R0 Debug API

内核层调试API

创建调试对象，初始化调试环境：
NtCreateDebugObject
==NtDebugActiveProcess==
==DbgkpSetProcessDebugObject==
DbgkpMarkProcessPeb

发送模拟消息：
DbgkpPostFakeProcessCreateMessages
DbgkpPostFakeThreadMessages

发送接收异常调试事件消息：
==KiDispatchException==
==DbgkpQueueMessage==
DbgkpSendApiMessage
DbgkSendSystemDllMessages
DbgkpPostModuleMessages
DbgkPostEnclaveModuleMessages
DbgkPostModuleMessage
==NtWaitForDebugEvent==
==NtDebugContinue==
==DbgkForwardException==

退出调试清理环境：
DbgkpWakeTarget
DbgkpFreeDebugEvent
==NtRemoveProcessDebug==
==DbgkClearProcessDebugObject==

NTSTATUS NtCreateDebugObject(
        PHANDLE DebugObjectHandle,
        ACCESS_MASK DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        ULONG Flags)
{
  char bFlags; // si
  CHAR PreviousMode; // r10
  __int64 MmUserProbeAddress; // rcx
  NTSTATUS status; // eax
  _EWOW64PROCESS *Wow64Process; // rax
  unsigned __int16 Machine; // ax
  void *v13; // [rsp+20h] [rbp-68h]
  PDEBUG_OBJECT DebugObject; // [rsp+58h] [rbp-30h] MAPDST BYREF
  void *Handle[4]; // [rsp+60h] [rbp-28h] BYREF

  bFlags = Flags;
  Handle[0] = 0i64;
  DebugObject = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if ( PreviousMode )                           // KernelMode = 0,UserMode = 1
  {
    // ProbeForWriteHandle(DebugObjectHandle);
    MmUserProbeAddress = 0x7FFFFFFF0000i64;
    if ( DebugObjectHandle < 0x7FFFFFFF0000i64 )
      MmUserProbeAddress = DebugObjectHandle;
    *MmUserProbeAddress = *MmUserProbeAddress;
  }
  *DebugObjectHandle = 0i64;
  if ( (Flags & 0xFFFFFFFE) != 0 )
    return 0xC000000D;
  status = ObCreateObjectEx(PreviousMode, DbgkDebugObjectType, ObjectAttributes, 
  			PreviousMode, v13, sizeof (DEBUG_OBJECT), 0, 0, &DebugObject, 0i64);
  if ( status >= 0 )
  {
    // ExInitializeFastMutex (&DebugObject->Mutex);
    DebugObject->Mutex.Count = 1;
    DebugObject->Mutex.Owner = 0i64;
    DebugObject->Mutex.Contention = 0;
    KeInitializeEvent(&DebugObject->Mutex.Event, SynchronizationEvent, 0);
    // InitializeListHead (&DebugObject->EventList);
    DebugObject->EventList.Blink = &DebugObject->EventList;
    DebugObject->EventList.Flink = &DebugObject->EventList;
    KeInitializeEvent(&DebugObject->EventsPresent, NotificationEvent, 0);
    if ( (bFlags & 1) != 0 )                    // Flags & DEBUG_KILL_ON_CLOSE
      DebugObject->Flags = 2;                   // DEBUG_OBJECT_KILL_ON_CLOSE
    else
      DebugObject->Flags = 0;
    Wow64Process = KeGetCurrentThread()->ApcState.Process.WoW64Process;
    if ( Wow64Process )
    {
      Machine = Wow64Process->Machine;
      // #define IMAGE_FILE_MACHINE_I386 0x014c  // Intel 386.
      if ( Machine == 0x14C || Machine == 0x1C4 )
        DebugObject->Flags |= 4u;
    }
    // 把调试对象插入到调试进程的句柄表中,其中句柄的权限就是R3传入的DesriedAccess;
    status = ObInsertObjectEx(DebugObject, 0i64, DesiredAccess, 0, 0, 0i64, Handle);
    if ( status >= 0 )
      *DebugObjectHandle = Handle[0];           // Teb->DbgSsReserved[1]
  }
  return status;
}

