x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 2 Activity

Merged in Dreg_fr33project/x64_dbg (pull request #23) 

set and get command line stuff + fix JIT stuff + GuiUpdateMemoryView stuff + Assemble at improved + Pull fixed v1
This commit is contained in:
mrexodia 2014-09-11 21:21:51 +02:00
parent 20d8903b22 ff8dbcbf34
commit d9834584eb
31 changed files with 721 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
help/alloc.htm
View File

@ -20,6 +20,7 @@ VirtualAllocEx). The memory is allocated
with PAGE_EXECUTE_READWRITE protection.</P>
<P><U>arguments</U><BR>[arg1]: Size of the memory to
allocate. When not specified, a default size of 0x1000 is used.</P>
<P>[arg2]&nbsp;(optional): if&nbsp;exist an&nbsp;arg2 (with any value)&nbsp;the memory map&nbsp;GUI is not updated explicity from this&nbsp;command.&nbsp;</P>
<P><U>result</U><BR>This command sets $result to the allocated memory address. It also sets the $lastalloc
variable to the allocated memory address when VirtualAllocEx
succeeded.</P></body>

3
help/free.htm
View File

@ -20,6 +20,9 @@ html,body {
<P>
<U>arguments</U><BR> [arg1]: Address of the memory to free. When not
specified, the value at $lastalloc is used.</P>
<P>
[arg2]&nbsp;(optional): if&nbsp;exist an&nbsp;arg2 (with any value)&nbsp;the memory
map&nbsp;GUI is not updated explicity from this&nbsp;command.&nbsp;</P>
<P>
<U>
result

22
help/getcommandline_getcmdline.htm Normal file
View File

@ -0,0 +1,22 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>getcommandline/getcmdline</title>
<meta name="GENERATOR" content="WinCHM">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style>
html,body {
/* Default Font */
font-family: Courier New;
font-size: 11pt;
}
</style>
</head>
<body>
<P><STRONG>getcommandline[,getcmdline]<BR></STRONG>It&nbsp;gets the actual command line.</P>
<P class=rvps3><SPAN class=rvts11><U>No arguments </U></SPAN></P>
<P class=rvps3><SPAN class=rvts11><U>result <BR></U></SPAN><SPAN class=rvts9>This command does not set any result variables.</SPAN></P>
<P>&nbsp;</P></body>
</html>

33
help/setcommandline_setcmdline.htm Normal file
View File

@ -0,0 +1,33 @@
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>setcommandline/setcmdline</title>
<meta name="GENERATOR" content="WinCHM">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style>
html,body {
/* Default Font */
font-family: Courier New;
font-size: 11pt;
}
</style>
</head>
<body>
<P><STRONG>setcommandline[,setcmdline]<BR></STRONG>It changes the command line data. </P>
<P class=rvps3>
<SPAN class=rvts11>
<U>
arguments
</U>&nbsp;
<BR>
</SPAN>
<SPAN class=rvts9 >
[arg1]:&nbsp;New command
line.&nbsp;</SPAN></P>
<P class=rvps3><SPAN class=rvts11><U>result <BR></U></SPAN><SPAN class=rvts9>This command does not set any result
variables.</SPAN></P></body>
</html>

5
help/setpagerights_setrightspage.htm
View File

@ -25,6 +25,11 @@ not the top address of a page). </SPAN></P>
"ExecuteRead", "ExecuteReadWrite", "ExecuteWriteCopy", "NoAccess", "ReadOnly", "ReadWrite", "WriteCopy". You can add a G at first
for add PAGE GUARD. example: "GReadOnly". Read
the MSDN for more info.</SPAN></P>
<P class=rvps3><SPAN class=rvts9>
arg3&nbsp;(optional): if&nbsp;exist
an&nbsp;arg3 (with any value)&nbsp;the memory map&nbsp;GUI is
not updated explicity from this&nbsp;command.&nbsp;</SPAN></P>
<P class=rvps3><SPAN class=rvts9></SPAN><SPAN class=rvts11><U>result <BR></U></SPAN><SPAN class=rvts9>This command does not set any result
variables.</SPAN></P></body>
</html>

BIN
help/x64_dbg.wcp
View File

Binary file not shown.

5
x64_dbg_bridge/bridgemain.cpp
View File

@ -883,6 +883,11 @@ BRIDGE_IMPEXP void GuiUpdateDumpView()
_gui_sendmessage(GUI_UPDATE_DUMP_VIEW, 0, 0);
}
BRIDGE_IMPEXP void GuiUpdateMemoryView()
{
_gui_sendmessage(GUI_UPDATE_MEMORY_VIEW, 0, 0);
}
BRIDGE_IMPEXP void GuiUpdateThreadView()
{
_gui_sendmessage(GUI_UPDATE_THREAD_VIEW, 0, 0);

11
x64_dbg_bridge/bridgemain.h
View File

@ -634,7 +634,9 @@ typedef enum
GUI_REPAINT_TABLE_VIEW, // param1=unused, param2=unused
GUI_UPDATE_PATCHES, // param1=unused, param2=unused
GUI_UPDATE_CALLSTACK, // param1=unused, param2=unused
GUI_SYMBOL_REFRESH_CURRENT // param1=unused, param2=unused
GUI_SYMBOL_REFRESH_CURRENT, // param1=unused, param2=unused
GUI_UPDATE_MEMORY_VIEW // param1=unused, param2=unused
} GUIMSG;
//GUI structures
@ -690,6 +692,7 @@ BRIDGE_IMPEXP void GuiReferenceSetSearchStartCol(int col);
BRIDGE_IMPEXP void GuiStackDumpAt(duint addr, duint csp);
BRIDGE_IMPEXP void GuiUpdateDumpView();
BRIDGE_IMPEXP void GuiUpdateThreadView();
BRIDGE_IMPEXP void GuiUpdateMemoryView();
BRIDGE_IMPEXP void GuiAddRecentFile(const char* file);
BRIDGE_IMPEXP void GuiSetLastException(unsigned int exception);
BRIDGE_IMPEXP bool GuiGetDisassembly(duint addr, char* text);
@ -708,6 +711,12 @@ BRIDGE_IMPEXP void GuiUpdateSideBar();
BRIDGE_IMPEXP void GuiRepaintTableView();
BRIDGE_IMPEXP void GuiUpdatePatches();
BRIDGE_IMPEXP void GuiUpdateCallStack();
BRIDGE_IMPEXP void GuiUpdateMemoryView();
//other MISC defines
#define RIGHTS_STRING (sizeof("ERWCG") + 1)
#define PAGE_SIZE 0x1000
#ifdef __cplusplus
}

