_attaching_8c.html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">
<head>
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=11"/>
<meta name="generator" content="Doxygen 1.11.0"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<title>HyperDbg Debugger: hyperdbg/hyperkd/code/debugger/user-level/Attaching.c File Reference</title>
<link href="tabs.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="jquery.js"></script>
<script type="text/javascript" src="dynsections.js"></script>
<script type="text/javascript" src="clipboard.js"></script>
<link href="navtree.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="navtreedata.js"></script>
<script type="text/javascript" src="navtree.js"></script>
<script type="text/javascript" src="resize.js"></script>
<script type="text/javascript" src="cookie.js"></script>
<link href="search/search.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="search/searchdata.js"></script>
<script type="text/javascript" src="search/search.js"></script>
<link href="doxygen.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
<div id="titlearea">
<table cellspacing="0" cellpadding="0">
 <tbody>
 <tr id="projectrow">
  <td id="projectalign">
   <div id="projectname">HyperDbg Debugger
   </div>
  </td>
 </tr>
 </tbody>
</table>
</div>
<!-- end header part -->
<!-- Generated by Doxygen 1.11.0 -->
<script type="text/javascript">
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&amp;dn=expat.txt MIT */
var searchBox = new SearchBox("searchBox", "search/",'.html');
/* @license-end */
</script>
<script type="text/javascript">
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&amp;dn=expat.txt MIT */
$(function() { codefold.init(0); });
/* @license-end */
</script>
<script type="text/javascript" src="menudata.js"></script>
<script type="text/javascript" src="menu.js"></script>
<script type="text/javascript">
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&amp;dn=expat.txt MIT */
$(function() {
  initMenu('',true,false,'search.php','Search',true);
  $(function() { init_search(); });
});
/* @license-end */
</script>
<div id="main-nav"></div>
</div><!-- top -->
<div id="side-nav" class="ui-resizable side-nav-resizable">
  <div id="nav-tree">
    <div id="nav-tree-contents">
      <div id="nav-sync" class="sync"></div>
    </div>
  </div>
  <div id="splitbar" style="-moz-user-select:none;" 
       class="ui-resizable-handle">
  </div>
</div>
<script type="text/javascript">
/* @license magnet:?xt=urn:btih:d3d9a9a6595521f9666a5e94cc830dab83b65699&amp;dn=expat.txt MIT */
$(function(){initNavTree('_attaching_8c.html',''); initResizable(true); });
/* @license-end */
</script>
<div id="doc-content">
<!-- window showing the filter options -->
<div id="MSearchSelectWindow"
     onmouseover="return searchBox.OnSearchSelectShow()"
     onmouseout="return searchBox.OnSearchSelectHide()"
     onkeydown="return searchBox.OnSearchSelectKey(event)">
</div>

<!-- iframe showing the search results (closed by default) -->
<div id="MSearchResultsWindow">
<div id="MSearchResults">
<div class="SRPage">
<div id="SRIndex">
<div id="SRResults"></div>
<div class="SRStatus" id="Loading">Loading...</div>
<div class="SRStatus" id="Searching">Searching...</div>
<div class="SRStatus" id="NoMatches">No Matches</div>
</div>
</div>
</div>
</div>

<div class="header">
  <div class="summary">
<a href="#func-members">Functions</a>  </div>
  <div class="headertitle"><div class="title">Attaching.c File Reference</div></div>
</div><!--header-->
<div class="contents">

<p>Attaching and detaching for debugging user-mode processes.  
