layout: post
title: 实现Windbg x64汇编功能
categories: Windows
description: 实现Windbg x64汇编功能
keywords:
url: https://lichao890427.github.io/ https://github.com/lichao890427/

实现windbg x64汇编功能

背景

  熟悉windbg的都知道，a指令，只支持x86，另外经我研究，虽然引擎中扩展了I386|ARM|IA64|AMD64|EBC的指令集，但是后几种只有反汇编能力，而并没有汇编能力。因此这是个突破点，然而汇编器源码这种东西是比较稀缺的，无奈之下为了实现amd64汇编我选择了ml64.exe工具，利用该用具生成机器码

0:000> !a -s AMD64 
usage: !a [-s ProcessorType] [-a Address]
        Optional ProcessorType:I386|ARM|IA64|AMD64|EBC
        Default ProcessorType is I386;Default Address is current $ip
example:!a -s AMD64 -a .
Assemble on AMD64 at 00007FFD75B81970
please input asm code, [enter] to leave
mov r8,0
mov r8,0
    00007ffd`75b81970 49c7c000000000  mov     r8,0
mov r8,gs:[0]
mov r8,gs:[0]
    00007ffd`75b81977 654c8b042500000000 mov   r8,qword ptr gs:[0] gs:00000000`00000000=????????????????
asm edit leave

开发Windbg插件

// WDbgLiExts.cpp
#include "DbgEng.h"
#include <windows.h>
#include <fstream>
#include <shlwapi.h>
#pragma comment(lib,"Shlwapi.lib")

#define EXT_MAJOR_VER  1
#define EXT_MINOR_VER  0

extern "C" HRESULT CALLBACK
DebugExtensionInitialize(PULONG Version, PULONG Flags) 
{
    *Version = DEBUG_EXTENSION_VERSION(EXT_MAJOR_VER, EXT_MINOR_VER);
    *Flags = 0;  // Reserved for future use.
    return S_OK;
}

extern "C" void CALLBACK
DebugExtensionNotify(ULONG Notify, ULONG64 Argument) 
{
    UNREFERENCED_PARAMETER(Argument);
    switch (Notify) {
        // A debugging session is active. The session may not necessarily be suspended.
    case DEBUG_NOTIFY_SESSION_ACTIVE:
        break;
        // No debugging session is active.
    case DEBUG_NOTIFY_SESSION_INACTIVE:
        break;
        // The debugging session has suspended and is now accessible.
    case DEBUG_NOTIFY_SESSION_ACCESSIBLE:
        break;
        // The debugging session has started running and is now inaccessible.
    case DEBUG_NOTIFY_SESSION_INACCESSIBLE:
        break;
    }
    return;
}

extern "C" void CALLBACK
DebugExtensionUninitialize(void) 
{
    return;
}

HRESULT CALLBACK
helloworld(PDEBUG_CLIENT pDebugClient, PCSTR args) 
{
    UNREFERENCED_PARAMETER(args);
    IDebugControl* pDebugControl;
    if (SUCCEEDED(pDebugClient->QueryInterface(__uuidof(IDebugControl),
        (void **)&pDebugControl))) {
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "Hello World!\n");
        pDebugControl->Release();
    }
    return S_OK;
}

//返回参数长度，和起始位置
int GetParamVal(PCSTR& begin, PCSTR& end)
{
    PCSTR truebegin = 0, trueend = 0;
    while (*begin)
    {
        if (*begin != ' ' && *begin != '\t')
        {
            truebegin = begin;
            break;
        }
        begin++;
    }

    trueend = truebegin;
    do
    {
        if (*trueend == '-' || *trueend == '\0')
        {
            break;
        }
        trueend++;
    } while (true);

    return trueend - truebegin;
}

PSTR getnextnonblank(PSTR begin)
{
    while (*begin)
    {
        if (*begin != ' ' && *begin != '\t')
            break;
        begin++;
    }
    return begin;
}

PSTR getnextchar(PSTR begin, char ch)
{
    while (*begin)
    {
        if (*begin == ch)
            break;
        begin++;
    }
    return begin;
}

bool ResolveSymbolInExpression(IDebugControl* pDebugControl, PSTR asmcode, PSTR outcode, ULONG64 Xip)
{   
    /*
    //找到操作码起始位置
    PSTR opcode, opdata;
    int opcodelen, opdatalen;
    asmcode = getnextnonblank(asmcode);
    if (!*asmcode)//找不到操作码
        return false;
    char si[] = " ,,,,,";
    int index = 0;
    char exp[256];
    __debugbreak();
    DEBUG_VALUE value;
    do
    {
        opcode = asmcode;
        asmcode = getnextchar(asmcode, si[index]);
        opcodelen = asmcode - opcode;
        strncpy(exp, opcode, opcodelen);
        exp[opcodelen] = '\0';
        memset(&value, 0, sizeof(value));
        if (SUCCEEDED(pDebugControl->Evaluate(exp, DEBUG_VALUE_INT64, &value, NULL)))
        {
            //若能解析
            sprintf(exp, "%I64d", (LONG64)value.I64);
            opcodelen = strlen(exp);
            strncpy(outcode, exp, opcodelen);
            outcode[opcodelen] = '\0';
            pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "解析exp=%s\n", outcode);
        }
        else
        {
            //不能解析
            strncpy(outcode, opcode, opcodelen);
            outcode[opcodelen] = '\0';
            pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "无法解析exp=%s\n", exp);
        }
        
