Detach()); //return NULL pointer. We don't need additional kd.exe process 72 | //pResult->WaitForInitialPrompt(); 73 | return pResult; 74 | } 75 | 76 | AsynchronousKDController::AsynchronousKDController(_In_ HANDLE processHandle, _In_ HANDLE stdInput, _In_ HANDLE stdOutput) 77 | : KDController(processHandle, stdInput, stdOutput) 78 | , m_asynchronousCommandThread(nullptr) 79 | { 80 | } 81 | 82 | AsynchronousKDController::~AsynchronousKDController() 83 | { 84 | if (IsAsynchronousCommandInProgress()) 85 | { 86 | ShutdownKD(); 87 | WaitForSingleObject(m_asynchronousCommandThread, INFINITE); 88 | } 89 | 90 | if (m_asynchronousCommandThread != nullptr) 91 | { 92 | CloseHandle(m_asynchronousCommandThread); 93 | m_asynchronousCommandThread = nullptr; 94 | } 95 | } 96 | 97 | unsigned AsynchronousKDController::CreateCodeBreakpoint(_In_ AddressType address) 98 | { 99 | unsigned slot = static_cast(-1); 100 | for(unsigned i = 0; i < m_breakpointSlots.size(); i++) 101 | { 102 | if (!m_breakpointSlots[i]) 103 | { 104 | slot = i; 105 | break; 106 | } 107 | } 108 | 109 | if (slot == -1) 110 | { 111 | slot = static_cast(m_breakpointSlots.size()); 112 | m_breakpointSlots.push_back(false); 113 | } 114 | 115 | char command[256]; 116 | _snprintf_s(command, _TRUNCATE, "bp%d 0x%I64x ; .echo", slot, address); 117 | std::string reply = ExecuteCommand(command); 118 | 119 | //KD does not seem to report any error conditions when setting breakpoints by addresses 120 | UNREFERENCED_PARAMETER(reply); 121 | 122 | m_breakpointSlots[slot] = true; 123 | return slot; 124 | } 125 | 126 | void AsynchronousKDController::DeleteCodeBreakpoint(_In_ unsigned breakpointNumber) 127 | { 128 | if (breakpointNumber >= m_breakpointSlots.size() || !m_breakpointSlots[breakpointNumber]) 129 | { 130 | throw std::exception("Trying to delete non-existing breakpoint"); 131 | } 132 | 133 | char command[256]; 134 | _snprintf_s(command, _TRUNCATE, "bc %d ; .echo", breakpointNumber); 135 | ExecuteCommand(command); 136 | m_breakpointSlots[breakpointNumber] = false; 137 | } 138 | 139 | std::string AsynchronousKDController::ExecuteCommand(_In_ LPCSTR pCommand) 140 | { 141 | if (IsAsynchronousCommandInProgress()) 142 | { 143 | throw std::exception("Cannot execute KD command while an asynchronous command is in progress (e.g. target is running)\r\n"); 144 | } 145 | 146 | return KDController::ExecuteCommand(pCommand); 147 | } 148 | 149 | void AsynchronousKDController::StartAsynchronousCommand(_In_ LPCSTR pCommand) 150 | { 151 | assert(pCommand != nullptr); 152 | if (IsAsynchronousCommandInProgress()) 153 | { 154 | throw std::exception("Cannot execute KD command while an asynchronous command is in progress (e.g. target is running)."); 155 | } 156 | 157 | if (m_asynchronousCommandThread != nullptr) 158 | { 159 | CloseHandle(m_asynchronousCommandThread); 160 | } 161 | 162 | //At this point no other thread is using these, so no lock is needed 163 | m_currentAsynchronousCommand = pCommand; 164 | m_currentAsynchronousCommandResult.clear(); 165 | 166 | DWORD threadId = 0; 167 | m_asynchronousCommandThread = CreateThread(nullptr, 0, AsynchronousCommandThreadBody, this, 0, &threadId); 168 | if (m_asynchronousCommandThread == nullptr) 169 | { 170 | throw std::exception("Failed