14
x64_dbg_dbg/_dbgfunctions.cpp
View File

@ -112,6 +112,16 @@ static bool _getjitauto(bool* jit_auto)
return dbggetjitauto(jit_auto, notfound, NULL, NULL);
}
static bool _getcmdline(char** cmd_line)
{
return dbggetcmdline(cmd_line, NULL);
}
static bool _setcmdline(char* cmd_line)
{
return dbgsetcmdline(cmd_line, NULL);
}
static bool _isprocesselevated(void)
{
return IsProcessElevated();
@ -129,7 +139,7 @@ static bool _pagerightstostring(DWORD protect, char* rights)
static bool _setpagerights(uint* addr, char* rights)
{
return dbgsetpagerights(addr, rights);
return dbgsetpagerights(addr, rights, false);
}
static bool _getjit(char* jit, bool jit64)
@ -204,4 +214,6 @@ void dbgfunctionsinit()
_dbgfunctions.SetPageRights = _setpagerights;
_dbgfunctions.PageRightsToString = _pagerightstostring;
_dbgfunctions.IsProcessElevated = _isprocesselevated;
_dbgfunctions.GetCmdline = _getcmdline;
_dbgfunctions.SetCmdline = _setcmdline;
}

4
x64_dbg_dbg/_dbgfunctions.h
View File

@ -61,6 +61,8 @@ typedef bool (*GETPAGERIGHTS)(duint*, char*);
typedef bool (*SETPAGERIGHTS)(duint*, char*);
typedef bool (*PAGERIGHTSTOSTRING)(DWORD, char*);
typedef bool (*ISPROCESSELEVATED)(void);
typedef bool (*GETCMDLINE)(char**);
typedef bool (*SETCMDLINE)(char*);
typedef struct DBGFUNCTIONS_
{
@ -92,6 +94,8 @@ typedef struct DBGFUNCTIONS_
SETPAGERIGHTS SetPageRights;
PAGERIGHTSTOSTRING PageRightsToString;
ISPROCESSELEVATED IsProcessElevated;
GETCMDLINE GetCmdline;
SETCMDLINE SetCmdline;
} DBGFUNCTIONS;
#ifdef BUILD_DBG

1
x64_dbg_dbg/_global.h
View File

@ -99,6 +99,7 @@ enum arch
x64
};
//superglobal variables
extern HINSTANCE hInst;
extern char dbbasepath[deflen];