NTSTATUS __fastcall NtDebugActiveProcess(HANDLE ProcessHandle, HANDLE DebugHandle)
{
  CHAR PreviousMode; // bp
  NTSTATUS status; // eax MAPDST
  PKTHREAD CurrentThread; // rax
  PEPROCESS CurrentProcess; // rsi
  PEWOW64PROCESS WoW64Process; // rax
  USHORT Machine; // cx
  PEWOW64PROCESS TargetWoW64Process; // rax
  USHORT TargetMachine; // cx
  NTSTATUS MsgStatus; // eax
  PETHREAD LastThread; // [rsp+40h] [rbp-28h] BYREF
  PEPROCESS TargetProcess; // [rsp+80h] [rbp+18h] MAPDST BYREF
  PDEBUG_OBJECT DebugObject; // [rsp+88h] [rbp+20h] MAPDST BYREF

  TargetProcess = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  LastThread = 0i64;
  status = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             0x800u,                            // PROCESS_SET_PORT
             PsProcessType,
             PreviousMode,
             'OgbD',
             &TargetProcess,
             0i64);
  if ( status >= 0 )
  {
    CurrentThread = KeGetCurrentThread();
    CurrentProcess = CurrentThread->ApcState.Process;// PsGetCurrentProcess()
    if ( TargetProcess == CurrentProcess || TargetProcess == PsInitialSystemProcess )
    {
      status = 0xC0000022;                      // STATUS_ACCESS_DENIED
    }
    else if ( PsTestProtectedProcessIncompatibility(PreviousMode, CurrentThread->ApcState.Process, TargetProcess) )
    {
      status = 0xC0000712;                      // STATUS_PROCESS_IS_PROTECTED
    }
    else if ( (TargetProcess->Pcb.SecureState.SecureHandle & 1) == 0
           || (status = PsRequestDebugSecureProcess(TargetProcess, 1u), status >= 0) )
    {
      WoW64Process = CurrentProcess->WoW64Process;
      if ( !WoW64Process
        || (Machine = WoW64Process->Machine, Machine != 0x14C) && Machine != 0x1C4
        || (TargetWoW64Process = TargetProcess->WoW64Process) != 0i64
        && ((TargetMachine = TargetWoW64Process->Machine, TargetMachine == 0x14C) || TargetMachine == 0x1C4) )
      {
        DebugObject = 0i64;
        status = ObReferenceObjectByHandle(DebugHandle, 2u, DbgkDebugObjectType, PreviousMode, &DebugObject, 0i64);
        if ( status >= 0 )
        {
          if ( ExAcquireRundownProtection_0(&TargetProcess->RundownProtect) )
          {
            MsgStatus = DbgkpPostFakeProcessCreateMessages(TargetProcess, DebugObject, &LastThread);
            status = DbgkpSetProcessDebugObject(TargetProcess, DebugObject, MsgStatus, LastThread);
            ExReleaseRundownProtection_0(&TargetProcess->RundownProtect);
          }
          else
          {
            status = 0xC000010A;                // STATUS_PROCESS_IS_TERMINATING
          }
          // ObfDereferenceObjectWithTag（DebugObject）
          HalPutDmaAdapter(DebugObject);
        }
      }
      else
      {
        status = 0xC00000BB;                    // STATUS_NOT_SUPPORTED
      }
    }
    ObfDereferenceObjectWithTag(TargetProcess, 'OgbD');
  }
  return status;
}

NTSTATUS __stdcall DbgkpPostFakeProcessCreateMessages(
        PEPROCESS Process,
        PDEBUG_OBJECT DebugObject,
        PETHREAD *pLastThread)
{
  NTSTATUS status; // eax
  PETHREAD FirstThread; // [rsp+30h] [rbp-68h] BYREF
  PETHREAD LastThread; // [rsp+38h] [rbp-60h] MAPDST BYREF
  KAPC_STATE ApcState; // [rsp+40h] [rbp-58h] BYREF

