diff --git a/.gitmodules b/.gitmodules index d1adcb1..a9ebb1c 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,3 @@ -[submodule "capstone_wrapper"] - path = capstone_wrapper - url = https://github.com/x64dbg/capstone_wrapper.git +[submodule "GleeBug/zyan-disassembler-engine"] + path = GleeBug/zyan-disassembler-engine + url = https://github.com/zyantific/zyan-disassembler-engine diff --git a/GleeBug/Debugger.Process.cpp b/GleeBug/Debugger.Process.cpp index 0899c22..d263dbd 100644 --- a/GleeBug/Debugger.Process.cpp +++ b/GleeBug/Debugger.Process.cpp @@ -1,5 +1,10 @@ #include "Debugger.Process.h" +#define ZYDIS_EXPORTS +#define ZYDIS_ENABLE_FEATURE_IMPLICITLY_USED_REGISTERS +#define ZYDIS_ENABLE_FEATURE_AFFECTED_FLAGS +#include + namespace GleeBug { Process::Process(HANDLE hProcess, uint32 dwProcessId, uint32 dwMainThreadId, const CREATE_PROCESS_DEBUG_INFO & createProcessInfo) : @@ -21,10 +26,29 @@ namespace GleeBug unsigned char data[16]; if (MemReadSafe(gip, data, sizeof(data))) { - mCapstone.Disassemble(gip, data); - if(mCapstone.GetId() == X86_INS_CALL) + ZydisInstructionInfo info; + memset(&info, 0, sizeof(info)); + auto mode = GleeArchValue(ZYDIS_OPERATING_MODE_32BIT, ZYDIS_OPERATING_MODE_64BIT); + auto status = ZydisDecode(mode, data, sizeof(data), gip, &info); + auto stepOver = false; + if(ZYDIS_SUCCESS(status)) { - SetBreakpoint(gip + mCapstone.Size(), [cbStep](const BreakpointInfo & info) + switch(info.mnemonic) + { + case ZYDIS_MNEMONIC_CALL: + case ZYDIS_MNEMONIC_PUSHF: + case ZYDIS_MNEMONIC_PUSHFD: + case ZYDIS_MNEMONIC_PUSHFQ: + stepOver = true; + break; + default: + auto repAttributes = ZYDIS_ATTRIB_HAS_REP | ZYDIS_ATTRIB_HAS_REPE | ZYDIS_ATTRIB_HAS_REPZ | ZYDIS_ATTRIB_HAS_REPNE | ZYDIS_ATTRIB_HAS_REPNZ; + stepOver = (info.attributes & repAttributes) != 0; + } + } + if (stepOver) + { + SetBreakpoint(gip + info.length, [cbStep](const BreakpointInfo & info) { cbStep(); }, true, SoftwareType::ShortInt3); diff --git a/GleeBug/Debugger.Process.h b/GleeBug/Debugger.Process.h index 831fc4f..0ff8d7a 100644 --- a/GleeBug/Debugger.Process.h +++ b/GleeBug/Debugger.Process.h @@ -6,7 +6,6 @@ #include "Debugger.Dll.h" #include "Debugger.Breakpoint.h" #include "Static.Pattern.h" -#include namespace GleeBug { @@ -411,9 +410,6 @@ namespace GleeBug result = false; return result; } - - private: - Capstone mCapstone; }; }; diff --git a/GleeBug/Debugger.Thread.Registers.cpp b/GleeBug/Debugger.Thread.Registers.cpp index 050f4dc..5237759 100644 --- a/GleeBug/Debugger.Thread.Registers.cpp +++ b/GleeBug/Debugger.Thread.Registers.cpp @@ -130,17 +130,21 @@ namespace GleeBug if(!this->mLazyOldContext || !this->mLazyThread) //assert __debugbreak(); + auto oldContext = this->mLazyOldContext; + auto lazyThread = this->mLazyThread; + + this->mLazyOldContext = nullptr; + this->mLazyThread = nullptr; + this->mLazySet = false; + //TODO: handle failure of GetThreadContext auto result = false; - if(GetThreadContext(this->mLazyThread, this->mLazyOldContext)) + if(GetThreadContext(lazyThread, oldContext)) { - this->mContext = *this->mLazyOldContext; + this->mContext = *oldContext; result = true; } - this->mLazyOldContext = nullptr; - this->mLazyThread = nullptr; - this->mLazySet = false; return result; } }; \ No newline at end of file diff --git a/GleeBug/Debugger.Thread.Registers.h b/GleeBug/Debugger.Thread.Registers.h index 7a0f842..547faa8 100644 --- a/GleeBug/Debugger.Thread.Registers.h +++ b/GleeBug/Debugger.Thread.Registers.h @@ -161,7 +161,7 @@ namespace GleeBug private: CONTEXT mContext; - CONTEXT* mLazyOldContext = nullptr; + LPCONTEXT mLazyOldContext = nullptr; HANDLE mLazyThread = nullptr; bool mLazySet = false; diff --git a/GleeBug/Debugger.h b/GleeBug/Debugger.h index 5a205f6..2b9b30d 100644 --- a/GleeBug/Debugger.h +++ b/GleeBug/Debugger.h @@ -4,7 +4,6 @@ #include "Debugger.Global.h" #include "Debugger.Process.h" #include "Debugger.Breakpoint.h" -#include namespace GleeBug { @@ -287,7 +286,6 @@ namespace GleeBug bool mDetach = false; bool mDetachAndBreak = false; bool mAttachedToProcess = false; - Capstone mCapstone; /** \brief The current process (can be null in some cases). diff --git a/GleeBug/GleeBug.h b/GleeBug/GleeBug.h index 9c58ab4..253af83 100644 --- a/GleeBug/GleeBug.h +++ b/GleeBug/GleeBug.h @@ -19,6 +19,23 @@ #define BIND(thisPtr, funcPtr) std::bind(&funcPtr, thisPtr) #define BIND1(thisPtr, funcPtr) std::bind(&funcPtr, thisPtr, std::placeholders::_1) +#ifdef _WIN64 +#define X64DBG_MOD L"x64dbg.dll" +#else +#define X64DBG_MOD L"x32dbg.dll" +#endif //_WIN64 + +#define DPRINTF() \ + static auto dprintf = (int(*)(const char* format, ...))GetProcAddress(GetModuleHandleW(X64DBG_MOD), "_plugin_logprintf"); \ + if(!dprintf) \ + dprintf = printf + +#ifdef _WIN64 +#define GleeArchValue(x32value, x64value) x64value +#else +#define GleeArchValue(x32value, x64value) x32value +#endif //_WIN64 + namespace GleeBug { typedef int8_t int8; diff --git a/GleeBug/GleeBug.vcxproj b/GleeBug/GleeBug.vcxproj index b1ecb74..1c2cd55 100644 --- a/GleeBug/GleeBug.vcxproj +++ b/GleeBug/GleeBug.vcxproj @@ -68,22 +68,22 @@ $(ProjectDir)..\bin\$(Configuration)\x32\ .lib - $(ProjectDir)..;$(IncludePath) + $(ProjectDir)..;$(ProjectDir)zyan-disassembler-engine\include;$(IncludePath) $(ProjectDir)..\bin\$(Configuration)\x64\ .lib - $(ProjectDir)..;$(IncludePath) + $(ProjectDir)..;$(ProjectDir)zyan-disassembler-engine\include;$(IncludePath) $(ProjectDir)..\bin\$(Configuration)\x32\ .lib - $(ProjectDir)..;$(IncludePath) + $(ProjectDir)..;$(ProjectDir)zyan-disassembler-engine\include;$(IncludePath) $(ProjectDir)..\bin\$(Configuration)\x64\ .lib - $(ProjectDir)..;$(IncludePath) + $(ProjectDir)..;$(ProjectDir)zyan-disassembler-engine\include;$(IncludePath) @@ -150,7 +150,6 @@ - @@ -173,9 +172,20 @@ + + + _CRT_SECURE_NO_WARNINGS;_USING_V110_SDK71_;%(PreprocessorDefinitions) + _CRT_SECURE_NO_WARNINGS;_USING_V110_SDK71_;%(PreprocessorDefinitions) + _CRT_SECURE_NO_WARNINGS;_USING_V110_SDK71_;%(PreprocessorDefinitions) + _CRT_SECURE_NO_WARNINGS;_USING_V110_SDK71_;%(PreprocessorDefinitions) + + + + + + - @@ -193,6 +203,25 @@ + + + + + + + + + + + + + + + + + + + diff --git a/GleeBug/GleeBug.vcxproj.filters b/GleeBug/GleeBug.vcxproj.filters index 41f6f89..d4c8fd8 100644 --- a/GleeBug/GleeBug.vcxproj.filters +++ b/GleeBug/GleeBug.vcxproj.filters @@ -9,11 +9,14 @@ {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hh;hpp;hxx;hm;inl;inc;xsd - - {4215a98e-b5ea-4d74-b38a-b4adaec85570} + + {087a6721-6324-4dd6-94f3-8cf8ec131db6} - - {0f772f56-25cc-40aa-85b4-be2140c10d27} + + {a3b02551-ba19-40b2-a117-90b9f44d3dcd} + + + {2bc2d721-bce0-440e-947e-e74497e76fa6} @@ -80,12 +83,30 @@ Source Files - - Source Files\capstone_wrapper - Source Files + + Source Files\Zydis + + + Source Files\Zydis + + + Source Files\Zydis + + + Source Files\Zydis + + + Source Files\Zydis + + + Source Files\Zydis + + + Source Files\Zydis + @@ -139,8 +160,58 @@ Header Files - - Header Files\capstone_wrapper + + Header Files\Zydis\Internal + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis + + + Header Files\Zydis\Internal + + + Header Files\Zydis\Internal + + + Header