<a href="#details">More...</a></p>
<div class="textblock"><code>#include &quot;pch.h&quot;</code><br />
</div><table class="memberdecls">
<tr class="heading"><td colspan="2"><h2 class="groupheader"><a id="func-members" name="func-members"></a>
Functions</h2></td></tr>
<tr class="memitem:ac973601a8671bd7f982fb9f7fd13ccc4" id="r_ac973601a8671bd7f982fb9f7fd13ccc4"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#ac973601a8671bd7f982fb9f7fd13ccc4">AttachingInitialize</a> ()</td></tr>
<tr class="memdesc:ac973601a8671bd7f982fb9f7fd13ccc4"><td class="mdescLeft">&#160;</td><td class="mdescRight">Initialize the attaching mechanism.  <br /></td></tr>
<tr class="separator:ac973601a8671bd7f982fb9f7fd13ccc4"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a593f7e7ea84362b61dad501869a7b998" id="r_a593f7e7ea84362b61dad501869a7b998"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a593f7e7ea84362b61dad501869a7b998">AttachingCreateProcessDebuggingDetails</a> (<a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> ProcessId, <a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> Enabled, <a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> Is32Bit, <a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> CheckCallbackAtFirstInstruction, PEPROCESS Eprocess, <a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> PebAddressToMonitor, <a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> UsermodeReservedBuffer)</td></tr>
<tr class="memdesc:a593f7e7ea84362b61dad501869a7b998"><td class="mdescLeft">&#160;</td><td class="mdescRight">Create user-mode debugging details for threads.  <br /></td></tr>
<tr class="separator:a593f7e7ea84362b61dad501869a7b998"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:ab826f65586e0a294b97e505c6affe8b5" id="r_ab826f65586e0a294b97e505c6affe8b5"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#ab826f65586e0a294b97e505c6affe8b5">AttachingFindProcessDebuggingDetailsByToken</a> (<a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> Token)</td></tr>
<tr class="memdesc:ab826f65586e0a294b97e505c6affe8b5"><td class="mdescLeft">&#160;</td><td class="mdescRight">Find user-mode debugging details for threads by token.  <br /></td></tr>
<tr class="separator:ab826f65586e0a294b97e505c6affe8b5"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a733d0f343ddcccaeec221bbbb20483c7" id="r_a733d0f343ddcccaeec221bbbb20483c7"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a> (<a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> ProcessId)</td></tr>
<tr class="memdesc:a733d0f343ddcccaeec221bbbb20483c7"><td class="mdescLeft">&#160;</td><td class="mdescRight">Find user-mode debugging details for threads by process Id.  <br /></td></tr>
<tr class="separator:a733d0f343ddcccaeec221bbbb20483c7"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a0890d6e4aaf7fd8bdb1663697ed6b717" id="r_a0890d6e4aaf7fd8bdb1663697ed6b717"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a0890d6e4aaf7fd8bdb1663697ed6b717">AttachingFindProcessDebuggingDetailsInStartingPhase</a> ()</td></tr>
<tr class="memdesc:a0890d6e4aaf7fd8bdb1663697ed6b717"><td class="mdescLeft">&#160;</td><td class="mdescRight">Find user-mode debugging details for threads that is in the start-up phase.  <br /></td></tr>
<tr class="separator:a0890d6e4aaf7fd8bdb1663697ed6b717"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:ad16b106f9f7b6a857bafc12252bcfadd" id="r_ad16b106f9f7b6a857bafc12252bcfadd"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a7f319bfc2492a2136964194204e7a8cf">VOID</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#ad16b106f9f7b6a857bafc12252bcfadd">AttachingRemoveAndFreeAllProcessDebuggingDetails</a> ()</td></tr>
<tr class="memdesc:ad16b106f9f7b6a857bafc12252bcfadd"><td class="mdescLeft">&#160;</td><td class="mdescRight">Remove and deallocate all thread debuggig details.  <br /></td></tr>
<tr class="separator:ad16b106f9f7b6a857bafc12252bcfadd"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:aaadea1225d670dcdb595dafb4f8e6022" id="r_aaadea1225d670dcdb595dafb4f8e6022"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a> (<a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> Token)</td></tr>
<tr class="memdesc:aaadea1225d670dcdb595dafb4f8e6022"><td class="mdescLeft">&#160;</td><td class="mdescRight">Remove user-mode debugging details for threads by its token.  <br /></td></tr>
<tr class="separator:aaadea1225d670dcdb595dafb4f8e6022"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a3d3e20ec99d70f3b498c332625729a3d" id="r_a3d3e20ec99d70f3b498c332625729a3d"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a3d3e20ec99d70f3b498c332625729a3d">AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken</a> (<a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> Set, <a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> Token)</td></tr>
<tr class="memdesc:a3d3e20ec99d70f3b498c332625729a3d"><td class="mdescLeft">&#160;</td><td class="mdescRight">Set the start up phase of a debugging thread buffer by its token.  <br /></td></tr>