  // This routine posts the faked initial process create, thread create and mudule load messages
  // 调试假消息的意义在于附加时进程已经创建,无法还原线程进程创建时场景
  // 因此采取模拟发送假消息方式进行折中,还原进程刚创建时的调试信息不会遗漏。
  LastThread = 0i64;
  FirstThread = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  LastThread = 0i64;
  status = DbgkpPostFakeThreadMessages(Process, DebugObject, 0i64, &FirstThread, &LastThread);
  if ( status >= 0 )
  {
    KiStackAttachProcess(Process, 0, &ApcState);
    DbgkpPostModuleMessages(Process, FirstThread, &DebugObject->EventsPresent);
    KiUnstackDetachProcess(&ApcState, 0i64);
    ObfDereferenceObjectWithTag(FirstThread, 'OgbD');
    status = 0;
  }
  *pLastThread = LastThread;
  return status;
}

NTSTATUS __stdcall DbgkpPostFakeThreadMessages(
        PEPROCESS Process,
        PDEBUG_OBJECT DebugObject,
        PETHREAD StartThread,
        PETHREAD *pFirstThread,
        PETHREAD *pLastThread)
{
  struct _ETHREAD *FirstThread; // r15
  PETHREAD v9; // rdi
  int status; // r12d
  bool v11; // r13
  ULONG v12; // esi
  char v13; // r13
  void *SectionObject; // rcx
  __int64 v15; // rax
  bool v17; // [rsp+30h] [rbp-1E8h]
  struct _ETHREAD *CurrentThread; // [rsp+68h] [rbp-1B0h]
  struct _DBGKM_APIMSG ApiMsg; // [rsp+90h] [rbp-188h] BYREF
  struct _KAPC_STATE ApcState; // [rsp+1A0h] [rbp-78h] BYREF

  memset(&ApcState, 0, sizeof(ApcState));
  memset(&ApiMsg, 0, sizeof(ApiMsg));
  FirstThread = 0i64;
  v9 = 0i64;
  CurrentThread = KeGetCurrentThread();
  status = 0xC0000001;
  if ( StartThread )
  {
    FirstThread = StartThread;
    ObfReferenceObjectWithTag(StartThread, 'OgbD');
  }
  else
  {
    StartThread = PsGetNextProcessThread(Process, 0i64);
  }
  v11 = StartThread == 0i64;
  v17 = StartThread == 0i64;
  while ( StartThread )
  {
    if ( v9 )
      ObfDereferenceObjectWithTag(v9, 'OgbD');
    v9 = StartThread;
    ObfReferenceObjectWithTag(StartThread, 'OgbD');
    if ( (StartThread->Tcb.MiscFlags & 0x400) == 0 )
    {
      if ( (StartThread->CrossThreadFlags & 2) != 0
        || (PsSynchronizeWithThreadInsertion(StartThread, CurrentThread), (StartThread->CrossThreadFlags & 2) != 0) )
      {
        if ( ExAcquireRundownProtection_0(&StartThread->RundownProtect) )
        {
          v12 = 0xA;
          if ( PsSuspendThread(StartThread, 0i64) >= 0 )
            v12 = 0x2A;
        }
        else
        {
          v12 = 0x12;
        }
        memset(&ApiMsg, 0, sizeof(ApiMsg));
        if ( !v11 || (v12 & 0x10) != 0 )
        {
          v13 = 0;
          ApiMsg.ApiNumber = DbgKmCreateThreadApi;
          ApiMsg.u.Exception.ExceptionRecord.FileHandle = StartThread->Win32StartAddress;// StartAddress
        }
        else
        {
          v13 = 1;
          ApiMsg.ApiNumber = DbgKmCreateProcessApi;
          SectionObject = Process->SectionObject;
          if ( SectionObject )
            ApiMsg.u.Exception.ExceptionRecord.FileHandle = DbgkpSectionToFileHandle(SectionObject);
          else
            ApiMsg.u.Exception.ExceptionRecord.FileHandle = 0i64;
          ApiMsg.u.Exception.ExceptionRecord.BaseOfImage = Process->SectionBaseAddress;
          KeStackAttachProcess(&Process->Pcb, &ApcState);
          v15 = RtlImageNtHeader(Process->SectionBaseAddress);
          if ( v15 )
          {
            ApiMsg.u.ErrorMsg.ExceptionRecord.ExceptionInformation[1] = 0i64;
            ApiMsg.u.LoadDll.NamePointer = *(v15 + 12);
          }
          KeUnstackDetachProcess(&ApcState);
        }
        status = DbgkpQueueMessage(Process, StartThread, &ApiMsg, v12, DebugObject);
        if ( status < 0 )
        {
          if ( (v12 & 0x20) != 0 )
            PsResumeThread(StartThread, 0i64);
          if ( (v12 & 8) != 0 )
            ExReleaseRundownProtection_0(&StartThread->RundownProtect);
          if ( ApiMsg.ApiNumber == DbgKmCreateProcessApi && ApiMsg.u.Exception.ExceptionRecord.FileHandle )
            ObCloseHandle(ApiMsg.u.Exception.ExceptionRecord.FileHandle, 0);
          PsQuitNextProcessThread(StartThread);
          break;
        }
        if ( v13 )
        {
          v11 = 0;
          v17 = 0;
          ObfReferenceObjectWithTag(StartThread, 'OgbD');
          FirstThread = StartThread;
          DbgkSendSystemDllMessages(StartThread, DebugObject, &ApiMsg);
        }
        else
        {
          v11 = v17;
        }
      }
    }
    StartThread = PsGetNextProcessThread(Process, StartThread);
  }
  if ( status >= 0 )
  {
    if ( FirstThread )
    {
      *pFirstThread = FirstThread;
      *pLastThread = v9;
    }
    else
    {
      if ( v9 )
        ObfDereferenceObjectWithTag(v9, 'OgbD');
      return 0xC0000001;
    }
  }
  else
  {
    if ( FirstThread )
      ObfDereferenceObjectWithTag(FirstThread, 'OgbD');
    if ( v9 )
      ObfDereferenceObjectWithTag(v9, 'OgbD');
  }
  return status;
}