Files\Zydis\Internal + + + Header Files\Zydis\Internal + + + Header Files\Zydis\Internal + + + Header Files\Zydis\Internal + + \ No newline at end of file diff --git a/GleeBug/zyan-disassembler-engine b/GleeBug/zyan-disassembler-engine new file mode 160000 index 0000000..baa1bc2 --- /dev/null +++ b/GleeBug/zyan-disassembler-engine @@ -0,0 +1 @@ +Subproject commit baa1bc243ac9e2b8c0930d6e7bed7065d0e2e5e0 diff --git a/MyDebugger/MyDebugger.vcxproj b/MyDebugger/MyDebugger.vcxproj index 61dccf3..9c62fe5 100644 --- a/MyDebugger/MyDebugger.vcxproj +++ b/MyDebugger/MyDebugger.vcxproj @@ -90,7 +90,7 @@ true - $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x86.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;%(AdditionalDependencies) Console @@ -103,7 +103,7 @@ true - $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x64.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;%(AdditionalDependencies) Console @@ -120,7 +120,7 @@ true true true - $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x86.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;%(AdditionalDependencies) Console @@ -137,7 +137,7 @@ true true true - $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x64.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;%(AdditionalDependencies) Console diff --git a/TitanEngineEmulator/TitanEngineEmulator.vcxproj b/TitanEngineEmulator/TitanEngineEmulator.vcxproj index e81c88e..10fd16b 100644 --- a/TitanEngineEmulator/TitanEngineEmulator.vcxproj +++ b/TitanEngineEmulator/TitanEngineEmulator.vcxproj @@ -98,7 +98,7 @@ true - $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x86.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) Windows @@ -111,7 +111,7 @@ true - $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x64.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) Windows @@ -128,7 +128,7 @@ true true true - $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x86.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x32\GleeBug.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) Windows @@ -145,7 +145,7 @@ true true true - $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;$(SolutionDir)capstone_wrapper\capstone\capstone_x64.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) + $(SolutionDir)bin\$(Configuration)\x64\GleeBug.lib;kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies) Windows diff --git a/ZydisExportConfig.h b/ZydisExportConfig.h new file mode 100644 index 0000000..2043fba --- /dev/null +++ b/ZydisExportConfig.h @@ -0,0 +1,41 @@ +#ifndef ZYDIS_EXPORT_H +#define ZYDIS_EXPORT_H + +#ifdef ZYDIS_STATIC_DEFINE +# define ZYDIS_EXPORT +# define ZYDIS_NO_EXPORT +#else +# ifndef ZYDIS_EXPORT +# ifdef Zydis_EXPORTS + /* We are building this library */ +# define ZYDIS_EXPORT +# else + /* We are using this library */ +# define ZYDIS_EXPORT +# endif +# endif + +# ifndef ZYDIS_NO_EXPORT +# define ZYDIS_NO_EXPORT +# endif +#endif + +#ifndef ZYDIS_DEPRECATED +# define ZYDIS_DEPRECATED __declspec(deprecated) +#endif + +#ifndef ZYDIS_DEPRECATED_EXPORT +# define ZYDIS_DEPRECATED_EXPORT ZYDIS_EXPORT ZYDIS_DEPRECATED +#endif + +#ifndef ZYDIS_DEPRECATED_NO_EXPORT +# define ZYDIS_DEPRECATED_NO_EXPORT ZYDIS_NO_EXPORT ZYDIS_DEPRECATED +#endif + +#if 0 /* DEFINE_NO_DEPRECATED */ +# ifndef ZYDIS_NO_DEPRECATED +# define ZYDIS_NO_DEPRECATED +# endif +#endif + +#endif diff --git a/capstone_wrapper b/capstone_wrapper deleted file mode 160000 index 2034d2a..0000000 --- a/capstone_wrapper +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 2034d2a0151866ae56fa51171788217d59c47a7b