admin/winterknife-EVENSTAR
1
0
Fork 0
mirror of https://github.com/winterknife/EVENSTAR synced 2026-06-21 14:13:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
winterknife
2024-10-09 11:46:53 -04:00
commit 0be341ca89
15 changed files with 805 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+5
View File
@@ -0,0 +1,5 @@
.vs/
[Bb]in/
[Tt]emp/
x64/
x86/
EVENSTAR.sln
+22
View File
@@ -0,0 +1,22 @@
Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.11.35312.102
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ReadCRDbgExt", "ReadCRDbgExt\ReadCRDbgExt.vcxproj", "{78BD9103-3B0A-46DF-9261-148EA8F34DF0}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Release|x64 = Release|x64
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{78BD9103-3B0A-46DF-9261-148EA8F34DF0}.Release|x64.ActiveCfg = Release|x64
{78BD9103-3B0A-46DF-9261-148EA8F34DF0}.Release|x64.Build.0 = Release|x64
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {6D678FC6-563C-4AB4-B381-0A1C39284E52}
EndGlobalSection
EndGlobal
ReadCRDbgExt/Inc/BaseDataTypes.h
+74
View File
@@ -0,0 +1,74 @@
// ========================================================================
// File: BaseDataTypes.h
//
// Author: winterknife
//
// Description: Type definitions for common Windows base data types made
// for maintaining uniformity across all User Mode and Kernel Mode code
//
// Modifications:
// 2021-07-31 Created
// 2022-08-13 Updated
// ========================================================================
// ========================================================================
// Pragmas
// ========================================================================
#pragma once
// ========================================================================
// Type definitions
// ========================================================================
#pragma region TYPEDEFS
// 8-bit unsigned integer, range = 0 - 255, unsigned char
typedef unsigned __int8 BYTE, *PBYTE;
// 16-bit unsigned integer, range = 0 - 65535, unsigned short
typedef unsigned __int16 WORD, *PWORD;
// 32-bit unsigned integer, range = 0 - 4294967295, unsigned int or unsigned long
typedef unsigned long DWORD, *PDWORD;
// 64-bit unsigned integer, range = 0 - 18446744073709551615, unsigned long long
typedef unsigned __int64 QWORD, *PQWORD;
// Should be TRUE(1) or FALSE(0), unsigned char or bool
typedef unsigned __int8 BOOLEAN, *PBOOLEAN;
// 8-bit UTF-8/Multibyte/ANSI character, char
typedef __int8 CHAR, *PCHAR;
// 16-bit UTF-16/Wide/UNICODE character, unsigned short
typedef wchar_t WCHAR, *PWCHAR;
// Pointer to any type, size = 4 bytes or 8 bytes depending on code bitness
typedef void* PVOID;
// Pointer to a constant of any type
typedef const void* PCVOID;
// Pointer to constant null-terminated string of ANSI characters
typedef _Null_terminated_ const __int8* PCSTR;
// Pointer to constant null-terminated string of UNICODE characters
typedef _Null_terminated_ const wchar_t* PCWSTR;
// Pointer to constant null-terminated string of ANSI or UNICODE characters depending on character encoding scheme
#if defined(UNICODE)
typedef const __wchar_t* PCTSTR;
#else
typedef const __int8* PCTSTR;
#endif
// 32-bit or 64-bit unsigned integer, range = 0 - 4294967295 or 18446744073709551615 depending on compiler bitness
// Used for casting pointers
#if defined(_WIN64)
typedef unsigned __int64 DWORD_PTR, *PDWORD_PTR;
#else
typedef unsigned long DWORD_PTR, *PDWORD_PTR;
#endif
#pragma endregion
ReadCRDbgExt/Inc/Common.h
+144
View File
@@ -0,0 +1,144 @@
// ========================================================================
// File: Common.h
//
// Author: winterknife
//
// Description: Contains the common stuff for this project
//
// Modifications:
// 2021-08-21 Created
// 2024-10-08 Updated
// ========================================================================
// ========================================================================
// Pragmas
// ========================================================================
#pragma once
// Specify program entry point
#pragma comment(linker, "/ENTRY:DllInit")
// Merge sections
#if defined (_MSC_VER)
#if (_MSC_VER >= 1920)
#pragma comment(linker, "/MERGE:_RDATA=.rdata")
#endif
#endif
// Emit error message at compile time if trying to build for 32-bit x86 target
#if !defined(_WIN64)
#error x86 build target is unsupported!