HANDLE __stdcall DbgkpSectionToFileHandle(PVOID SectionObject)
{
  POBJECT_NAME_INFORMATION v1; // rdi
  NTSTATUS v2; // ebx
  struct _IO_STATUS_BLOCK IoStatusBlock; // [rsp+30h] [rbp-40h] BYREF
  OBJECT_ATTRIBUTES ObjectAttributes; // [rsp+40h] [rbp-30h] BYREF
  POBJECT_NAME_INFORMATION FileNameInfo; // [rsp+88h] [rbp+18h] BYREF
  HANDLE FileHandle; // [rsp+90h] [rbp+20h] BYREF

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  FileHandle = 0i64;
  FileNameInfo = 0i64;
  IoStatusBlock = 0i64;
  if ( MmGetFileNameForSection(SectionObject, &FileNameInfo) < 0 )
    return 0i64;
  v1 = FileNameInfo;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &FileNameInfo->Name;
  ObjectAttributes.Length = 48;
  *&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.Attributes = 1600;
  v2 = ZwOpenFile(&FileHandle, 0x80100000, &ObjectAttributes, &IoStatusBlock, 7u, 0x20u);
  ExFreePoolWithTag(v1, 0);
  if ( v2 < 0 )
    return 0i64;
  else
    return FileHandle;
}

void __fastcall DbgkSendSystemDllMessages(PETHREAD Thread, PDEBUG_OBJECT DebugObject, PDBGKM_APIMSG ApiMsg)
{
  struct _EPROCESS *Process; // r15
  union _DBGKM_APIMSG::$1C0BB51BD40DD7F329A455188E31308E *ApiMsgUnionData; // rsi
  int i; // r14d
  PPS_SYSTEM_DLL_INFO SystemDllInfo; // rax MAPDST
  __int64 BaseAddress; // r13
  PIMAGE_NT_HEADERS NtHeader; // rax
  struct _KTHREAD *CurrentThread; // rcx
  char v13; // [rsp+30h] [rbp-108h]
  PTEB Teb; // [rsp+38h] [rbp-100h]
  OBJECT_ATTRIBUTES ObjectAttributes; // [rsp+88h] [rbp-B0h] BYREF
  struct _IO_STATUS_BLOCK IoStatusBlock; // [rsp+B8h] [rbp-80h] BYREF
  struct _KAPC_STATE ApcState; // [rsp+C8h] [rbp-70h] BYREF