to start asynchronous command thread."); 171 | } 172 | } 173 | 174 | bool AsynchronousKDController::IsAsynchronousCommandInProgress() 175 | { 176 | return m_asynchronousCommandThread != nullptr && 177 | WaitForSingleObject(m_asynchronousCommandThread, 0) != WAIT_OBJECT_0; 178 | } 179 | 180 | bool AsynchronousKDController::GetAsynchronousCommandResult(_In_ DWORD timeoutInMilliseconds, _Out_opt_ std::string *pResult) 181 | { 182 | if (pResult != nullptr) 183 | { 184 | pResult->clear(); 185 | } 186 | 187 | if (m_asynchronousCommandThread == nullptr) 188 | { 189 | throw std::exception("No active asynchronous command is running"); 190 | } 191 | 192 | bool result = false; 193 | 194 | if (WaitForSingleObject(m_asynchronousCommandThread, timeoutInMilliseconds) == WAIT_OBJECT_0) 195 | { 196 | result = true; 197 | if (pResult != nullptr) 198 | { 199 | pResult->assign(m_currentAsynchronousCommandResult); 200 | } 201 | } 202 | 203 | return result; 204 | } 205 | 206 | DWORD AsynchronousKDController::AsynchronousCommandThreadBody(LPVOID p) 207 | { 208 | AsynchronousKDController *pController = reinterpret_cast(p); 209 | assert(pController != nullptr); 210 | 211 | pController->m_currentAsynchronousCommandResult = 212 | pController->KDController::ExecuteCommand(pController->m_currentAsynchronousCommand.c_str()); 213 | return 0; 214 | } 215 | 216 | void AsynchronousKDController::StartStepCommand(unsigned processorNumber) 217 | { 218 | if (processorNumber != -1) 219 | { 220 | char processorSelectionCommand[32]; 221 | _snprintf_s(processorSelectionCommand, _TRUNCATE, "~%ds ; .echo", processorNumber); 222 | ExecuteCommand(processorSelectionCommand); 223 | } 224 | StartAsynchronousCommand("t"); 225 | } 226 | 227 | void AsynchronousKDController::StartRunCommand() 228 | { 229 | StartAsynchronousCommand("g"); 230 | } 231 | 232 | -------------------------------------------------------------------------------- /ExdiKdSample/KdControllerLib/KdControllerLib.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {F864C8F4-8773-4B37-8DD9-E48514D3733B} 23 | Win32Proj 24 | KdControllerLib 25 | 26 | 27 | 28 | StaticLibrary 29 | true 30 | v142 31 | Unicode 32 | 33 | 34 | StaticLibrary 35 | true 36 | v142 37 | Unicode 38 | 39 | 40 | StaticLibrary 41 | false 42 | v142 43 | true 44 | Unicode 45 | 46 | 47 | StaticLibrary 48 | false 49 | v142 50 | true 51 | Unicode 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | D:\Projects\HyperVDebug\LiveCloudKdSdk\LiveCloudKdSdk\include\public;$(IncludePath) 71 | D:\Projects\HyperVDebug\files\;$(LibraryPath) 72 | 73 | 74 | D:\Projects\HyperVDebug\LiveCloudKdSdk\LiveCloudKdSdk\include\public;$(IncludePath) 75 | 76 | 77 | 78 | Use 79 | Level3 80 | Disabled 81 | WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) 82 | true 83 | 84 | 85 | Windows 86 | true 87 | 88 | 89 | 90 | 91 | Use 92 | Level3 93 | Disabled 94 | WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) 95 | true 96 | 97 | 98 | Windows 99 | true 100 | 101 | 102 | 103 | 104 | Level3 105 | Use 106 | MaxSpeed 107 | true 108 | true 109 | WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) 110 | true 111 | 112 | 113 | Windows 114 | true 115 | true 116 | true 117 | 118 | 119 | 120 | 121 | Level3 122 | Use 123 | MaxSpeed 124 | true 125 | true 126 | WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) 127 | true 128 | 129 | 130 | Windows 131 | true 132 | true 133 | true 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | Create 153 | Create 154 | Create 155 | Create 156 | 157 | 158 | 159 | 160 | 161 | -------------------------------------------------------------------------------- /hvmm/hvmm/hvmm.c: -------------------------------------------------------------------------------- 1 | #include "hvmm.h" 2 | 3 | extern PVOID pPsGetCurrentProcessOrig; 4 | extern PVOID pSavedPsGetCurrentProcessFunction; 5 | extern BOOLEAN bIsPsGetCurrentPsPatched; 6 | 7 | NTSTATUS DeviceControlRoutine( IN PDEVICE_OBJECT fdo, IN PIRP Irp ); 8 | VOID UnloadRoutine(IN PDRIVER_OBJECT DriverObject); 9 | NTSTATUS Create_File_IRPprocessing(IN PDEVICE_OBJECT fdo, IN PIRP Irp); 10 | NTSTATUS Close_HandleIRPprocessing(IN PDEVICE_OBJECT fdo, IN PIRP Irp); 11 | NTSTATUS ReadWrite_IRPhandler(IN PDEVICE_OBJECT fdo, IN PIRP Irp); 12 | 13 | KSPIN_LOCK MySpinLock; 14 | 15 | NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, 16 | IN PUNICODE_STRING RegistryPath ) 17 | { 18 | NTSTATUS status = STATUS_SUCCESS; 19 | PDEVICE_OBJECT fdo; 20 | UNICODE_STRING devName; 21 | PHVMM_DEVICE_EXTENSION dx; 22 | UNICODE_STRING symLinkName; 23 | UNICODE_STRING DeviceSDDLString; 24 | UNREFERENCED_PARAMETER(RegistryPath); 25 | 26 | DriverObject->DriverUnload = UnloadRoutine; 27 | DriverObject->MajorFunction[IRP_MJ_CREATE]= Create_File_IRPprocessing; 28 | DriverObject->MajorFunction[IRP_MJ_CLOSE] = Close_HandleIRPprocessing; 29 | DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]= DeviceControlRoutine; 30 | DriverObject->MajorFunction[IRP_MJ_READ] = ReadWrite_IRPhandler; 31 | DriverObject->MajorFunction[IRP_MJ_WRITE] = ReadWrite_IRPhandler; 32 | 33 | RtlInitUnicodeString( &devName, L"\\Device\\hvmm" ); 34 | RtlInitUnicodeString(&DeviceSDDLString, DEVICE_SDDL); 35 | 36 | status = IoCreateDeviceSecure(DriverObject, 37 | sizeof(HVMM_DEVICE_EXTENSION), 38 | &devName, 39 | FILE_DEVICE_UNKNOWN, 40 | FILE_DEVICE_SECURE_OPEN, 41 | FALSE, 42 | &DeviceSDDLString, 43 | NULL, 44 | &fdo); 45 | 46 | if(!NT_SUCCESS(status)) return status; 47 | 48 | dx = (PHVMM_DEVICE_EXTENSION)fdo->DeviceExtension; 49 | dx->fdo = fdo; 50 | 51 | #define SYM_LINK_NAME L"\\DosDevices\\hvmm" 52 | 53 | RtlInitUnicodeString( &symLinkName, SYM_LINK_NAME ); 54 | dx->ustrSymLinkName = symLinkName; 55 | 56 | status = IoCreateSymbolicLink( &symLinkName, &devName ); 57 | if (!NT_SUCCESS(status)) 58 | { 59 | KDbgLog("Error IoCreateSymbolicLink", status); 60 | IoDeleteDevice( fdo ); 61 | return status; 62 | } 63 | KDbgPrintString("hvmm was loaded succesfully"); 64 | return status; 65 | } 66 | 67 | NTSTATUS CompleteIrp( PIRP Irp, NTSTATUS status, ULONG info) 68 | { 69 | Irp->IoStatus.Status = status; 70 | Irp->IoStatus.Information = info; 71 | IoCompleteRequest(Irp,IO_NO_INCREMENT); 72 | return status; 73 | } 74 | 75 | NTSTATUS ReadWrite_IRPhandler( IN PDEVICE_OBJECT fdo, IN PIRP Irp ) 76 | { 77 | ULONG BytesTxd = 0; 78 | NTSTATUS status = STATUS_SUCCESS; 79 | UNREFERENCED_PARAMETER(fdo); 80 | return CompleteIrp(Irp,status,BytesTxd); 81 | } 82 | 83 | NTSTATUS Create_File_IRPprocessing(IN