252
x64_dbg_dbg/debugger.cpp
View File

@ -1523,11 +1523,10 @@ bool _readwritejitkey(char* jit_key_value, DWORD* jit_key_vale_size, char* key,
{
if(arch_in != x64 && arch_in != x32)
{
#ifdef _WIN32
* arch_out = x32;
#endif
#ifdef _WIN64
* arch_out = x64;
#else
* arch_out = x32;
#endif
}
else
@ -1546,7 +1545,7 @@ bool _readwritejitkey(char* jit_key_value, DWORD* jit_key_vale_size, char* key,
}
#endif
#ifdef _WIN32
#ifndef _WIN64
key_flags |= KEY_WOW64_64KEY;
#endif
}
@ -1564,22 +1563,23 @@ bool _readwritejitkey(char* jit_key_value, DWORD* jit_key_vale_size, char* key,
return false;
lRv = RegSetValueExA(hKey, key, 0, REG_SZ, (BYTE*) jit_key_value, (DWORD)(* jit_key_vale_size) + 1);
RegCloseKey(hKey);
}
else
{
lRv = RegOpenKeyEx(HKEY_LOCAL_MACHINE, JIT_REG_KEY, 0, key_flags, &hKey);
if(lRv != ERROR_SUCCESS)
return false;
lRv = RegQueryValueExA(hKey, key, 0, NULL, (LPBYTE)jit_key_value, jit_key_vale_size);
if(lRv != ERROR_SUCCESS)
{
if(error != NULL)
* error = ERROR_RW_FILE_NOT_FOUND;
return false;
}
lRv = RegQueryValueExA(hKey, key, 0, NULL, (LPBYTE)jit_key_value, jit_key_vale_size);
}
RegCloseKey(hKey);
if(lRv != ERROR_SUCCESS)
return false;
@ -1671,7 +1671,7 @@ bool dbgpagerightsfromstring(DWORD* protect, char* rights_string)
return true;
}
bool dbgsetpagerights(uint* addr, char* rights_string)
bool dbgsetpagerights(uint* addr, char* rights_string, bool update_memmap)
{
DWORD protect;
DWORD old_protect;
@ -1684,6 +1684,12 @@ bool dbgsetpagerights(uint* addr, char* rights_string)
if(VirtualProtectEx(fdProcessInfo->hProcess, (void*)*addr, PAGE_SIZE, protect, & old_protect) == 0)
return false;
if(update_memmap)
{
memupdatemap(fdProcessInfo->hProcess);
GuiUpdateMemoryView();
}
return true;
}
@ -1827,5 +1833,231 @@ bool dbglistprocesses(std::vector<PROCESSENTRY32>* list)
list->push_back(pe32);
}
while(Process32Next(hProcessSnap, &pe32));
return true;
}
bool _getcommandlineaddr(uint* addr, cmdline_error_t* cmd_line_error)
{
SIZE_T size;
uint pprocess_parameters;
cmd_line_error->addr = (uint) GetPEBLocation(fdProcessInfo->hProcess);
if(cmd_line_error->addr == 0)
{
cmd_line_error->type = CMDL_ERR_GET_PEB;
return false;
}
//cast-trick to calculate the address of the remote peb field ProcessParameters
cmd_line_error->addr = (uint) & (((PPEB) cmd_line_error->addr)->ProcessParameters);
if(!memread(fdProcessInfo->hProcess, (const void*) cmd_line_error->addr, & pprocess_parameters, sizeof(pprocess_parameters), & size))
{
cmd_line_error->type = CMDL_ERR_READ_PEBBASE;
return false;
}
* addr = (uint) & (((RTL_USER_PROCESS_PARAMETERS*) pprocess_parameters)->CommandLine);
return true;
}
bool __fixgetcommandlines(uint getcommandline, uint new_command_line, cmdline_error_t* cmd_line_error)
{
uint command_line_stored = 0;
uint aux = 0;
SIZE_T size;
unsigned char data[100];
cmd_line_error->addr = getcommandline;
if(!memread(fdProcessInfo->hProcess, (const void*) cmd_line_error->addr, & data, sizeof(data), & size))
{
cmd_line_error->type = CMDL_ERR_READ_GETCOMMANDLINEBASE;
return false;
}
#ifdef _WIN64
if(data[0] != 0x48 || data[1] != 0x8B || data[2] != 0x05 || data[7] != 0xC3)
{
cmd_line_error->type = CMDL_ERR_CHECK_GETCOMMANDLINESTORED;
return false;
}
DWORD offset = * ((DWORD*) & data[3]);
command_line_stored = getcommandline + 7 + offset;
/*
00007FFC5B91E3C8 | 48 8B 05 19 1D 0E 00 | mov rax,qword ptr ds:[7FFC5BA000E8]
00007FFC5B91E3CF | C3 | ret |
This is a relative offset then to get the symbol: next instruction of getmodulehandle (+7 bytes) + offset to symbol
(the last 4 bytes of the instruction)
*/
#else
if(data[0] != 0xA1 || data[5] != 0xC3)
{
cmd_line_error->type = CMDL_ERR_CHECK_GETCOMMANDLINESTORED;
return false;
}
command_line_stored = * ((uint*) & data[1]);
/*
750FE9CA | A1 CC DB 1A 75 | mov eax,dword ptr ds:[751ADBCC] |
750FE9CF | C3 | ret |
*/
#endif
if(! memwrite(fdProcessInfo->hProcess, (void*) command_line_stored, & new_command_line, sizeof(new_command_line), & size))
{
cmd_line_error->addr = command_line_stored;
cmd_line_error->type = CMDL_ERR_WRITE_GETCOMMANDLINESTORED;
return false;
}
return true;
}
bool _fixgetcommandlines(uint new_command_line_unicode, uint new_command_line_ascii, cmdline_error_t* cmd_line_error)
{
uint getcommandline;
if(!valfromstring("kernelbase:GetCommandLineA", & getcommandline))
{
if(!valfromstring("kernel32:GetCommandLineA", & getcommandline))
{
cmd_line_error->type = CMDL_ERR_GET_GETCOMMANDLINE;
return false;
}
}
if(!__fixgetcommandlines(getcommandline, new_command_line_ascii, cmd_line_error))
return false;
if(!valfromstring("kernelbase:GetCommandLineW", & getcommandline))
{
if(!valfromstring("kernel32:GetCommandLineW", & getcommandline))
{
cmd_line_error->type = CMDL_ERR_GET_GETCOMMANDLINE;
return false;
}
}
if(! __fixgetcommandlines(getcommandline, new_command_line_unicode, cmd_line_error))
return false;
return true;
}
bool dbgsetcmdline(char* cmd_line, cmdline_error_t* cmd_line_error)
{
cmdline_error_t cmd_line_error_aux;
UNICODE_STRING new_command_line;
SIZE_T size;
uint command_line_addr;
if(cmd_line_error == NULL)
cmd_line_error = & cmd_line_error_aux;
if(!_getcommandlineaddr(& cmd_line_error->addr, cmd_line_error))
return false;
command_line_addr = cmd_line_error->addr;
SIZE_T cmd_line_size = strlen(cmd_line);
new_command_line.Length = (USHORT)(strlen(cmd_line) + 1) * sizeof(WCHAR);
new_command_line.MaximumLength = new_command_line.Length;
Memory<wchar_t*> command_linewstr(new_command_line.Length);
// Covert to Unicode.
if(MultiByteToWideChar(CP_ACP, 0, cmd_line, (int) cmd_line_size + 1, command_linewstr, (int) cmd_line_size + 1) == 0)
{
cmd_line_error->type = CMDL_ERR_CONVERTUNICODE;
return false;
}
new_command_line.Buffer = command_linewstr;
uint mem = (uint)memalloc(fdProcessInfo->hProcess, 0, new_command_line.Length * 2, PAGE_READWRITE);
if(!mem)
{
cmd_line_error->type = CMDL_ERR_ALLOC_UNICODEANSI_COMMANDLINE;
return false;
}
memupdatemap(fdProcessInfo->hProcess);
GuiUpdateMemoryView();
if(! memwrite(fdProcessInfo->hProcess, (void*) mem, new_command_line.Buffer, new_command_line.Length, & size))
{
cmd_line_error->addr = mem;
cmd_line_error->type = CMDL_ERR_WRITE_UNICODE_COMMANDLINE;
return false;
}
if(! memwrite(fdProcessInfo->hProcess, (void*)(mem + new_command_line.Length), cmd_line, strlen(cmd_line) + 1, & size))
{
cmd_line_error->addr = mem + new_command_line.Length;
cmd_line_error->type = CMDL_ERR_WRITE_ANSI_COMMANDLINE;
return false;
}
if(!_fixgetcommandlines(mem, mem + new_command_line.Length, cmd_line_error))
return false;
new_command_line.Buffer = (PWSTR) mem;
if(! memwrite(fdProcessInfo->hProcess, (void*) command_line_addr, & new_command_line, sizeof(new_command_line), & size))
{
cmd_line_error->addr = command_line_addr;
cmd_line_error->type = CMDL_ERR_WRITE_PEBUNICODE_COMMANDLINE;
return false;
}
return true;
}
bool dbggetcmdline(char** cmd_line, cmdline_error_t* cmd_line_error)
{
SIZE_T size;
UNICODE_STRING CommandLine;
cmdline_error_t cmd_line_error_aux;
if(cmd_line_error == NULL)
cmd_line_error = & cmd_line_error_aux;
if(!_getcommandlineaddr(& cmd_line_error->addr, cmd_line_error))
return false;
if(!memread(fdProcessInfo->hProcess, (const void*) cmd_line_error->addr, & CommandLine, sizeof(CommandLine), & size))
{
cmd_line_error->type = CMDL_ERR_READ_PROCPARM_PTR;
return false;
}
Memory<wchar_t*> wstr_cmd(CommandLine.Length + sizeof(wchar_t));
cmd_line_error->addr = (uint) CommandLine.Buffer;
if(!memread(fdProcessInfo->hProcess, (const void*) cmd_line_error->addr, wstr_cmd, CommandLine.Length, & size))
{
cmd_line_error->type = CMDL_ERR_READ_PROCPARM_CMDLINE;
return false;
}
SIZE_T wstr_cmd_size = wcslen(wstr_cmd) + 1;
SIZE_T cmd_line_size = wstr_cmd_size * 2;
* cmd_line = (char*) calloc(1, cmd_line_size);
if(* cmd_line == NULL)
{
cmd_line_error->type = CMDL_ERR_ALLOC;
return false;
}
//Convert TO ASCII
if(WideCharToMultiByte(CP_ACP, 0, wstr_cmd, (int) wstr_cmd_size, * cmd_line, (int) cmd_line_size, NULL, NULL) == 0)
{
free(* cmd_line);
cmd_line_error->type = CMDL_ERR_CONVERTUNICODE;
return false;
}
return true;
}