<tr class="separator:a3d3e20ec99d70f3b498c332625729a3d"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:afb4b04c662929a9dc3b74b45b634aff4" id="r_afb4b04c662929a9dc3b74b45b634aff4"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#afb4b04c662929a9dc3b74b45b634aff4">AttachingReachedToValidLoadedModule</a> (<a class="el" href="hyperkd_2header_2debugger_2core_2_state_8h.html#aa35afece6adc9a29a7bf7a2e76476037">PROCESSOR_DEBUGGING_STATE</a> *DbgState, <a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail)</td></tr>
<tr class="memdesc:afb4b04c662929a9dc3b74b45b634aff4"><td class="mdescLeft">&#160;</td><td class="mdescRight">Handle cases where we reached to the valid loaded module The main module should be loaded once we reach to this function.  <br /></td></tr>
<tr class="separator:afb4b04c662929a9dc3b74b45b634aff4"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:adadde19c6465b57b781fff52e7f8db85" id="r_adadde19c6465b57b781fff52e7f8db85"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a7f319bfc2492a2136964194204e7a8cf">VOID</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#adadde19c6465b57b781fff52e7f8db85">AttachingHandleEntrypointInterception</a> (<a class="el" href="hyperkd_2header_2debugger_2core_2_state_8h.html#aa35afece6adc9a29a7bf7a2e76476037">PROCESSOR_DEBUGGING_STATE</a> *DbgState)</td></tr>
<tr class="memdesc:adadde19c6465b57b781fff52e7f8db85"><td class="mdescLeft">&#160;</td><td class="mdescRight">Handle the interception of finding the entrypoint on attaching to user-mode process.  <br /></td></tr>
<tr class="separator:adadde19c6465b57b781fff52e7f8db85"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a5d48d4a604f0d7effefad660da3aaf4a" id="r_a5d48d4a604f0d7effefad660da3aaf4a"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a5d48d4a604f0d7effefad660da3aaf4a">AttachingAdjustNopSledBuffer</a> (<a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> ReservedBuffAddress, <a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> ProcessId)</td></tr>
<tr class="memdesc:a5d48d4a604f0d7effefad660da3aaf4a"><td class="mdescLeft">&#160;</td><td class="mdescRight">Allocate a nop-sled buffer.  <br /></td></tr>
<tr class="separator:a5d48d4a604f0d7effefad660da3aaf4a"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:af709328759d9b5fb6d0213ee458723dd" id="r_af709328759d9b5fb6d0213ee458723dd"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#af709328759d9b5fb6d0213ee458723dd">AttachingCheckPageFaultsWithUserDebugger</a> (<a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> CoreId, <a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> <a class="el" href="_hyper_dbg_script_imports_8h.html#a3f7c5b71d899e923be0a80d4ac7902fe">Address</a>, <a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> PageFaultErrorCode)</td></tr>
<tr class="memdesc:af709328759d9b5fb6d0213ee458723dd"><td class="mdescLeft">&#160;</td><td class="mdescRight">Check page-faults with user-debugger.  <br /></td></tr>
<tr class="separator:af709328759d9b5fb6d0213ee458723dd"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a7f67611f7474cb9199c0b941fcf82a85" id="r_a7f67611f7474cb9199c0b941fcf82a85"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a7f67611f7474cb9199c0b941fcf82a85">AttachingConfigureInterceptingThreads</a> (<a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> ProcessDebuggingToken, <a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> Enable)</td></tr>
<tr class="memdesc:a7f67611f7474cb9199c0b941fcf82a85"><td class="mdescLeft">&#160;</td><td class="mdescRight">Enable or disable the thread intercepting phase.  <br /></td></tr>
<tr class="separator:a7f67611f7474cb9199c0b941fcf82a85"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a96029792901bb04ae2baa8acfacdd5a7" id="r_a96029792901bb04ae2baa8acfacdd5a7"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a96029792901bb04ae2baa8acfacdd5a7">AttachingCheckForSafeCallbackRequestedInitializations</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> AttachRequest, <a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> ProcessDebuggingToken)</td></tr>
<tr class="memdesc:a96029792901bb04ae2baa8acfacdd5a7"><td class="mdescLeft">&#160;</td><td class="mdescRight">This function checks whether any special initialization is needed while attaching to a process that requests a callback.  <br /></td></tr>
<tr class="separator:a96029792901bb04ae2baa8acfacdd5a7"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:aa2294a8797b41cc7787eeb68672689b9" id="r_aa2294a8797b41cc7787eeb68672689b9"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#aa2294a8797b41cc7787eeb68672689b9">AttachingPerformAttachToProcess</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> AttachRequest, <a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> IsAttachingToEntrypoint)</td></tr>
<tr class="memdesc:aa2294a8797b41cc7787eeb68672689b9"><td class="mdescLeft">&#160;</td><td class="mdescRight">Attach to the target process.  <br /></td></tr>