PDEVICE_OBJECT fdo,IN PIRP Irp) 84 | { 85 | UNREFERENCED_PARAMETER(fdo); 86 | return CompleteIrp(Irp,STATUS_SUCCESS,0); 87 | } 88 | 89 | NTSTATUS Close_HandleIRPprocessing(IN PDEVICE_OBJECT fdo,IN PIRP Irp) 90 | { 91 | UNREFERENCED_PARAMETER(fdo); 92 | return CompleteIrp(Irp,STATUS_SUCCESS,0); 93 | } 94 | 95 | NTSTATUS DeviceControlRoutine( IN PDEVICE_OBJECT fdo, IN PIRP Irp ) 96 | { 97 | NTSTATUS status = STATUS_SUCCESS; 98 | ULONG BytesTxd =0; 99 | UNREFERENCED_PARAMETER(fdo); 100 | PCHAR pInputBuffer, pOutputBuffer; 101 | PIO_STACK_LOCATION IrpStack=IoGetCurrentIrpStackLocation(Irp); 102 | ULONG uOutBufLen, uInputBufLen; 103 | ULONG ControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode; 104 | 105 | uOutBufLen = IrpStack->Parameters.DeviceIoControl.OutputBufferLength; 106 | uInputBufLen = IrpStack->Parameters.DeviceIoControl.InputBufferLength; 107 | 108 | if (!uOutBufLen || !uInputBufLen) 109 | { 110 | status = STATUS_INVALID_PARAMETER; 111 | goto End; 112 | } 113 | 114 | pInputBuffer = Irp->AssociatedIrp.SystemBuffer; 115 | pOutputBuffer = Irp->AssociatedIrp.SystemBuffer; 116 | 117 | if (!pInputBuffer) { 118 | KDbgPrintString("uOutBufLen is too big"); 119 | } 120 | 121 | if (uOutBufLen > USER_BUFFER_LIMIT) 122 | { 123 | KDbgPrintString("uOutBufLen is too big"); 124 | uOutBufLen = USER_BUFFER_LIMIT; 125 | } 126 | 127 | if (uInputBufLen > USER_BUFFER_LIMIT) 128 | { 129 | KDbgPrintString("uInputBufLen is too big"); 130 | uInputBufLen = USER_BUFFER_LIMIT; 131 | } 132 | 133 | //DbgBreakPoint(); 134 | //KDbgLog("IOCTL", ControlCode); 135 | switch(ControlCode) { 136 | case IOCTL_HV_READ_GPA: 137 | { 138 | if (VidHvReadGpa(pInputBuffer, uOutBufLen) == TRUE) { 139 | BytesTxd = uOutBufLen; 140 | } 141 | else { 142 | BytesTxd = 0; 143 | } 144 | break; 145 | } 146 | case IOCTL_VID_INTERNAL_READ_MEMORY: 147 | { 148 | if (VidInternalReadMemory(pInputBuffer, uOutBufLen) == TRUE) { 149 | BytesTxd = uOutBufLen; 150 | } 151 | else { 152 | BytesTxd = 0; 153 | } 154 | break; 155 | } 156 | case IOCTL_VID_QUERY_INFO: 157 | { 158 | if (VidQueryInformation(pInputBuffer, uOutBufLen) == TRUE) { 159 | BytesTxd = uOutBufLen; 160 | } 161 | else { 162 | BytesTxd = 0; 163 | } 164 | break; 165 | } 166 | case IOCTL_GET_MBLOCK_FROM_GPA: 167 | { 168 | if (VidGetGparBlockInfoFromGPA(pInputBuffer, uOutBufLen) == TRUE) { 169 | BytesTxd = uOutBufLen; 170 | } 171 | else { 172 | BytesTxd = 0; 173 | } 174 | break; 175 | } 176 | case IOCTL_GET_FRIENDLY_PARTIION_NAME: 177 | { 178 | if (VidGetFriendlyPartitionName(pInputBuffer, uOutBufLen) == TRUE) { 179 | BytesTxd = uOutBufLen; 180 | } 181 | else { 182 | BytesTxd = 0; 183 | } 184 | break; 185 | } 186 | case IOCTL_GET_ACTIVE_PARTITIONS: 187 | { 188 | EnumActivePartitionID(); 189 | BytesTxd = uOutBufLen; 190 | break; 191 | } 192 | case IOCTL_HV_WRITE_GPA: 193 | { 194 | if (VidHvWriteGpa(pInputBuffer, uOutBufLen) == TRUE) { 195 | BytesTxd = uOutBufLen; 196 | } 197 | else { 198 | BytesTxd = 0; 199 | } 200 | break; 201 | } 202 | case IOCTL_HV_TRANSLATE_VA: 203 | { 204 | if (VidTranslateGvatoGpa(pInputBuffer, uOutBufLen) == TRUE) { 205 | BytesTxd = uOutBufLen; 206 | } 207 | else { 208 | BytesTxd = 0; 209 | } 210 | break; 211 | } 212 | case IOCTL_HV_READ_REG: 213 | { 214 | if (VidReadVpRegisters(pInputBuffer, uOutBufLen) == TRUE) { 215 | BytesTxd = uOutBufLen; 216 | } 217 | else { 218 | BytesTxd = 0; 219 | } 220 | break; 221 | } 222 | case IOCTL_HV_WRITE_REG: 223 | { 224 | if (VidWriteVpRegisters(pInputBuffer, uOutBufLen) == TRUE) { 225 | BytesTxd = uOutBufLen; 226 | } 227 | else { 228 | BytesTxd = 0; 229 | } 230 | break; 231 | } 232 | case IOCTL_HV_PATCH_GETPROCESS: 233 | { 234 | if (VidPatchPsGetCurrentProcess(pInputBuffer, uOutBufLen) == TRUE) { 235 | BytesTxd = uOutBufLen; 236 | } 237 | else { 238 | BytesTxd = 0; 239 | } 240 | break; 241 | } 242 | case IOCTL_HV_RESTORE_GETPROCESS: 243 | { 244 | if (VidRestorePsGetCurrentProcess() == TRUE) { 245 | BytesTxd = uOutBufLen; 246 | } 247 | else { 248 | BytesTxd = 0; 249 | } 250 | break; 251 | } 252 | case IOCTL_INJECT_VIDAUX_DLL: 253 | { 254 | if (VidInjectDllToVmwp(pInputBuffer, uOutBufLen) == TRUE) { 255 | BytesTxd = uOutBufLen; 256 | } 257 | else { 258 | BytesTxd = 0; 259 | } 260 | break; 261 | } 262 | case IOCTL_DISABLE_VMWP_MITIGATIONS: 263 | { 264 | if (VidIOCTLDisableProcessProtection(pInputBuffer, uOutBufLen) == TRUE) { 265 | BytesTxd = uOutBufLen; 266 | } 267 | else { 268 | BytesTxd = 0; 269 | } 270 | break; 271 | } 272 | case IOCTL_ENABLE_VMWP_MITIGATIONS: 273 | { 274 | if (VidIOCTLEnableProcessProtection(pInputBuffer, uOutBufLen) == TRUE) { 275 | BytesTxd = uOutBufLen; 276 | } 277 | else { 278 | BytesTxd = 0; 279 | } 280 | break; 281 | } 282 | 283 | default: status = STATUS_INVALID_DEVICE_REQUEST; 284 | } 285 | End: 286 | return CompleteIrp(Irp,status,BytesTxd); 287 | } 288 | 289 | 290 | VOID UnloadRoutine(IN PDRIVER_OBJECT pDriverObject) 291 | { 292 | PDEVICE_OBJECT pNextDevObj; 293 | int i; 294 | 295 | VidRestorePsGetCurrentProcess(); 296 | 297 | pNextDevObj = pDriverObject->DeviceObject; 298 | 299 | for(i=0; pNextDevObj!=NULL; i++) 300 | { 301 | PHVMM_DEVICE_EXTENSION dx = 302 | (PHVMM_DEVICE_EXTENSION)pNextDevObj->DeviceExtension; 303 | UNICODE_STRING *pLinkName = & (dx->ustrSymLinkName); 304 | pNextDevObj = pNextDevObj->NextDevice; 305 | IoDeleteSymbolicLink(pLinkName); 306 | IoDeleteDevice(dx->fdo); 307 | } 308 | 309 | KDbgPrintString("hvmm was unloaded succesfully"); 310 | } -------------------------------------------------------------------------------- /hvmm/hvmm/hvmm.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | Debug 22 | ARM 23 | 24 | 25 | Release 26 | ARM 27 | 28 | 29 | Debug 30 | ARM64 31 | 32 | 33 | Release 34 | ARM64 35 | 36 | 37 | 38 | {B277739E-4630-4282-8229-53CDCD176655} 39 | {dd38f7fc-d7bd-488b-9242-7d8754cde80d} 40 | v4.5 41 | 12.0 42 | Debug 43 | Win32 44 | hvmm 45 | hvmm 46 | 47 | 48 | 49 | Windows10 50 | true 51 | WindowsKernelModeDriver10.0 52 | Driver 53 | WDM 54 | 55 | 56 | Windows10 57 | false 58 | WindowsKernelModeDriver10.0 59 | Driver 60 | WDM 61 | 62 | 63 | Windows10 64 | true 65 | WindowsKernelModeDriver10.0 66 | Driver 67 | WDM 68 | 69 | 70 | Windows10 71 | false 72 | WindowsKernelModeDriver10.0 73 | Driver 74 | WDM 75 | 76 | 77 | Windows10 78 | true 79 | WindowsKernelModeDriver10.0 80 | Driver 81 | WDM 82 | 83 | 84 | Windows10 85 | false 86 | WindowsKernelModeDriver10.0 87 | Driver 88 | WDM 89 | 90 | 91 | Windows10 92 | true 93 | WindowsKernelModeDriver10.0 94 | Driver 95 | WDM 96 | 97 | 98 | Windows10 99 | false 100 | WindowsKernelModeDriver10.0 101 | Driver 102 | WDM 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | DbgengKernelDebugger 114 | 115 | 116 | DbgengKernelDebugger 117 | 118 | 119 | DbgengKernelDebugger 120 | true 121 | 122 | 123 | DbgengKernelDebugger 124 | 125 | 126 | DbgengKernelDebugger 127 | 128 | 129 | DbgengKernelDebugger 130 | 131 | 132 | DbgengKernelDebugger 133 | 134 | 135 | DbgengKernelDebugger 136 | 137 | 138 | 139 | 4748;4201;4214;4152;%(DisableSpecificWarnings) 140 | false 141 | 16Bytes 142 | NotSet 143 | 144 | 145 | $(SolutionDir)hvmm\lib\Win1017666\winhvr.lib;$(DDK_LIB_PATH)\wdmsec.lib;%(AdditionalDependencies) 146 | true 147 | 148 | 149 | copy "$(OutDir)\hvmm.sys" "$(SolutionDir)files" /y 150 | 151 | 152 | 153 | 154 | copy "$(OutDir)\hvmm.sys" "$(SolutionDir)files" /y 155 | 156 | 157 | 4714;4748;4201;4214;4152;%(DisableSpecificWarnings) 158 | Full 159 | 160 | 161 | 162 | 163 | $(SolutionDir)hvmm\lib\Win1017666\winhvr.lib;$(DDK_LIB_PATH)\wdmsec.lib;%(AdditionalDependencies) 164 | Default 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | -------------------------------------------------------------------------------- /LiveCloudKd/dmp.h: -------------------------------------------------------------------------------- 1 | /*++ 2 | Copyright (C) 2010 Matthieu Suiche http://www.msuiche.net 3 | Copyright (C) 2010 MoonSols. 4 | All rights reserved. 5 | 6 | Module Name: 7 | 8 | - dmp.h 9 | 10 | Abstract: 11 | 12 | - 13 | 14 | 15 | Environment: 16 | 17 | - User mode 18 | 19 | Revision History: 20 | 21 | - Matthieu Suiche (Jan-2010) 22 | 23 | --*/ 24 | 25 | #define DUMP_SIGNATURE ('EGAP') 26 | #define DUMP_VALID_DUMP ('PMUD') 27 | #define DUMP_VALID_DUMP64 ('46UD') 28 | 29 | #define DUMP_TYPE_FULL 1 30 | //#define DUMP_TYPE_KERNEL_BITMAP 5 31 | 32 | #define X86_KPRCB_OFFSET 0x120 33 | #define X86_KPROCESSOR_STATE_OFFSET 0x01C 34 | #define X86_CONTEXT_OFFSET 0x000 35 | #define X86_KSPECIAL_REGISTERS_OFFSET 0x2CC 36 | // 37 | // If Win7 and above. 38 | // 39 | #define X86_NT61_KPROCESSOR_STATE_OFFSET 0x18 40 | 41 | #define X64_KPRCB_OFFSET 0x180 42 | //#define X64_KPROCESSOR_STATE_OFFSET 0x040 43 | #define X64_KPROCESSOR_STATE_OFFSET 0x100 //Windows 10 1803 HARDCODED 44 | #define X64_KSPECIAL_REGISTERS_OFFSET 0x000 45 | //#define X64_CONTEXT_OFFSET 0x0E0 46 | //#define X64_CONTEXT_OFFSET 0x0F0 //Windows 10 1803 HARDCODED 47 | //#define X64_CONTEXT_OFFSET 0x0A0 //Test 48 | 49 | extern FUNCTION_TABLE FunctionTable; 50 | 51 | typedef struct _PHYSICAL_MEMORY_RUN32 { 52 | ULONG BasePage; 53 | ULONG PageCount; 54 | } PHYSICAL_MEMORY_RUN32, *PPHYSICAL_MEMORY_RUN32; 55 | 56 | typedef struct _PHYSICAL_MEMORY_DESCRIPTOR32 { 57 | ULONG NumberOfRuns; 58 | ULONG NumberOfPages; 59 | PHYSICAL_MEMORY_RUN32 Run[1]; // NumberOfRuns is the total entries. 