36
x64_dbg_dbg/debugger.h
View File

@ -5,12 +5,14 @@
#include "TitanEngine\TitanEngine.h"
#include "command.h"
#include "breakpoint.h"
#include "undocumented.h"
#include "value.h"
#define ATTACH_CMD_LINE "\" -a %ld -e %ld"
#define JIT_ENTRY_DEF_SIZE (MAX_PATH + sizeof(ATTACH_CMD_LINE) + 2)
#define JIT_ENTRY_MAX_SIZE 512
#define JIT_REG_KEY TEXT("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug")
#define RIGHTS_STRING (sizeof("ERWCG") + 1)
typedef enum
{
@ -28,6 +30,31 @@ struct INIT_STRUCT
char* currentfolder;
};
typedef enum
{
CMDL_ERR_READ_PEBBASE = 0,
CMDL_ERR_READ_PROCPARM_PTR,
CMDL_ERR_READ_PROCPARM_CMDLINE,
CMDL_ERR_CONVERTUNICODE,
CMDL_ERR_ALLOC,
CMDL_ERR_GET_PEB,
CMDL_ERR_READ_GETCOMMANDLINEBASE,
CMDL_ERR_CHECK_GETCOMMANDLINESTORED,
CMDL_ERR_WRITE_GETCOMMANDLINESTORED,
CMDL_ERR_GET_GETCOMMANDLINE,
CMDL_ERR_ALLOC_UNICODEANSI_COMMANDLINE,
CMDL_ERR_WRITE_ANSI_COMMANDLINE,
CMDL_ERR_WRITE_UNICODE_COMMANDLINE,
CMDL_ERR_WRITE_PEBUNICODE_COMMANDLINE
} cmdline_error_type_t;
typedef struct
{
cmdline_error_type_t type;
uint addr;
} cmdline_error_t;
struct ExceptionRange
{
unsigned int start;
@ -68,7 +95,7 @@ bool dbggetpagerights(uint*, char*);
bool dbgpagerightstostring(DWORD, char*);
void dbggetpageligned(uint*);
bool dbgpagerightsfromstring(DWORD*, char*);
bool dbgsetpagerights(uint*, char*);
bool dbgsetpagerights(uint*, char*, bool);
bool dbgsetjit(char* jit_cmd, arch arch_in, arch* arch_out, readwritejitkey_error_t*);
bool dbggetdefjit(char* jit_entry);
bool _readwritejitkey(char*, DWORD*, char*, arch, arch*, readwritejitkey_error_t*, bool);
@ -76,6 +103,11 @@ bool dbggetjitauto(bool*, arch, arch*, readwritejitkey_error_t*);
bool dbgsetjitauto(bool, arch, arch*, readwritejitkey_error_t*);
bool dbglistprocesses(std::vector<PROCESSENTRY32>* list);
bool IsProcessElevated();
bool dbggetcmdline(char**, cmdline_error_t*);
bool dbgsetcmdline(char*, cmdline_error_t*);
bool _fixgetcommandlines(uint new_command_line_unicode, uint new_command_line_ascii, cmdline_error_t* cmd_line_error);
bool __fixgetcommandlines(uint getcommandline, uint new_command_line, cmdline_error_t* cmd_line_error);
bool _getcommandlineaddr(uint* addr, cmdline_error_t* cmd_line_error);
void cbStep();
void cbRtrStep();