#endif
// ========================================================================
// Includes
// ========================================================================
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include <intrin.h>
#include "BaseDataTypes.h"
#pragma intrinsic(__stosb)
#pragma intrinsic(__movsb)
#pragma intrinsic(strlen)
#pragma intrinsic(strcmp)
// ========================================================================
// Macros
// ========================================================================
#pragma region MACROS
// Module name
#define __MODULE__ "ReadCRDbgExt"
// Comment out for final build
//#define DEBUG_BUILD
// Stringizing operator macro
#ifndef _CRT_STRINGIZE
#define _CRT_STRINGIZE_(x) #x
#define _CRT_STRINGIZE(x) _CRT_STRINGIZE_(x)
#endif
// Get mangled name of a function
#define GET_MANGLED_FUNCTION_NAME __pragma(message(__FILE__ _CRT_STRINGIZE((__LINE__): \nfunction:\t) __FUNCSIG__ " is mangled to: " __FUNCDNAME__))
// To set alternate name of decorated x86 IAT global function pointer
#ifdef _X86_
// Uses undocumented /ALTERNATENAME linker flag
#define ALT_NAME(name, n) __pragma(comment(linker, _CRT_STRINGIZE(/ALTERNATENAME:__imp__##name##@##n####=___imp_##name)))
#else
#define ALT_NAME(name, n)
#endif
// To declare/initialize global IAT function pointers for run-time dynamic linking, use on global scope
#define IMP_FUNC(name, n) EXTERN_C_START PVOID __imp_##name = NULL; EXTERN_C_END ALT_NAME(name, n)
// To declare/initialize local function pointers for run-time dynamic linking, use on local scope
// Warning: will ignore SAL annotations
#define IMP_FUNC_PIC(name) typedef decltype(name) __type_##name; __type_##name* ##name = NULL;
// Check if a function is in a delay loaded module, use on a global scope
#define CHECK_DELAY_LOAD(f) extern "C" extern void* __imp_load_ ##f; void test_delay_load ##f(){ (__imp_load_ ##f) ? 1 : 0; }
// Macro to indicate a specific function to the linker as the first in the link order
#define CODE_BEGIN code_seg(push, ".text")
// Macro to indicate the end of the specific function to the linker
#define CODE_END code_seg(pop)
// Macro to disable all compiler optimizations for a specific function
#define OPTIMIZATION_OFF optimize("", off)
// Macro to re-enable/reset compiler optimizations for a specific function
#define OPTIMIZATION_ON optimize("", on)
// Macro to enable compiler optimizations for generating short sequences of machine code for a specific function
#if defined(_M_IX86)
#define OPTIMIZATION_SIZE optimize("gsy", on)
#else
#define OPTIMIZATION_SIZE optimize("gs", on)
#endif
// Macro to enable compiler optimizations for generating fast sequences of machine code for a specific function
#if defined(_M_IX86)
#define OPTIMIZATION_SPEED optimize("gty", on)
#else
#define OPTIMIZATION_SPEED optimize("gt", on)
#endif
// Macro to fill a block of memory with zeroes given it's address and length in bytes by generating store string instruction(rep stosb)
// Enhanced REP STOSB/MOVSB(ERMSB) are only available since Ivy Bridge Intel microarchitecture(2012/2013)
// Processors that provide support for enhanced MOVSB/STOSB operations are enumerated by the CPUID feature flag: CPUID:(EAX=7H, ECX=0H):EBX.ERMSB[bit 9] = 1
#define ZERO_MEMORY(Destination, Length) __stosb((PBYTE)Destination, 0, Length)
// Macro to copy a block of memory given it's source address, destination address and the number of bytes to copy by generating move string instruction(rep movsb)
#define COPY_MEMORY(Destination, Source, Count) __movsb((PBYTE)Destination, (const PBYTE)Source, Count)
#pragma endregion
// ========================================================================
// C inline routines