  memset(&ApcState, 0, sizeof(ApcState));
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if ( Thread )
    Process = Thread->Tcb.Process;
  else
    Process = KeGetCurrentThread()->ApcState.Process;
  ApiMsgUnionData = &ApiMsg->u;
  for ( i = 0; i < 6; ++i )
  {
    SystemDllInfo = PsQuerySystemDllInfo(i);
    if ( SystemDllInfo
      && (i <= 0 || *(&SystemDllInfo->1 + 1) && Process->WoW64Process && i == PsWow64GetProcessNtdllType(Process)) )
    {
      *&ApiMsgUnionData->Exception.ExceptionRecord.SubSystemKey = 0i64;
      *&ApiMsgUnionData->ErrorMsg.ExceptionRecord.ExceptionAddress = 0i64;
      Teb = 0i64;
      BaseAddress = SystemDllInfo->BaseAddress;
      ApiMsgUnionData->Exception.ExceptionRecord.FileHandle = BaseAddress;
      if ( Thread && i )
      {
        v13 = 1;
        KiStackAttachProcess(Process, 0, &ApcState);
      }
      else
      {
        v13 = 0;
      }
      NtHeader = RtlImageNtHeader(BaseAddress);
      if ( NtHeader )
      {
        ApiMsgUnionData->LoadDll.DebugInfoFileOffset = NtHeader->FileHeader.PointerToSymbolTable;
        ApiMsgUnionData->LoadDll.DebugInfoSize = NtHeader->FileHeader.NumberOfSymbols;
      }
      if ( !Thread )
      {
        CurrentThread = KeGetCurrentThread();
        if ( (CurrentThread->MiscFlags & 0x400) != 0 || CurrentThread->ApcStateIndex == 1 )
          Teb = 0i64;
        else
          Teb = CurrentThread->Teb;
        if ( Teb )
        {
          RtlStringCbCopyW(Teb->StaticUnicodeBuffer, 0x20Aui64, *&SystemDllInfo[1].Flags);
          Teb->NtTib.ArbitraryUserPointer = Teb->StaticUnicodeBuffer;
          ApiMsgUnionData->LoadDll.NamePointer = &Teb->NtTib.ArbitraryUserPointer;
        }
      }
      if ( v13 )
        KiUnstackDetachProcess(&ApcState, 0i64);
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 1600;
      ObjectAttributes.ObjectName = &SystemDllInfo->DllPath;
      *&ObjectAttributes.SecurityDescriptor = 0i64;
      if ( ZwOpenFile(ApiMsgUnionData, 0x80100000, &ObjectAttributes, &IoStatusBlock, 7u, 0x20u) < 0 )
        ApiMsgUnionData->LoadDll.FileHandle = 0i64;
      ApiMsg->h.u1.Length = 5242920;
      ApiMsg->h.u2.ZeroInit = 8;
      ApiMsg->ApiNumber = DbgKmLoadDllApi;
      if ( Thread )
      {
        if ( DbgkpQueueMessage(Process, Thread, ApiMsg, 2u, DebugObject) < 0 && ApiMsgUnionData->LoadDll.FileHandle )
          ObCloseHandle(ApiMsgUnionData->LoadDll.FileHandle, 0);
      }
      else
      {
        DbgkpSendApiMessage(Process);
        if ( ApiMsgUnionData->LoadDll.FileHandle )
          ObCloseHandle(ApiMsgUnionData->LoadDll.FileHandle, 0);
        if ( Teb )
          Teb->NtTib.ArbitraryUserPointer = 0i64;
      }
    }
  }
}