114
x64_dbg_dbg/debugger_commands.cpp
View File

@ -1,5 +1,4 @@
#include "debugger_commands.h"
#include "debugger.h"
#include "console.h"
#include "value.h"
#include "thread.h"
@ -706,6 +705,8 @@ CMDRESULT cbDebugAlloc(int argc, char* argv[])
varset("$lastalloc", mem, true);
dbggetprivateusage(fdProcessInfo->hProcess, true);
memupdatemap(fdProcessInfo->hProcess);
if(argc <= 2)
GuiUpdateMemoryView();
varset("$res", mem, false);
return STATUS_CONTINUE;
}
@ -733,6 +734,8 @@ CMDRESULT cbDebugFree(int argc, char* argv[])
dputs("VirtualFreeEx failed");
dbggetprivateusage(fdProcessInfo->hProcess, true);
memupdatemap(fdProcessInfo->hProcess);
if(argc <= 2)
GuiUpdateMemoryView();
varset("$res", ok, false);
return STATUS_CONTINUE;
}
@ -1727,14 +1730,18 @@ CMDRESULT cbDebugSetPageRights(int argc, char* argv[])
{
uint addr = 0;
char rights[RIGHTS_STRING];
bool update_memmap = true;
if(argc != 3 || !valfromstring(argv[1], &addr))
if(argc < 3 || !valfromstring(argv[1], &addr))
{
dprintf("Error: using an address as arg1 and as arg2: Execute, ExecuteRead, ExecuteReadWrite, ExecuteWriteCopy, NoAccess, ReadOnly, ReadWrite, WriteCopy. You can add a G at first for add PAGE GUARD, example: GReadOnly\n");
return STATUS_ERROR;
}
if(!dbgsetpagerights(&addr, argv[2]))
if(argc >= 4)
update_memmap = false;
if(!dbgsetpagerights(&addr, argv[2], update_memmap))
{
dprintf("Error: Set rights of "fhex" with Rights: %s\n", addr, argv[2]);
return STATUS_ERROR;
@ -1748,5 +1755,106 @@ CMDRESULT cbDebugSetPageRights(int argc, char* argv[])
dprintf("New rights of "fhex": %s\n", addr, rights);
return STATUS_CONTINUE;
}
void showcommandlineerror(cmdline_error_t* cmdline_error)
{
bool unkown = false;
switch(cmdline_error->type)
{
case CMDL_ERR_ALLOC:
dprintf(" Error allocating memory for cmdline");
break;
case CMDL_ERR_CONVERTUNICODE:
dprintf(" Error converting UNICODE cmdline");
break;
case CMDL_ERR_READ_PEBBASE:
dprintf(" Error reading PEB base addres");
break;
case CMDL_ERR_READ_PROCPARM_CMDLINE:
dprintf(" Error reading PEB -> ProcessParameters -> CommandLine UNICODE_STRING");
break;
case CMDL_ERR_READ_PROCPARM_PTR:
dprintf(" Error reading PEB -> ProcessParameters pointer address");
break;
case CMDL_ERR_GET_PEB:
dprintf(" Error Getting remote PEB address");
break;
case CMDL_ERR_READ_GETCOMMANDLINEBASE:
dprintf(" Error Getting command line base address");
break;
case CMDL_ERR_CHECK_GETCOMMANDLINESTORED:
dprintf(" Error checking the pattern of the commandline stored");
break;
case CMDL_ERR_WRITE_GETCOMMANDLINESTORED:
dprintf(" Error writing the new command line stored");
break;
case CMDL_ERR_GET_GETCOMMANDLINE:
dprintf(" Error getting getcommandline");
break;
case CMDL_ERR_ALLOC_UNICODEANSI_COMMANDLINE:
dprintf(" Error allocating the page with UNICODE and ANSI command lines");
break;
case CMDL_ERR_WRITE_ANSI_COMMANDLINE:
dprintf(" Error writing the ANSI command line in the page");
break;
case CMDL_ERR_WRITE_UNICODE_COMMANDLINE:
dprintf(" Error writing the UNICODE command line in the page");
break;
case CMDL_ERR_WRITE_PEBUNICODE_COMMANDLINE:
dprintf(" Error writing command line UNICODE in PEB");
break;
default:
unkown = true;
dputs(" Error getting cmdline");
break;
}
if(!unkown)
{
if(cmdline_error->addr != 0)
dprintf(" "fhex"", cmdline_error->addr);
dputs("");
}
}
CMDRESULT cbDebugGetCmdline(int argc, char* argv[])
{
char* cmd_line;
cmdline_error_t cmdline_error = {(cmdline_error_type_t) 0, 0};
if(! dbggetcmdline(& cmd_line, & cmdline_error))
{
showcommandlineerror(& cmdline_error);
return STATUS_ERROR;
}
dprintf("Command line: %s\n", cmd_line);
free(cmd_line);
return STATUS_CONTINUE;
}
CMDRESULT cbDebugSetCmdline(int argc, char* argv[])
{
cmdline_error_t cmdline_error = {(cmdline_error_type_t) 0, 0};
if(argc != 2)
{
dprintf("Error: write the arg1 with the new command line of the process debugged\n");
return STATUS_ERROR;
}
if(! dbgsetcmdline(argv[1], & cmdline_error))
{
showcommandlineerror(& cmdline_error);
return STATUS_ERROR;
}
dprintf("New command line: %s\n", argv[1]);
return STATUS_CONTINUE;
}

6
x64_dbg_dbg/debugger_commands.h
View File

@ -2,6 +2,7 @@
#define _DEBUGGER_COMMANDS_H
#include "command.h"
#include "debugger.h"
//command callbacks
CMDRESULT cbDebugInit(int argc, char* argv[]);
@ -50,6 +51,8 @@ CMDRESULT cbDebugSetJITAuto(int argc, char* argv[]);
CMDRESULT cbDebugSuspendthread(int argc, char* argv[]);
CMDRESULT cbDebugKillthread(int argc, char* argv[]);
CMDRESULT cbDebugSetPriority(int argc, char* argv[]);
CMDRESULT cbDebugGetCmdline(int argc, char* argv[]);
CMDRESULT cbDebugSetCmdline(int argc, char* argv[]);
CMDRESULT cbDebugEnableHardwareBreakpoint(int argc, char* argv[]);
CMDRESULT cbDebugDisableHardwareBreakpoint(int argc, char* argv[]);
CMDRESULT cbDebugEnableMemoryBreakpoint(int argc, char* argv[]);
@ -58,4 +61,7 @@ CMDRESULT cbDebugDownloadSymbol(int argc, char* argv[]);
CMDRESULT cbDebugGetPageRights(int argc, char* argv[]);
CMDRESULT cbDebugSetPageRights(int argc, char* argv[]);
//misc
void showcommandlineerror(cmdline_error_t* cmdline_error);
#endif //_DEBUGGER_COMMANDS_H

2
x64_dbg_dbg/memory.h
View File

@ -4,8 +4,6 @@
#include "_global.h"
#include "addrinfo.h"
#define PAGE_SIZE 0x1000 //TODO: better stuff here
typedef std::map<Range, MEMPAGE, RangeCompare> MemoryMap;
extern MemoryMap memoryPages;

