gui/debugger_test copy.go.bak at main · HyperDbg/gui · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
package main

import (
	"fmt"
	"testing"
	"time"
	"unsafe"

	"github.com/ddkwork/HyperDbg/debugger"
	"github.com/ddkwork/HyperDbg/debugger/driver"
	"github.com/ddkwork/golibrary/std/mylog"
	"github.com/ddkwork/golibrary/std/stream"
)

func TestFixError(t *testing.T) {
	stream.Fmt(".")
	stream.Fix(".")
}

func TestRustDriverHTTP(t *testing.T) {
	driverPath := `d:\ux\examples\hypedbg\rust-driver\kd\hyperdbg_kd.sys`

	drv := driver.NewWithOptions(driverPath, "hyperdbg", "\\\\.\\hyperdbg", true)
	drv.Install()
	drv.Start()

	conn := debugger.NewPacket("http://127.0.0.1:50080")

	mylog.Check(conn.Connect())

	notepadPID := mylog.Check2(conn.StartProcess("notepad.exe"))
	// defer conn.KillProcess(notepadPID)
	mylog.Success(notepadPID)

	mylog.Check(conn.LoadVmm())
	mylog.Check(conn.UnloadVmm())
	// mylog.Check(conn.AttachProcess(notepadPID))
	// t.Logf("Process %d attached successfully", notepadPID)
	// defer conn.Disconnect()
	// defer func() {
	drv.Stop()
	drv.Uninstall()
	//}()
}

func TestOurCompiledDriverHTTP(t *testing.T) {
	driverPath := `d:\ux\examples\hypedbg\HyperDbgUnified\build\Release\hyperkd.sys`

	t.Logf("Testing with driver: %s", driverPath)

	drv := driver.NewWithOptions(driverPath, "hyperdbg", "\\\\.\\hyperdbg", true)
	drv.Install()
	drv.Start()


	conn := debugger.NewPacket("http://127.0.0.1:50080")
	mylog.Check(conn.Connect())

	notepadPID := mylog.Check2(conn.StartProcess("notepad.exe"))
	mylog.Success(notepadPID)

	mylog.Check(conn.LoadVmm())
	mylog.Check(conn.UnloadVmm())

	drv.Stop()
	drv.Uninstall()
}

func TestMultipleDriverInitialization(t *testing.T) {
	driverPath := `d:\ux\examples\hypedbg\rust-driver\kd\hyperdbg_kd.sys`

	iterations := 5
	for i := range iterations {
		drv := driver.NewWithOptions(driverPath, "hyperdbg", "\\\\.\\hyperdbg", true)
		drv.Install()
		drv.Start()

		time.Sleep(200 * time.Millisecond)

		conn := debugger.NewPacket("http://127.0.0.1:50080")
		if err := conn.Connect(); err != nil {
			t.Errorf("第 %d 次初始化失败: %v", i+1, err)
			drv.Stop()
			drv.Uninstall()
			continue
		}

		if !conn.IsConnected() {
			t.Errorf("第 %d 次初始化失败: 驱动未连接", i+1)
			drv.Stop()
			drv.Uninstall()
			continue
		}

		conn.Disconnect()
		drv.Stop()
		drv.Uninstall()
	}
}

func TestHookScript(t *testing.T) {
	packet := debugger.NewPacket("http://127.0.0.1:50080").(*debugger.Packet)
	err := packet.InstallHookScript(&debugger.HookScript{
		ApiName:  "NtDeviceIoControlFile",
		HookType: debugger.HookTypeEPT,
		Filter: &debugger.HookFilter{
			ExcludeSystem: true,
		},
		OnMatch: func(ctx *debugger.HookContext) {
			const (
				SMART_RCV_DRIVE_DATA          = 0x0007c088
				IOCTL_DISK_GET_DRIVE_GEOMETRY = 0x00070000
				IOCTL_STORAGE_QUERY_PROPERTY  = 0x002d1400
				IOCTL_CPUID                   = 0x00220000
				AFD_CONNECT                   = 0x12007
				IOCTL_NDIS_QUERY_GLOBAL_STATS = 0x00170202
			)
			type IDINFO struct {
				WGenConfig          uint16
				WNumCyls            uint16
				WReserved2          uint16
				WNumHeads           uint16
				WReserved4          uint16
				WReserved5          uint16
				WNumSectorsPerTrack uint16
				WVendorUnique       [3]uint16
				SSerialNumber       [20]byte
				WBufferType         uint16
				WBufferSize         uint16
				WECCSize            uint16
				SFirmwareRev        [8]byte
				SModelNumber        [40]byte
			}
			swapBytes := func(dst []byte, src []byte) {
				for i := 0; i < len(src); i += 2 {
					if i+1 < len(src) && i < len(dst) {
						dst[i] = src[i+1]
						dst[i+1] = src[i]
					}
				}
			}
			args := ctx.Args.(*debugger.NtDeviceIoControlFileArgs)
			switch args.IoControlCode {
			case SMART_RCV_DRIVE_DATA, IOCTL_STORAGE_QUERY_PROPERTY:
				if args.OutputBuffer != 0 && args.OutputBufferLength >= 512 {
					info := (*IDINFO)(unsafe.Pointer(args.OutputBuffer))
					model := "Hitachi HTS545050A7E380"
					serial := "TEA55A3Q2NTK8R"
					swapBytes(info.SSerialNumber[:], []byte(serial))
					swapBytes(info.SModelNumber[:], []byte(model))
				}
				ctx.Return = 0
			}
		},
	})
	if err != nil {
		fmt.Printf("Failed to install hook script: %v\n", err)
		return
	}

	fmt.Println("Hardware spoof hooks installed")
}