debugger.h

Go to the documentation of this file.

 
#ifndef DEBUGGER_H
#define DEBUGGER_H
 
#pragma comment(lib, "Advapi32.lib")
#pragma comment(lib, "ntdll.lib")
 
#include <windows.h>
#include <string>
#include <vector>
#include <tlhelp32.h>
#include <iostream>
#include <iomanip>
#include <sstream>
#include <unordered_map>
#include <tchar.h>
#include <stdio.h>
#include <psapi.h>
#include <map>
#include <fstream>
#include <winternl.h>
#include <intrin.h>
 
#include "util.h"
 
namespace RoboDBG {

    enum BreakpointAction {
        BREAK,       
        RESTORE,     
        SINGLE_STEP  
    };

    enum class AccessType {
        EXECUTE,   
        WRITE,     
        READWRITE  
    };

    enum class DRReg {
        NOP = -1, 
        DR0 = 0,  
        DR1 = 1,  
        DR2 = 2,  
        DR3 = 3   
    };

    enum class BreakpointLength {
        BYTE  = 0, 
        WORD  = 1, 
        DWORD = 2, 
        QWORD = 3  
    };

    struct thread_t {
        HANDLE hThread;      
        DWORD threadId;      
        LPVOID threadBase;   
        LPVOID startAddress; 
    };

    struct hwBp_t {
        HANDLE          hThread; 
        LPVOID          address; 
        DRReg           reg;     
        AccessType      type;    
        BreakpointLength len;    
    };

    struct MemoryRegion_t {
        LPVOID BaseAddress; 
        SIZE_T RegionSize;  
        DWORD State;        
        DWORD Protect;      
        DWORD Type;         
    };
 
    #ifdef _WIN64
    enum class Flags64 : DWORD64 {
        CF = 1ull << 0,  
        PF = 1ull << 2,  
        AF = 1ull << 4,  
        ZF = 1ull << 6,  
        SF = 1ull << 7,  
        TF = 1ull << 8,  
        IF = 1ull << 9,  
        DF = 1ull << 10, 
        OF = 1ull << 11  
    };
    #else
    enum class Flags32 : DWORD {
        CF = 1 << 0,   
        PF = 1 << 2,   
        AF = 1 << 4,   
        ZF = 1 << 6,   
        SF = 1 << 7,   
        TF = 1 << 8,   
        IF = 1 << 9,   
        DF = 1 << 10,  
        OF = 1 << 11   
    };
    #endif
 
    #ifdef _WIN64
    enum class Register64 {
        RAX, RBX, RCX, RDX, RSI, RDI, RBP, RSP,
        R8, R9, R10, R11, R12, R13, R14, R15,
        RIP 
    };
    #else
    enum class Register32 {
        EAX, EBX, ECX, EDX, ESI, EDI, EBP, ESP,
        EIP 
    };
    #endif
 

class Debugger {
private:
    LPVOID bpAddrToRestore;
    bool needToRestoreBreakpoint; // TODO: rename to bpNeedToRestore
    int lastBpType;
 
    bool restoreHwBP;
    hwBp_t hwBPToRestore;
    HANDLE hwBPThreadToRestore;
 
    bool dbgLoop = true;
 
    // internal callbacks. Arent used right now / not implemented.
    void onPreStart();
    void onPreAttach();
 
protected:
    bool verbose;
    uintptr_t baseAddressOffset = 0; // TODO: Add a base image address, e.g: 0x00400000U
 
#ifdef __WIN64
    uintptr_t baseImageBase = 0x0000000140000000ULL; 
#else
    uintptr_t baseImageBase = 0x00400000U;           
#endif
    std::map<LPVOID, BYTE> breakpoints;
    std::map<LPVOID, hwBp_t> hwBreakpoints;
    std::map<LPVOID, BYTE> dlls;
    std::vector<thread_t> threads;
    int debuggedPid;
    HANDLE hProcessGlobal = nullptr;
    HANDLE hThreadGlobal = nullptr;
 
    // ===== Lifecycle & events =====

    virtual void onStart(uintptr_t imageBase, uintptr_t entryPoint);

    virtual void onEnd(DWORD exitCode, DWORD pid);

    virtual void onAttach();

    virtual void onThreadCreate(HANDLE hThread, DWORD threadId, uintptr_t threadBase, uintptr_t startAddress);

    virtual void onThreadExit(DWORD threadID);

    virtual bool onDLLLoad(uintptr_t address, std::string dllName, uintptr_t entryPoint);

    virtual void onDLLUnload(uintptr_t address, std::string dllName);

    virtual BreakpointAction onBreakpoint(uintptr_t address, HANDLE hThread);

    virtual BreakpointAction onHardwareBreakpoint(uintptr_t address, HANDLE hThread, DRReg reg);

    virtual void onSinglestep(uintptr_t address, HANDLE hThread);

    virtual void onDebugString(std::string dbgString);

    virtual void onAccessViolation(uintptr_t address, uintptr_t faultingAddress, long accessType);

    virtual void onRIPError(const RIP_INFO& rip);

    virtual void onUnknownException(uintptr_t addr, DWORD code);

    virtual void onUnknownDebugEvent(DWORD code);
 
    // ===== Threading =====

    void actualizeThreadList();
 
    // ===== Breakpoints (low-level) =====

    void setBreakpoint(LPVOID address);