// ========================================================================
#pragma region INLINES
// Brief: To compare two blocks of memory and return the number of bytes that match
// Parameter1: pcSource1 = Pointer to the first block of memory
// Parameter2: pcSource2 = Pointer to the second block of memory
// Parameter3: dwptrLength = The number of bytes to compare
// Return: Number of bytes in the two blocks that match, if all bytes match up to the specified Length value, the Length value is returned
extern "C" __forceinline DWORD_PTR __stdcall compare_memory(_In_ const PVOID pcSource1, _In_ const PVOID pcSource2, _In_ DWORD_PTR dwptrLength) {
// Init local variables
DWORD_PTR dwptrIndex = 0;
// Start comparing the two blocks of memory
for (dwptrIndex = 0; (dwptrIndex < dwptrLength) && (((PBYTE)pcSource1)[dwptrIndex] == ((PBYTE)pcSource2)[dwptrIndex]); dwptrIndex++);
return dwptrIndex;
}
#pragma endregion
ReadCRDbgExt/Inc/DbgExt.h
+59
View File
@@ -0,0 +1,59 @@
// ========================================================================
// File: DbgExt.h
//
// Author: winterknife
//
// Description: Header file for DbgExt.cpp source file
//
// Modifications:
// 2024-10-08 Created
// 2024-10-08 Updated
// ========================================================================
// ========================================================================
// Pragmas
// ========================================================================
#pragma once
// ========================================================================
// Includes
// ========================================================================
#include "Common.h"
#define KDEXT_64BIT
#include <WDBGEXTS.H>
#include <ntverp.h>
// ========================================================================
// C routine declarations
// ========================================================================
#pragma region DECLARATIONS
/// @brief Load and initialize the extension module
/// @param pWindbgExtensionApis Pointer to WINDBG_EXTENSION_APIS64 structure
/// @param woMajorVersion Specifies the Microsoft Windows build type
/// @param woMinorVersion Specifies the Windows build number of the target system
/// @return None
extern "C" __declspec(dllexport) VOID __stdcall WinDbgExtensionDllInit(
_In_ PWINDBG_EXTENSION_APIS pWindbgExtensionApis,
_In_ WORD woMajorVersion,
_In_ WORD woMinorVersion
);
/// @brief Returns version information about the extension DLL
/// @param None
/// @return Pointer to EXT_API_VERSION structure
extern "C" __declspec(dllexport) LPEXT_API_VERSION __stdcall ExtensionApiVersion(
VOID
);
/// @brief Verifies that the extension module version matches the debugger version, and outputs a warning message if there is a mismatch
/// @param None
/// @return None
extern "C" __declspec(dllexport) VOID __stdcall CheckVersion(
VOID
);
#pragma endregion
ReadCRDbgExt/Inc/ReadControlRegisters.h
+92
View File
@@ -0,0 +1,92 @@
// ========================================================================
// File: ReadControlRegisters.h
//
// Author: winterknife
//
// Description: Header file for ReadControlRegisters.cpp source file
//
// Modifications:
// 2024-10-08 Created
// 2024-10-09 Updated
// ========================================================================
// ========================================================================
// Pragmas
// ========================================================================
#pragma once
// ========================================================================
// Includes
// ========================================================================
#include "Common.h"
// ========================================================================