        outcode += opcodelen;
        asmcode = getnextnonblank(asmcode + 1);
        *outcode = si[index];
        outcode++;
        index++;
    } while (*asmcode);
    outcode[-1] = '\0';
    */
    strcpy(outcode, asmcode);
    return true;
}

bool GetByteCode(IDebugControl* pDebugControl, PSTR asmcode, PSTR outbyte, PULONG byteswrite)
{
    __debugbreak();
    char buf[256], asmpath[256], objpath[256], ml64path[256], msvcr100[256];
    bool ret = false;
    GetCurrentDirectoryA(256, buf);
    sprintf(asmpath, "%s\\test.asm", buf);
    sprintf(objpath, "%s\\test.obj", buf);
    sprintf(ml64path, "%s\\ml64.exe", buf);
    sprintf(msvcr100, "%s\\msvcr100.dll", buf);
    FILE* fpasm = NULL,*fpobj = NULL;
    fpasm = fopen(asmpath, "w");
    if (!fpasm)
    {
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "无法创建asm\n");
    }
    else if (!PathFileExistsA(ml64path))
    {
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "ml64.exe不存在\n");
    }
    else if (!PathFileExistsA(msvcr100))
    {
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "msvcr100.dll不存在\n");
    }
    else
    {
        fputs(".CODE\n", fpasm);
        fputs("Entry PROC\n", fpasm);
        fputs(asmcode, fpasm);
        fputs("\nEntry ENDP\n", fpasm);
        fputs("END\n", fpasm);
        fclose(fpasm);
        fpasm = NULL;
        if (!PathFileExistsA(objpath) || DeleteFileA(objpath))
        {
            WinExec("ml64 test.asm", SW_HIDE);
            Sleep(200);
            fpobj = fopen(objpath, "rb");
            if (!fpobj)
            {
                pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "语法错误\n");
            }
            else
            {
                char* data = new char[256];
                fread(data, 256, 1, fpobj);
                int offset = 0x18;
                unsigned short datasize;
                offset += *(unsigned short*)(data + offset);
                datasize = *(unsigned short*)(data + 0x24);
                //此时data+offset处的datasize个字节即为汇编生成的机器码
                //写入内存
                memcpy(outbyte, data + offset, datasize);
                *byteswrite = datasize;
                delete[]data;
                ret = true;
            }
        }
        else
        {
            pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "obj文件无法删除\n");  
        }
    }
    if (fpasm)
        fclose(fpasm);
    if (fpobj)
        fclose(fpobj);
    //DeleteFileA(asmpath);
    DeleteFileA(objpath);
    return ret;
}

HRESULT CALLBACK
a(PDEBUG_CLIENT pDebugClient, PCSTR args) 
{
    UNREFERENCED_PARAMETER(args);
    IDebugControl* pDebugControl;

    if (SUCCEEDED(pDebugClient->QueryInterface(__uuidof(IDebugControl),(void **)&pDebugControl))) 
    {
        HRESULT result = 0;
        ULONG OriProcessorType = 0, CurProcessorType = 0;
        if (!SUCCEEDED(pDebugControl->GetEffectiveProcessorType(&OriProcessorType)))
            OriProcessorType = IMAGE_FILE_MACHINE_I386;

        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "usage: !a [-s ProcessorType] [-a Address]\n");
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "\tOptional ProcessorType:I386|ARM|IA64|AMD64|EBC\n");
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "\tDefault ProcessorType is I386;Default Address is current $ip\n");
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "example:!a -s AMD64 -a .\n");