60 | } PHYSICAL_MEMORY_DESCRIPTOR32, *PPHYSICAL_MEMORY_DESCRIPTOR32; 61 | 62 | typedef struct _PHYSICAL_MEMORY_RUN64 { 63 | ULONG64 BasePage; 64 | ULONG64 PageCount; 65 | } PHYSICAL_MEMORY_RUN64, *PPHYSICAL_MEMORY_RUN64; 66 | 67 | typedef struct _PHYSICAL_MEMORY_DESCRIPTOR64 { 68 | ULONG NumberOfRuns; 69 | ULONG64 NumberOfPages; 70 | PHYSICAL_MEMORY_RUN64 Run[1]; 71 | } PHYSICAL_MEMORY_DESCRIPTOR64, *PPHYSICAL_MEMORY_DESCRIPTOR64; 72 | 73 | typedef struct _DUMP_HEADER32 { 74 | ULONG Signature; 75 | ULONG ValidDump; 76 | ULONG MajorVersion; 77 | ULONG MinorVersion; 78 | ULONG DirectoryTableBase; 79 | ULONG PfnDataBase; 80 | ULONG PsLoadedModuleList; 81 | ULONG PsActiveProcessHead; 82 | ULONG MachineImageType; 83 | ULONG NumberProcessors; 84 | ULONG BugCheckCode; 85 | ULONG BugCheckParameter1; 86 | ULONG BugCheckParameter2; 87 | ULONG BugCheckParameter3; 88 | ULONG BugCheckParameter4; 89 | CHAR VersionUser[32]; 90 | CHAR PaeEnabled; 91 | CHAR KdSecondaryVersion; 92 | CHAR spare[2]; 93 | ULONG KdDebuggerDataBlock; 94 | union { 95 | PHYSICAL_MEMORY_DESCRIPTOR32 PhysicalMemoryBlock; 96 | UCHAR PhysicalMemoryBlockBuffer[700]; 97 | }; 98 | union { 99 | // CONTEXT Context; 100 | UCHAR ContextRecord[1200]; 101 | }; 102 | EXCEPTION_RECORD32 ExceptionRecord; 103 | CHAR Comment[128]; 104 | UCHAR reserved0[1768]; 105 | ULONG DumpType; 106 | ULONG MiniDumpFields; 107 | ULONG SecondaryDataState; 108 | ULONG ProductType; 109 | ULONG SuiteMask; 110 | ULONG WriterStatus; 111 | LARGE_INTEGER RequiredDumpSpace; 112 | UCHAR reserved2[16]; 113 | FILETIME SystemUpTime; 114 | FILETIME SystemTime; 115 | UCHAR reserved3[56]; 116 | } DUMP_HEADER32, *PDUMP_HEADER32; 117 | 118 | typedef struct _DUMP_HEADER64 { 119 | ULONG Signature; 120 | ULONG ValidDump; 121 | ULONG MajorVersion; 122 | ULONG MinorVersion; 123 | ULONG64 DirectoryTableBase; 124 | ULONG64 PfnDataBase; 125 | ULONG64 PsLoadedModuleList; 126 | ULONG64 PsActiveProcessHead; 127 | ULONG MachineImageType; 128 | ULONG NumberProcessors; 129 | ULONG BugCheckCode; 130 | ULONG64 BugCheckParameter1; 131 | ULONG64 BugCheckParameter2; 132 | ULONG64 BugCheckParameter3; 133 | ULONG64 BugCheckParameter4; 134 | CHAR VersionUser[32]; 135 | //ULONG64 KdDebuggerDataBlock; 136 | PKDDEBUGGER_DATA64 KdDebuggerDataBlock; 137 | union { 138 | PHYSICAL_MEMORY_DESCRIPTOR64 PhysicalMemoryBlock; 139 | UCHAR PhysicalMemoryBlockBuffer [700]; 140 | }; 141 | UCHAR ContextRecord[3000]; 142 | EXCEPTION_RECORD64 ExceptionRecord; 143 | ULONG DumpType; 144 | LARGE_INTEGER RequiredDumpSpace; 145 | FILETIME SystemTime; 146 | CHAR Comment[0x80]; // May not be present. 147 | FILETIME SystemUpTime; 148 | ULONG MiniDumpFields; 149 | ULONG SecondaryDataState; 150 | ULONG ProductType; 151 | ULONG SuiteMask; 152 | ULONG WriterStatus; 153 | UCHAR Unused1; 154 | UCHAR KdSecondaryVersion; // Present only for W2K3 SP1 and better 155 | UCHAR Unused[2]; 156 | UCHAR _reserved0[4016]; 157 | } DUMP_HEADER64, *PDUMP_HEADER64; 158 | 159 | typedef struct _X86_CONTEXT { 160 | /*0x000*/ ULONG32 ContextFlags; 161 | /*0x004*/ ULONG32 Dr0; 162 | /*0x008*/ ULONG32 Dr1; 163 | /*0x00C*/ ULONG32 Dr2; 164 | /*0x010*/ ULONG32 Dr3; 165 | /*0x014*/ ULONG32 Dr6; 166 | /*0x018*/ ULONG32 Dr7; 167 | /*0x01C*/ UCHAR FloatSave[0x70]; 168 | /*0x08C*/ ULONG32 SegGs; 169 | /*0x090*/ ULONG32 SegFs; 170 | /*0x094*/ ULONG32 SegEs; 171 | /*0x098*/ ULONG32 SegDs; 172 | /*0x09C*/ ULONG32 Edi; 173 | /*0x0A0*/ ULONG32 Esi; 174 | /*0x0A4*/ ULONG32 Ebx; 175 | /*0x0A8*/ ULONG32 Edx; 176 | /*0x0AC*/ ULONG32 Ecx; 177 | /*0x0B0*/ ULONG32 Eax; 178 | /*0x0B4*/ ULONG32 Ebp; 179 | /*0x0B8*/ ULONG32 Eip; 180 | /*0x0BC*/ ULONG32 SegCs; 181 | /*0x0C0*/ ULONG32 EFlags; 182 | /*0x0C4*/ ULONG32 Esp; 183 | /*0x0C8*/ ULONG32 SegSs; 184 | /*0x0CC*/ UINT8 ExtendedRegisters[512]; 185 | } X86_CONTEXT, *PX86_CONTEXT; 186 | 187 | #define RPL_MASK 0x0003 188 | #define MODE_MASK 0x0001 189 | 190 | #define KGDT_NULL (0x00) 191 | #define KGDT_R0_CODE (0x8) 192 | #define KGDT_R0_DATA (0x10) 193 | #define KGDT_R3_CODE (0x18) 194 | #define KGDT_R3_DATA (0x20) 195 | #define KGDT_TSS (0x28) 196 | #define KGDT_R0_PCR (0x30) 197 | #define KGDT_R3_TEB (0x38) 198 | #define KGDT_LDT (0x48) 199 | #define KGDT_DF_TSS (0x50) 200 | #define KGDT_NMI_TSS (0x58) 201 | 202 | typedef struct _X64_CONTEXT { 203 | /*0x000*/ UINT64 P1Home; 204 | /*0x008*/ UINT64 P2Home; 205 | /*0x010*/ UINT64 P3Home; 206 | /*0x018*/ UINT64 P4Home; 207 | /*0x020*/ UINT64 P5Home; 208 | /*0x028*/ UINT64 P6Home; 209 | /*0x030*/ ULONG32 ContextFlags; 210 | /*0x034*/ ULONG32 MxCsr; 211 | /*0x038*/ UINT16 SegCs; 212 | /*0x03A*/ UINT16 SegDs; 213 | /*0x03C*/ UINT16 SegEs; 214 | /*0x03E*/ UINT16 SegFs; 215 | /*0x040*/ UINT16 SegGs; 216 | /*0x042*/ UINT16 SegSs; 217 | /*0x044*/ ULONG32 EFlags; 218 | /*0x048*/ UINT64 Dr0; 219 | /*0x050*/ UINT64 Dr1; 220 | /*0x058*/ UINT64 Dr2; 221 | /*0x060*/ UINT64 Dr3; 222 | /*0x068*/ UINT64 Dr6; 223 | /*0x070*/ UINT64 Dr7; 224 | /*0x078*/ UINT64 Rax; 225 | /*0x080*/ UINT64 Rcx; 226 | /*0x088*/ UINT64 Rdx; 227 | /*0x090*/ UINT64 Rbx; 228 | /*0x098*/ UINT64 Rsp; 229 | /*0x0A0*/ UINT64 Rbp; 230 | /*0x0A8*/ UINT64 Rsi; 231 | /*0x0B0*/ UINT64 Rdi; 232 | /*0x0B8*/ UINT64 R8; 233 | /*0x0C0*/ UINT64 R9; 234 | /*0x0C8*/ UINT64 R10; 235 | /*0x0D0*/ UINT64 R11; 236 | /*0x0D8*/ UINT64 R12; 237 | /*0x0E0*/ UINT64 R13; 238 | /*0x0E8*/ UINT64 R14; 239 | /*0x0F0*/ UINT64 R15; 240 | /*0x0F8*/ UINT64 Rip; 241 | struct 242 | { 243 | /*0x100*/ struct _M128A Header[2]; 244 | /*0x120*/ struct _M128A Legacy[8]; 245 | /*0x1A0*/ struct _M128A Xmm0; 246 | /*0x1B0*/ struct _M128A Xmm1; 247 | /*0x1C0*/ struct _M128A Xmm2; 248 | /*0x1D0*/ struct _M128A Xmm3; 249 | /*0x1E0*/ struct _M128A Xmm4; 250 | /*0x1F0*/ struct _M128A Xmm5; 251 | /*0x200*/ struct _M128A Xmm6; 252 | /*0x210*/ struct _M128A Xmm7; 253 | /*0x220*/ struct _M128A Xmm8; 254 | /*0x230*/ struct _M128A Xmm9; 255 | /*0x240*/ struct _M128A Xmm10; 256 | /*0x250*/ struct _M128A Xmm11; 257 | /*0x260*/ struct _M128A Xmm12; 258 | /*0x270*/ struct _M128A Xmm13; 259 | /*0x280*/ struct _M128A Xmm14; 260 | /*0x290*/ struct _M128A Xmm15; 261 | /*0x2A0*/ UINT8 _PADDING0_[0x60]; 262 | }; 263 | /*0x300*/ struct _M128A VectorRegister[26]; 264 | /*0x4A0*/ UINT64 VectorControl; 265 | /*0x4A8*/ UINT64 DebugControl; 266 | /*0x4B0*/ UINT64 LastBranchToRip; 267 | /*0x4B8*/ UINT64 LastBranchFromRip; 268 | /*0x4C0*/ UINT64 LastExceptionToRip; 269 | /*0x4C8*/ UINT64 LastExceptionFromRip; 270 | } X64_CONTEXT, *PX64_CONTEXT; 271 | 272 | #define KGDT64_NULL (0 * 16) 273 | #define KGDT64_R0_CODE (1 * 16) 274 | #define KGDT64_R0_DATA ((1 * 16) + 8) 275 | #define KGDT64_R3_CMCODE (2 * 16) 276 | #define KGDT64_R3_DATA ((2 * 16) + 8) 277 | #define KGDT64_R3_CODE (3 * 16) 278 | #define KGDT64_SYS_TSS (4 * 16) 279 | #define KGDT64_R3_CMTEB (5 * 16) 280 | #define KGDT64_LAST (6 * 16) --------------------------------------------------------------------------------