// Structures/Enumerations/Unions
// ========================================================================
#pragma region STRUCTS_ENUMS_UNIONS
#pragma warning(push)
#pragma warning(disable: 4201)
typedef union _CR0_FLAGS {
struct {
QWORD PE : 1; // Protection Enable
QWORD MP : 1; // Monitor Coprocessor
QWORD EM : 1; // Emulation
QWORD TS : 1; // Task Switched
QWORD ET : 1; // Extension Type
QWORD NE : 1; // Numeric Error
QWORD Reserved1 : 10; // Reserved
QWORD WP : 1; // Write Protect
QWORD Reserved2 : 1; // Reserved
QWORD AM : 1; // Alignment Mask
QWORD Reserved3 : 10; // Reserved
QWORD NW : 1; // Not Write-through
QWORD CD : 1; // Cache Disable
QWORD PG : 1; // Paging
};
QWORD Value;
} CR0_FLAGS, *PCR0_FLAGS;
#pragma warning(pop)
#pragma endregion
// ========================================================================
// C routine declarations
// ========================================================================
#pragma region DECLARATIONS
/// @brief Built-in help command for the debugger extension DLL
/// @param hCurrentProcess Handle for the current process
/// @param hCurrentThread Handle for the current thread
/// @param qwCurrentPc Program counter
/// @param dwProcessor Current processor
/// @param strArgs Command line arguments
/// @return None
extern "C" __declspec(dllexport) VOID __stdcall help(
_In_ HANDLE hCurrentProcess,
_In_ HANDLE hCurrentThread,
_In_ QWORD qwCurrentPc,
_In_ DWORD dwProcessor,
_In_ PCSTR strArgs
);
/// @brief Built-in command to display Control Register 0 (CR0) flags
/// @param hCurrentProcess Handle for the current process
/// @param hCurrentThread Handle for the current thread
/// @param qwCurrentPc Program counter
/// @param dwProcessor Current processor
/// @param strArgs Command line arguments
/// @return None
extern "C" __declspec(dllexport) VOID __stdcall readcr0(
_In_ HANDLE hCurrentProcess,
_In_ HANDLE hCurrentThread,
_In_ QWORD qwCurrentPc,
_In_ DWORD dwProcessor,
_In_ PCSTR strArgs
);
#pragma endregion
ReadCRDbgExt/Misc/GES2007.TRoy.Slides.pdf
BIN
View File
Binary file not shown.
ReadCRDbgExt/Misc/control-registers.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 120 KiB

ReadCRDbgExt/Misc/intel-sdm-vol3-system-programming-guide.pdf
BIN
View File
Binary file not shown.
ReadCRDbgExt/ReadCRDbgExt.vcxproj
+86
View File
@@ -0,0 +1,86 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{78bd9103-3b0a-46df-9261-148ea8f34df0}</ProjectGuid>
<RootNamespace>ReadCRDbgExt</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
<OutDir>.\Bin\x64\</OutDir>
<IntDir>.\Temp\x64\</IntDir>
<GenerateManifest>false</GenerateManifest>
<RunCodeAnalysis>true</RunCodeAnalysis>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level4</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<TreatWarningAsError>true</TreatWarningAsError>
<Optimization>Disabled</Optimization>
<InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
<OmitFramePointers>false</OmitFramePointers>
<BufferSecurityCheck>false</BufferSecurityCheck>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<ExceptionHandling>false</ExceptionHandling>
<SuppressStartupBanner>false</SuppressStartupBanner>
</ClCompile>
<Link>
<SubSystem>Native</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>DebugFull</GenerateDebugInformation>
<IgnoreAllDefaultLibraries>true</IgnoreAllDefaultLibraries>
<AdditionalDependencies>
</AdditionalDependencies>
<AdditionalOptions>/EMITPOGOPHASEINFO /NOVCFEATURE /NOCOFFGRPINFO /FILEALIGN:0x200 /PDBALTPATH:$(ProjectName).pdb /Brepro /RELEASE /NOIMPLIB /NOEXP %(AdditionalOptions)</AdditionalOptions>
<ShowProgress>LinkVerbose</ShowProgress>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="Src\DllMain.cpp" />