180
x64_dbg_dbg/undocumented.h
View File

@ -1,5 +1,7 @@
#include <windows.h>
#ifndef _UNDOCUMENTED_H
#define _UNDOCUMENTED_H
//Thanks to: https://github.com/zer0fl4g/Nanomite
typedef LONG NTSTATUS;
@ -17,50 +19,92 @@ typedef struct _CLIENT_ID
HANDLE UniqueThread;
} CLIENT_ID;
typedef struct _PEB
typedef struct _RTL_USER_PROCESS_PARAMETERS
{
BYTE InheritedAddressSpace;
BYTE ReadImageFileExecOptions;
BYTE BeingDebugged;
BYTE SpareBool;
DWORD Mutant;
DWORD ImageBaseAddress;
DWORD LoaderData;
DWORD ProcessParameters;
DWORD SubSystemData;
DWORD ProcessHeap;
DWORD FastPebLock;
DWORD FastPebLockRoutine;
DWORD FastPebUnlockRoutine;
DWORD EnviromentUpdateCount;
DWORD KernelCallbackTable;
DWORD UserSharedInfoPtr;
DWORD ThunksOrOptions;
DWORD FreeList;
DWORD TlsExpansionCounter;
DWORD TlsBitmap;
BYTE Reserved1[16];
PVOID Reserved2[10];
UNICODE_STRING ImagePathName;
UNICODE_STRING CommandLine;
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
#pragma pack(push)
#pragma pack(1)
template <class T>
struct LIST_ENTRY_T
{
T Flink;
T Blink;
};
template <class T>
struct UNICODE_STRING_T
{
union
{
struct
{
WORD Length;
WORD MaximumLength;
};
T dummy;
};
T _Buffer;
};
template <class T, class NGF, int A>
struct _PEB_T
{
union
{
struct
{
BYTE InheritedAddressSpace;
BYTE ReadImageFileExecOptions;
BYTE BeingDebugged;
BYTE BitField;
};
T dummy01;
};
T Mutant;
T ImageBaseAddress;
T Ldr;
T ProcessParameters;
T SubSystemData;
T ProcessHeap;
T FastPebLock;
T AtlThunkSListPtr;
T IFEOKey;
T CrossProcessFlags;
T UserSharedInfoPtr;
DWORD SystemReserved;
DWORD AtlThunkSListPtr32;
T ApiSetMap;
T TlsExpansionCounter;
T TlsBitmap;
DWORD TlsBitmapBits[2];
DWORD ReadOnlySharedMemoryBase;
DWORD ReadOnlySharedMemoryHeap;
DWORD ReadOnlyStaticServerData;
DWORD AnsiCodePageData;
DWORD OemCodePageData;
DWORD UnicodeCaseTableData;
T ReadOnlySharedMemoryBase;
T HotpatchInformation;
T ReadOnlyStaticServerData;
T AnsiCodePageData;
T OemCodePageData;
T UnicodeCaseTableData;
DWORD NumberOfProcessors;
DWORD NtGlobalFlag;
DWORD Reserved;
union
{
DWORD NtGlobalFlag;
NGF dummy02;
};
LARGE_INTEGER CriticalSectionTimeout;
DWORD HeapSegmentReserve;
DWORD HeapSegmentCommit;
DWORD HeapDeCommitTotalFreeThreshold;
DWORD HeapDeCommitFreeBlockThreshold;
T HeapSegmentReserve;
T HeapSegmentCommit;
T HeapDeCommitTotalFreeThreshold;
T HeapDeCommitFreeBlockThreshold;
DWORD NumberOfHeaps;
DWORD MaximumNumberOfHeaps;
DWORD ProcessHeaps;
DWORD GdiSharedHandleTable;
DWORD ProcessStarterHelper;
DWORD GdiDCAttributeList;
DWORD LoaderLock;
T ProcessHeaps;
T GdiSharedHandleTable;
T ProcessStarterHelper;
T GdiDCAttributeList;
T LoaderLock;
DWORD OSMajorVersion;
DWORD OSMinorVersion;
WORD OSBuildNumber;
@ -68,30 +112,47 @@ typedef struct _PEB
DWORD OSPlatformId;
DWORD ImageSubsystem;
DWORD ImageSubsystemMajorVersion;
DWORD ImageSubsystemMinorVersion;
DWORD ImageProcessAffinityMask;
DWORD GdiHandleBuffer[34];
DWORD PostProcessInitRoutine;
DWORD TlsExpansionBitmap;
T ImageSubsystemMinorVersion;
T ActiveProcessAffinityMask;
T GdiHandleBuffer[A];
T PostProcessInitRoutine;
T TlsExpansionBitmap;
DWORD TlsExpansionBitmapBits[32];
DWORD SessionId;
T SessionId;
ULARGE_INTEGER AppCompatFlags;
ULARGE_INTEGER AppCompatFlagsUser;
DWORD pShimData;
DWORD AppCompatInfo;
UNICODE_STRING CSDVersion;
DWORD ActivationContextData;
DWORD ProcessAssemblyStorageMap;
DWORD SystemDefaultActivationContextData;
DWORD SystemAssemblyStorageMap;
DWORD MinimumStackCommit;
DWORD FlsCallback;
DWORD FlsListHead_Flink;
DWORD FlsListHead_Blink;
DWORD FlsBitmap;
T pShimData;
T AppCompatInfo;
UNICODE_STRING_T<T> CSDVersion;
T ActivationContextData;
T ProcessAssemblyStorageMap;
T SystemDefaultActivationContextData;
T SystemAssemblyStorageMap;
T MinimumStackCommit;
T FlsCallback;
LIST_ENTRY_T<T> FlsListHead;
T FlsBitmap;
DWORD FlsBitmapBits[4];
DWORD FlsHighIndex;
} PEB, *PPEB;
T FlsHighIndex;
T WerRegistrationData;
T WerShipAssertPtr;
T pContextData;
T pImageHeaderHash;
T TracingFlags;
};
typedef _PEB_T<DWORD, DWORD64, 34> PEB32;
typedef _PEB_T<DWORD64, DWORD, 30> PEB64;
#pragma pack(pop)
#ifdef _WIN64 //x64
typedef PEB64 PEB;
#else //x86
typedef PEB32 PEB;
#endif //_WIN64
typedef PEB* PPEB;
typedef struct _TEB
{
@ -153,3 +214,6 @@ typedef struct _TEB
PVOID StackCommitMax;
PVOID StackReserved;
} TEB, *PTEB;
#endif /* _UNDOCUMENTED_H */