    DRReg isHardwareBreakpointAt(LPVOID address);

    void restoreBreakpoint(LPVOID address);

    bool setHardwareBreakpointOnThread(hwBp_t bp);

    bool setHardwareBreakpoint(hwBp_t bp);

    std::vector<hwBp_t> getHardwareBreakpoints();

    void enableSingleStep(HANDLE hThread);

    void decrementIP(HANDLE hThread);

    bool clearHardwareBreakpoint(DRReg reg);

    bool clearHardwareBreakpointOnThread(HANDLE hThread, DRReg reg);

    hwBp_t getBreakpointByReg(DRReg reg);
 
    // ===== Memory =====

    bool writeMemory(LPVOID address, const void* buffer, SIZE_T size);

    bool readMemory(LPVOID address, void* buffer, SIZE_T size);

    bool changeMemoryProtection(LPVOID baseAddress, SIZE_T regionSize, DWORD newProtect);

    MemoryRegion_t getPageByAddress(LPVOID baseAddress);

    std::vector<MemoryRegion_t> getMemoryPages();

    bool changeMemoryProtection(MemoryRegion_t page, DWORD newProtect);

    std::vector<uintptr_t> searchInMemory(const std::vector<BYTE>& pattern);
 
    // ===== Misc =====

    uintptr_t ASLR(LPVOID address);

    uintptr_t ASLR(uintptr_t address);

    bool hideDebugger();

    void printIP(HANDLE hThread);
 
#ifdef _WIN64
    bool getFlag(HANDLE hThread, Flags64 flag);

    void setFlag(HANDLE hThread, Flags64 flag, bool enabled);

    int64_t getRegister(HANDLE hThread, Register64 reg);

    void setRegister(HANDLE hThread, Register64 reg, int64_t value);
#else
    bool getFlag(HANDLE hThread, Flags32 flag);

    void setFlag(HANDLE hThread, Flags32 flag, bool enabled);

    int32_t getRegister(HANDLE hThread, Register32 reg);

    void setRegister(HANDLE hThread, Register32 reg, int32_t value);
#endif

    void PrintMemoryPages();
 
    // ===== Wrappers (inline, app-friendly) =====

    inline void setBreakpoint(uintptr_t address) {
        setBreakpoint(reinterpret_cast<LPVOID>(address));
    }

    inline DRReg isHardwareBreakpointAt(uintptr_t address) {
        return isHardwareBreakpointAt(reinterpret_cast<LPVOID>(address));
    }

    inline MemoryRegion_t getPageByAddress(uintptr_t baseAddress) {
        return getPageByAddress(reinterpret_cast<LPVOID>(baseAddress));
    }

    inline void restoreBreakpoint(uintptr_t address) {
        restoreBreakpoint(reinterpret_cast<LPVOID>(address));
    }

    inline bool setHardwareBreakpointOnThread(HANDLE hThread, LPVOID address, DRReg reg, AccessType type, BreakpointLength len) {
        hwBp_t bp = { hThread, address, reg, type, len };
        return setHardwareBreakpointOnThread(bp);
    }

    inline bool setHardwareBreakpoint(LPVOID address, DRReg reg, AccessType type, BreakpointLength len) {
        hwBp_t bp = { (HANDLE)nullptr, address, reg, type, len };
        return setHardwareBreakpoint(bp);
    }

    inline bool setHardwareBreakpoint(int address, DRReg reg, AccessType type, BreakpointLength len) {
        hwBp_t bp = { (HANDLE)nullptr, reinterpret_cast<LPVOID>(static_cast<intptr_t>(address)), reg, type, len };
        return setHardwareBreakpoint(bp);
    }

    inline bool changeMemoryProtection(uintptr_t baseAddress, SIZE_T regionSize, DWORD newProtect) {
        return changeMemoryProtection(reinterpret_cast<LPVOID>(baseAddress), regionSize, newProtect);
    }

    inline bool writeMemory(uintptr_t address, const void* buffer, SIZE_T size) {
        return writeMemory(reinterpret_cast<LPVOID>(address), buffer, size);
    }

    inline bool readMemory(uintptr_t address, void* buffer, SIZE_T size) {
        return readMemory(reinterpret_cast<LPVOID>(address), buffer, size);
    }

    template<typename T>
    bool writeMemory(uintptr_t address, const T& value) {
        SIZE_T bytesWritten = 0;
        if (!WriteProcessMemory(hProcessGlobal, reinterpret_cast<LPVOID>(address), &value, sizeof(T), &bytesWritten) || bytesWritten != sizeof(T)) {
            return false;
        }
        FlushInstructionCache(hProcessGlobal, reinterpret_cast<LPVOID>(address), sizeof(T));
        return true;
    }

    template<typename T>
    T readMemory(uintptr_t address) {
        T value{};
        SIZE_T bytesRead = 0;
        if (!ReadProcessMemory(hProcessGlobal, reinterpret_cast<LPCVOID>(address), &value, sizeof(T), &bytesRead) || bytesRead != sizeof(T)) {
            return T{};
        }
        return value;
    }

    inline bool isEqual(LPVOID a, uintptr_t b) {
        return a == reinterpret_cast<LPCVOID>(b);
    }

    inline HANDLE getProcessHandle( )
    {
        return hProcessGlobal;
    }
public:
    Debugger();

    Debugger(bool verbose);

    int start(std::string exeName);

    int start(std::string exeName, const std::vector<std::string>& args);

    int attach(std::string exeName);

    int detach();

    int loop();
};
 
} // namespace RoboDBG
 
#endif