<ClCompile Include="Src\DbgExt.cpp" />
<ClCompile Include="Src\ReadControlRegisters.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="Inc\BaseDataTypes.h" />
<ClInclude Include="Inc\Common.h" />
<ClInclude Include="Inc\DbgExt.h" />
<ClInclude Include="Inc\ReadControlRegisters.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
</ImportGroup>
</Project>
ReadCRDbgExt/ReadCRDbgExt.vcxproj.filters
+38
View File
@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="Source Files">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
<Filter Include="Header Files">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="Src\DllMain.cpp">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="Src\DbgExt.cpp">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="Src\ReadControlRegisters.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="Inc\BaseDataTypes.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="Inc\Common.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="Inc\DbgExt.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="Inc\ReadControlRegisters.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
</Project>
ReadCRDbgExt/ReadCRDbgExt.vcxproj.user
+4
View File
@@ -0,0 +1,4 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup />
</Project>
ReadCRDbgExt/Src/DbgExt.cpp
+61
View File
@@ -0,0 +1,61 @@
// ========================================================================
// File: DbgExt.cpp
//
// Author: winterknife
//
// Description: Source file that contains the basic template for a
// WdbgExts extension DLL
//
// Modifications:
// 2024-10-08 Created
// 2024-10-08 Updated
// ========================================================================
// ========================================================================
// Includes
// ========================================================================
#include "../Inc/DbgExt.h"
// ========================================================================
// Globals
// ========================================================================
#pragma region GLOBALS
EXT_API_VERSION ApiVersion = { (VER_PRODUCTVERSION_W >> 8), (VER_PRODUCTVERSION_W & 0xff), EXT_API_VERSION_NUMBER64, 0 };
WINDBG_EXTENSION_APIS ExtensionApis;
DWORD SavedMajorVersion;
DWORD SavedMinorVersion;
#pragma endregion
// ========================================================================
// Routines
// ========================================================================
#pragma region ROUTINES
VOID __stdcall WinDbgExtensionDllInit(
_In_ PWINDBG_EXTENSION_APIS pWindbgExtensionApis,
_In_ WORD woMajorVersion,
_In_ WORD woMinorVersion
) {
ExtensionApis = *pWindbgExtensionApis;
SavedMajorVersion = woMajorVersion;
SavedMinorVersion = woMinorVersion;
}
LPEXT_API_VERSION __stdcall ExtensionApiVersion(
VOID
) {
return &ApiVersion;
}
VOID __stdcall CheckVersion(
VOID
) {
return;
}
#pragma endregion
ReadCRDbgExt/Src/DllMain.cpp
+57
View File
@@ -0,0 +1,57 @@
// ========================================================================
// File: DllMain.cpp
//
// Author: winterknife
//
// Description: Source file that contains the DLL entry point
//
// Modifications:
// 2024-10-08 Created
// 2024-10-08 Updated
// ========================================================================
// ========================================================================
// Includes
// ========================================================================
#include "../Inc/Common.h"
// ========================================================================
// Routines
// ========================================================================
#pragma region ROUTINES
#pragma CODE_BEGIN
/// @brief DLL entry point