2
x64_dbg_dbg/x64_dbg.cpp
View File

@ -106,6 +106,8 @@ static void registercommands()
dbgcmdnew("getjit\1jitget", cbDebugGetJIT, false); //get JIT
dbgcmdnew("getjitauto\1jitgetauto", cbDebugGetJITAuto, false); //get JIT Auto
dbgcmdnew("setjitauto\1jitsetauto", cbDebugSetJITAuto, false); //set JIT Auto
dbgcmdnew("getcmdline\1getcommandline", cbDebugGetCmdline, true); //Get CmdLine
dbgcmdnew("setcmdline\1setcommandline", cbDebugSetCmdline, true); //Set CmdLine
//breakpoints
dbgcmdnew("bplist", cbDebugBplist, true); //breakpoint list

12
x64_dbg_gui/Project/Src/Bridge/Bridge.cpp
View File

@ -218,6 +218,11 @@ void Bridge::emitUpdateThreads()
emit updateThreads();
}
void Bridge::emitUpdateMemory()
{
emit updateMemory();
}
void Bridge::emitAddRecentFile(QString file)
{
emit addRecentFile(file);
@ -618,6 +623,12 @@ __declspec(dllexport) void* _gui_sendmessage(GUIMSG type, void* param1, void* pa
}
break;
case GUI_UPDATE_MEMORY_VIEW:
{
Bridge::getBridge()->emitUpdateMemory();
}
break;
case GUI_ADD_RECENT_FILE:
{
Bridge::getBridge()->emitAddRecentFile(QString(reinterpret_cast<const char*>(param1)));
@ -756,6 +767,7 @@ __declspec(dllexport) void* _gui_sendmessage(GUIMSG type, void* param1, void* pa
default:
{
}
break;
}

2
x64_dbg_gui/Project/Src/Bridge/Bridge.h
View File

@ -57,6 +57,7 @@ public:
void emitStackDumpAt(uint_t va, uint_t csp);
void emitUpdateDump();
void emitUpdateThreads();
void emitUpdateMemory();
void emitAddRecentFile(QString file);
void emitSetLastException(unsigned int exceptionCode);
int emitMenuAddMenu(int hMenu, QString title);
@ -115,6 +116,7 @@ signals:
void stackDumpAt(uint_t va, uint_t csp);
void updateDump();
void updateThreads();
void updateMemory();
void addRecentFile(QString file);
void setLastException(unsigned int exceptionCode);
void menuAddMenu(int hMenu, QString title);

46
x64_dbg_gui/Project/Src/Gui/CPUDisassembly.cpp
View File

@ -816,26 +816,34 @@ void CPUDisassembly::assembleAt()
QBeaEngine disasm;
Instruction_t instr = disasm.DisassembleAt(reinterpret_cast<byte_t*>(wBuffer.data()), wMaxByteCountToRead, 0, 0, wVA);
LineEditDialog mLineEdit(this);
mLineEdit.setText(instr.instStr);
mLineEdit.setWindowTitle("Assemble at " + addr_text);
mLineEdit.setCheckBoxText("&Fill with NOP's");
mLineEdit.enableCheckBox(true);
mLineEdit.setCheckBox(ConfigBool("Disassembler", "FillNOPs"));
if(mLineEdit.exec() != QDialog::Accepted)
return;
Config()->setBool("Disassembler", "FillNOPs", mLineEdit.bChecked);
char error[MAX_ERROR_SIZE] = "";
if(!DbgFunctions()->AssembleAtEx(wVA, mLineEdit.editText.toUtf8().constData(), error, mLineEdit.bChecked))
QString actual_inst = instr.instStr;
bool assembly_error = false;
do
{
QMessageBox msg(QMessageBox::Critical, "Error!", "Failed to assemble instruction \"" + mLineEdit.editText + "\" (" + error + ")");
msg.setWindowIcon(QIcon(":/icons/images/compile-error.png"));
msg.setParent(this, Qt::Dialog);
msg.setWindowFlags(msg.windowFlags() & (~Qt::WindowContextHelpButtonHint));
msg.exec();
return;
LineEditDialog mLineEdit(this);
mLineEdit.setText(actual_inst);
mLineEdit.setWindowTitle("Assemble at " + addr_text);
mLineEdit.setCheckBoxText("&Fill with NOP's");
mLineEdit.enableCheckBox(true);
mLineEdit.setCheckBox(ConfigBool("Disassembler", "FillNOPs"));
if(mLineEdit.exec() != QDialog::Accepted)
return;
Config()->setBool("Disassembler", "FillNOPs", mLineEdit.bChecked);
char error[MAX_ERROR_SIZE] = "";
if(!DbgFunctions()->AssembleAtEx(wVA, mLineEdit.editText.toUtf8().constData(), error, mLineEdit.bChecked))
{
QMessageBox msg(QMessageBox::Critical, "Error!", "Failed to assemble instruction \"" + mLineEdit.editText + "\" (" + error + ")");
msg.setWindowIcon(QIcon(":/icons/images/compile-error.png"));
msg.setParent(this, Qt::Dialog);
msg.setWindowFlags(msg.windowFlags() & (~Qt::WindowContextHelpButtonHint));
msg.exec();
actual_inst = mLineEdit.editText;
assembly_error = true;
}
}
while(assembly_error);
//select next instruction after assembling
setSingleSelection(wRVA);
int_t wInstrSize = getInstructionRVA(wRVA, 1) - wRVA - 1;
@ -843,6 +851,8 @@ void CPUDisassembly::assembleAt()
selectNext(false);
//refresh view
GuiUpdateAllViews();
assembleAt();
}
void CPUDisassembly::gotoExpression()