        PSTR pt = (PSTR)args;
        DEBUG_VALUE value;
        ULONG64 Address;

        char exp[256] = "$ip",ProcessorName[256];
        PCSTR b = pt, e = pt;
        CurProcessorType = IMAGE_FILE_MACHINE_I386;
        strcpy(ProcessorName, "I386");
        if (b = strstr(pt, "-s"))
        {
            if (strstr(pt, "I386"))
            {
                CurProcessorType = IMAGE_FILE_MACHINE_I386;
                strcpy(ProcessorName, "I386");
            }
            else if (strstr(pt, "ARM"))
            {
                CurProcessorType = IMAGE_FILE_MACHINE_ARM;
                strcpy(ProcessorName, "ARM");
            }
            else if (strstr(pt, "IA64"))
            {
                CurProcessorType = IMAGE_FILE_MACHINE_IA64;
                strcpy(ProcessorName, "IA64");
            }
            else if (strstr(pt, "AMD64"))
            {
                CurProcessorType = IMAGE_FILE_MACHINE_AMD64;
                strcpy(ProcessorName, "AMD64");
            }
            else if (strstr(pt, "EBC"))
            {
                CurProcessorType = IMAGE_FILE_MACHINE_EBC;
                strcpy(ProcessorName, "EBC");
            }
        }
        else if (b = strstr(pt, "-a"))
        {
            e = b;
            int len = GetParamVal(b, e);
            if (len)
            {
                strncpy(exp, b, len);
                exp[len] = '\0';
            }
        }
        pDebugControl->Evaluate(exp, (OriProcessorType == IMAGE_FILE_MACHINE_I386) ? DEBUG_VALUE_INT32 : DEBUG_VALUE_INT64, &value, NULL);
        Address = (OriProcessorType == IMAGE_FILE_MACHINE_I386) ? value.I32 : value.I64;    
        pDebugControl->SetEffectiveProcessorType(CurProcessorType);
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "Assemble on %s at %N\n please input asm code, [enter] to leave\n", ProcessorName, Address);

        char Inputbuf[256];
        while (true)
        {
            ULONG64 NextAddr = Address,NextAddr2;
            memset(Inputbuf, 0, 256);
            pDebugControl->Input(Inputbuf, 256, NULL);
            if (strlen(Inputbuf) == 0)
                break;
            switch (CurProcessorType)
            {
            case IMAGE_FILE_MACHINE_I386:
                strcpy(pt, Inputbuf);
                //逐行反汇编
                result = pDebugControl->Assemble(Address, Inputbuf, &NextAddr);
                //打印结果
                if (SUCCEEDED(result))
                {
                    pDebugControl->OutputDisassembly(DEBUG_OUTCTL_ALL_CLIENTS, Address, DEBUG_DISASM_EFFECTIVE_ADDRESS | DEBUG_DISASM_MATCHING_SYMBOLS |
                        DEBUG_DISASM_SOURCE_LINE_NUMBER | DEBUG_DISASM_SOURCE_FILE_NAME, &NextAddr2);
                    Address = NextAddr;
                }
                break;
            case IMAGE_FILE_MACHINE_AMD64:
                {
                    char bytecode[256],fixasmcode[256];             
                    bool suc = true;
                    
                    //使用ml64进行解析：
                    //1.先将Inputbuf中的符号解析为数据
                    suc = ResolveSymbolInExpression(pDebugControl, Inputbuf, fixasmcode, Address);
                    if(!suc)
                        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "unresolve symbol\n");
                    //2.使用ml64解析并取得obj机器码
                    else
                    {
                        ULONG bytewrite = 0;
                        suc = GetByteCode(pDebugControl, fixasmcode, bytecode, &bytewrite);
                        if(!suc || !bytewrite)
                            pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "file op or disasm fail\n");
                        else
                        {
                            //3.写入虚拟内存
                            IDebugDataSpaces* dataspace;
                            if (SUCCEEDED(pDebugClient->QueryInterface(__uuidof(IDebugDataSpaces), (void **)&dataspace)))
                            {
                                if (!SUCCEEDED(dataspace->WriteVirtual(Address, (PVOID)bytecode, bytewrite, NULL)))
                                {
                                    suc = false;
                                    pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "can't write to memory\n");
                                }
                            }
                            else
                            {
                                suc = false;
                                pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "can't obtain IDebugDataSpaces\n");
                            }
                            if (suc)
                            {
                                pDebugControl->OutputDisassembly(DEBUG_OUTCTL_ALL_CLIENTS, Address, DEBUG_DISASM_EFFECTIVE_ADDRESS | DEBUG_DISASM_MATCHING_SYMBOLS |
                                    DEBUG_DISASM_SOURCE_LINE_NUMBER | DEBUG_DISASM_SOURCE_FILE_NAME, &NextAddr2);
                                Address = NextAddr2;
                            }
                        }
                    }
                    
                }
                break;
            default:
                break;
            }
        }
        pDebugControl->Output(DEBUG_OUTPUT_NORMAL, "asm edit leave\n", ProcessorName, Address);
        pDebugControl->SetEffectiveProcessorType(OriProcessorType);
        pDebugControl->Release();
    }
    return S_OK;
}

 export.def

 EXPORTS
   DebugExtensionNotify
   DebugExtensionInitialize
   DebugExtensionUninitialize
   a