/// @param hModule A handle to the DLL module
/// @param dwReason The reason code that indicates why the DLL entry-point function is being called
/// @param dwReserved Reserved
/// @return TRUE if DLL initialization succeeds or FALSE if it fails
extern "C" __declspec(noinline) BOOLEAN __stdcall DllInit(
_In_ HMODULE hModule,
_In_ DWORD dwReason,
_In_opt_ DWORD dwReserved
) {
UNREFERENCED_PARAMETER(hModule);
UNREFERENCED_PARAMETER(dwReserved);
switch (dwReason) {
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
case DLL_PROCESS_ATTACH:
break;
}
return TRUE;
}
#pragma CODE_END
#pragma endregion
ReadCRDbgExt/Src/ReadControlRegisters.cpp
+163
View File
@@ -0,0 +1,163 @@
// ========================================================================
// File: ReadControlRegisters.cpp
//
// Author: winterknife
//
// Description: Source file that contains the necessary routines to display
// various flags of the Control Registers of the target system
//
// Modifications:
// 2024-10-08 Created
// 2024-10-09 Updated
// ========================================================================
// ========================================================================
// Includes
// ========================================================================
#include "../Inc/ReadControlRegisters.h"
#include "../Inc/DbgExt.h"
// ========================================================================
// Routines
// ========================================================================
#pragma region ROUTINES
VOID __stdcall help(
_In_ HANDLE hCurrentProcess,
_In_ HANDLE hCurrentThread,
_In_ QWORD qwCurrentPc,
_In_ DWORD dwProcessor,
_In_ PCSTR strArgs
) {
UNREFERENCED_PARAMETER(hCurrentProcess);
UNREFERENCED_PARAMETER(hCurrentThread);
UNREFERENCED_PARAMETER(qwCurrentPc);
UNREFERENCED_PARAMETER(dwProcessor);
UNREFERENCED_PARAMETER(strArgs);
dprintf(
"Help for debugger extension DLL ReadCRDbgExt.dll\n"
" help - Show help menu\n"
" readcr0 - Display CR0 flags\n"
);
}
VOID __stdcall readcr0(
_In_ HANDLE hCurrentProcess,
_In_ HANDLE hCurrentThread,
_In_ QWORD qwCurrentPc,
_In_ DWORD dwProcessor,
_In_ PCSTR strArgs
) {
UNREFERENCED_PARAMETER(hCurrentProcess);
UNREFERENCED_PARAMETER(hCurrentThread);
UNREFERENCED_PARAMETER(qwCurrentPc);
UNREFERENCED_PARAMETER(strArgs);
dprintf("[!] Current processor number = %d\n", dwProcessor);
// Init local variables
BOOLEAN bEvaluated = FALSE;
QWORD qwCR0 = 0;
CR0_FLAGS cr0Flags; ZERO_MEMORY(&cr0Flags, sizeof(CR0_FLAGS));
// Determine if the target uses 64-bit pointers
if (!IsPtr64()) {
dprintf("[-] IA-32 target is not supported by this extension!\n");
goto cleanup;
}
// Read CR0 value
bEvaluated = (BOOLEAN)GetExpressionEx("@cr0", &qwCR0, NULL);
if (!bEvaluated) {
dprintf("[-] Error evaluating MASM expression!\n");
goto cleanup;
}
dprintf("[+] CR0 = 0x%I64X\n", qwCR0);
// Display CR0 flags
dprintf(
" |-----|------|--------|\n"
" | %-3s | %-3s | %-6s |\n"
" |-----|------|--------|\n",
"Bit", "Flag", "Status"
);
cr0Flags.Value = qwCR0;
dprintf(
" | %3d | %4s | %6d |\n",
0,
"PE",
cr0Flags.PE
);
dprintf(
" | %3d | %4s | %6d |\n",
1,
"MP",
cr0Flags.MP
);
dprintf(
" | %3d | %4s | %6d |\n",
2,
"EM",
cr0Flags.EM
);
dprintf(
" | %3d | %4s | %6d |\n",
3,
"TS",
cr0Flags.TS
);
dprintf(
" | %3d | %4s | %6d |\n",
4,
"ET",
cr0Flags.ET
);
dprintf(
" | %3d | %4s | %6d |\n",
5,
"NE",
cr0Flags.NE
);
dprintf(
" | %3d | %4s | %6d |\n",
16,
"WP",
cr0Flags.WP
);
dprintf(
" | %3d | %4s | %6d |\n",
18,
"AM",
cr0Flags.AM
);
dprintf(
" | %3d | %4s | %6d |\n",
29,
"NW",
cr0Flags.NW
);
dprintf(
" | %3d | %4s | %6d |\n",
30,
"CD",
cr0Flags.CD
);
dprintf(
" | %3d | %4s | %6d |\n",
31,
"PG",
cr0Flags.PG
);
dprintf(" |-----|------|--------|\n");
cleanup:
return;
}
#pragma endregion