5
x64_dbg_gui/Project/Src/Gui/LineEditDialog.cpp
View File

@ -17,6 +17,11 @@ LineEditDialog::~LineEditDialog()
delete ui;
}
void LineEditDialog::setCursorPosition(int position)
{
ui->textEdit->setCursorPosition(position);
}
void LineEditDialog::setText(const QString & text)
{
ui->textEdit->setText(text);

1
x64_dbg_gui/Project/Src/Gui/LineEditDialog.h
View File

@ -21,6 +21,7 @@ public:
void enableCheckBox(bool bEnable);
void setCheckBox(bool bSet);
void setCheckBoxText(const QString & text);
void setCursorPosition(int position);
private slots:
void on_textEdit_textChanged(const QString & arg1);

44
x64_dbg_gui/Project/Src/Gui/MainWindow.cpp
View File

@ -931,3 +931,47 @@ void MainWindow::detach()
{
DbgCmdExec("detach");
}
void MainWindow::on_actionChange_command_line_triggered()
{
if(!DbgIsDebugging())
{
QMessageBox msg(QMessageBox::Warning, "ERROR NO DEBUGGING", "THERE IS NOT A DEBUGGING PROCESS");
msg.setWindowIcon(QIcon(":/icons/images/compile-warning.png"));
msg.setParent(this, Qt::Dialog);
msg.setWindowFlags(msg.windowFlags() & (~Qt::WindowContextHelpButtonHint));
msg.exec();
return;
}
LineEditDialog mLineEdit(this);
mLineEdit.setText("this is the current command line");
mLineEdit.setWindowTitle("Edit Command Line");
mLineEdit.setWindowIcon(QIcon(":/icons/images/changeargs.png"));
char* cmd_line;
if(! DbgFunctions()->GetCmdline(& cmd_line))
mLineEdit.setText("Cant get remote command line use getcmdline command for more information");
else
{
mLineEdit.setText(QString(cmd_line));
free(cmd_line);
}
mLineEdit.setCursorPosition(0);
if(mLineEdit.exec() != QDialog::Accepted)
return; //pressed cancel
if(!DbgFunctions()->SetCmdline((char*)mLineEdit.editText.toUtf8().constData()))
{
QMessageBox msg(QMessageBox::Warning, "ERROR CANT SET COMMAND LINE", "ERROR SETTING COMMAND LINE TRY SETCOMMANDLINE COMMAND");
msg.setWindowIcon(QIcon(":/icons/images/compile-warning.png"));
msg.setParent(this, Qt::Dialog);
msg.setWindowFlags(msg.windowFlags() & (~Qt::WindowContextHelpButtonHint));
msg.exec();
}
else
GuiAddStatusBarMessage(QString("New command line: " + mLineEdit.editText + "\n").toUtf8().constData());
}

2
x64_dbg_gui/Project/Src/Gui/MainWindow.h
View File

@ -151,6 +151,8 @@ protected:
void dragEnterEvent(QDragEnterEvent* pEvent);
void dropEvent(QDropEvent* pEvent);
private slots:
void on_actionChange_command_line_triggered();
};
#endif // MAINWINDOW_H

11
x64_dbg_gui/Project/Src/Gui/MainWindow.ui
View File

@ -81,6 +81,8 @@
<addaction name="actioneRtr"/>
<addaction name="separator"/>
<addaction name="actionCommand"/>
<addaction name="separator"/>
<addaction name="actionChange_command_line"/>
</widget>
<widget class="QMenu" name="menuHelp">
<property name="title">
@ -593,6 +595,15 @@
<string>Detach</string>
</property>
</action>
<action name="actionChange_command_line">
<property name="icon">
<iconset resource="../../resource.qrc">
<normaloff>:/icons/images/changeargs.png</normaloff>:/icons/images/changeargs.png</iconset>
</property>
<property name="text">
<string>Change command line</string>
</property>
</action>
</widget>
<layoutdefault spacing="6" margin="11"/>
<resources>

1
x64_dbg_gui/Project/Src/Gui/MemoryMapView.cpp
View File

@ -17,6 +17,7 @@ MemoryMapView::MemoryMapView(StdTable* parent) : StdTable(parent)
addColumnAt(8 + charwidth * 5, "APROT", false, "Allocation Protection"); //allocation protection
addColumnAt(100, "", false);
connect(Bridge::getBridge(), SIGNAL(updateMemory()), this, SLOT(refreshMap()));
connect(Bridge::getBridge(), SIGNAL(dbgStateChanged(DBGSTATE)), this, SLOT(stateChangedSlot(DBGSTATE)));
connect(this, SIGNAL(contextMenuSignal(QPoint)), this, SLOT(contextMenuSlot(QPoint)));

1
x64_dbg_gui/Project/Src/Gui/PageMemoryRights.cpp
View File

@ -30,7 +30,6 @@ void PageMemoryRights::RunAddrSize(uint_t addrin, uint_t sizein, QString pagetyp
tableWidget->setHorizontalHeaderItem(0, new QTableWidgetItem(QString("Address")));
tableWidget->setHorizontalHeaderItem(1, new QTableWidgetItem(QString("Rights")));
#define RIGHTS_STRING (sizeof("ERWCG") + 1)
duint actual_addr;
char rights[RIGHTS_STRING];
for(uint_t i = 0; i < nr_pages; i++)

2
x64_dbg_gui/Project/Src/Gui/PageMemoryRights.h
View File

@ -4,8 +4,6 @@
#include <QDialog>
#include "NewTypes.h"
#define PAGE_SIZE 0x1000
namespace Ui
{
class PageMemoryRights;

BIN
x64_dbg_gui/Project/images/changeargs.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 669 B

1
x64_dbg_gui/Project/resource.qrc
View File

@ -46,5 +46,6 @@
<file>images/attach.png</file>
<file>images/detach.png</file>
<file>images/trace.png</file>
<file>images/changeargs.png</file>
</qresource>
</RCC>