<tr class="separator:aa2294a8797b41cc7787eeb68672689b9"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a2a634f245bfc5d1ce07e9df31f37f26a" id="r_a2a634f245bfc5d1ce07e9df31f37f26a"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a2a634f245bfc5d1ce07e9df31f37f26a">AttachingHandleCr3VmexitsForThreadInterception</a> (<a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> CoreId, <a class="el" href="_basic_types_8h.html#aaeec30724d8f0c9d2acd894f41ee06fe">CR3_TYPE</a> NewCr3)</td></tr>
<tr class="memdesc:a2a634f245bfc5d1ce07e9df31f37f26a"><td class="mdescLeft">&#160;</td><td class="mdescRight">Handle the cr3 vm-exits for thread interception.  <br /></td></tr>
<tr class="separator:a2a634f245bfc5d1ce07e9df31f37f26a"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:af92565f7d626021eb2e7312480126fa5" id="r_af92565f7d626021eb2e7312480126fa5"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#af92565f7d626021eb2e7312480126fa5">AttachingCheckUnhandledEptViolation</a> (<a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> CoreId, <a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> ViolationQualification, <a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> GuestPhysicalAddr)</td></tr>
<tr class="memdesc:af92565f7d626021eb2e7312480126fa5"><td class="mdescLeft">&#160;</td><td class="mdescRight">handling unhandled EPT violations  <br /></td></tr>
<tr class="separator:af92565f7d626021eb2e7312480126fa5"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:aba0a55c32fa1b903bbb0b4408b238f62" id="r_aba0a55c32fa1b903bbb0b4408b238f62"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#aba0a55c32fa1b903bbb0b4408b238f62">AttachingRemoveHooks</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> AttachRequest)</td></tr>
<tr class="memdesc:aba0a55c32fa1b903bbb0b4408b238f62"><td class="mdescLeft">&#160;</td><td class="mdescRight">Clearing hooks after resuming the process.  <br /></td></tr>
<tr class="separator:aba0a55c32fa1b903bbb0b4408b238f62"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:aa9fb4120d9e11c187b7a722ba6c7818c" id="r_aa9fb4120d9e11c187b7a722ba6c7818c"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#aa9fb4120d9e11c187b7a722ba6c7818c">AttachingPauseProcess</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> PauseRequest)</td></tr>
<tr class="memdesc:aa9fb4120d9e11c187b7a722ba6c7818c"><td class="mdescLeft">&#160;</td><td class="mdescRight">Pauses the target process.  <br /></td></tr>
<tr class="separator:aa9fb4120d9e11c187b7a722ba6c7818c"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:ae631c2803c19685c4517a36470b7f169" id="r_ae631c2803c19685c4517a36470b7f169"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#ae631c2803c19685c4517a36470b7f169">AttachingKillProcess</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> KillRequest)</td></tr>
<tr class="memdesc:ae631c2803c19685c4517a36470b7f169"><td class="mdescLeft">&#160;</td><td class="mdescRight">Kill the target process from kernel-mode.  <br /></td></tr>
<tr class="separator:ae631c2803c19685c4517a36470b7f169"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a8f5b7ae763989ea4c219eada9c8889c6" id="r_a8f5b7ae763989ea4c219eada9c8889c6"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a8f5b7ae763989ea4c219eada9c8889c6">AttachingPerformDetach</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> DetachRequest)</td></tr>
<tr class="memdesc:a8f5b7ae763989ea4c219eada9c8889c6"><td class="mdescLeft">&#160;</td><td class="mdescRight">Clearing hooks after resuming the process.  <br /></td></tr>
<tr class="separator:a8f5b7ae763989ea4c219eada9c8889c6"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a7275aab09d377c86c14c6a7613897597" id="r_a7275aab09d377c86c14c6a7613897597"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a7275aab09d377c86c14c6a7613897597">AttachingSwitchProcess</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> SwitchRequest)</td></tr>
<tr class="memdesc:a7275aab09d377c86c14c6a7613897597"><td class="mdescLeft">&#160;</td><td class="mdescRight">Switch to the target thread.  <br /></td></tr>
<tr class="separator:a7275aab09d377c86c14c6a7613897597"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:aab87bdbf88894b1c9986c88a16298e38" id="r_aab87bdbf88894b1c9986c88a16298e38"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#aab87bdbf88894b1c9986c88a16298e38">AttachingQueryCountOfActiveDebuggingThreadsAndProcesses</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> QueryCountOfDebugThreadsRequest)</td></tr>
<tr class="memdesc:aab87bdbf88894b1c9986c88a16298e38"><td class="mdescLeft">&#160;</td><td class="mdescRight">Query count of active debugging threads.  <br /></td></tr>
<tr class="separator:aab87bdbf88894b1c9986c88a16298e38"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a640e936614ebe9a68cf54e78f7d8f323" id="r_a640e936614ebe9a68cf54e78f7d8f323"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a640e936614ebe9a68cf54e78f7d8f323">AttachingQueryDetailsOfActiveDebuggingThreadsAndProcesses</a> (PVOID BufferToStoreDetails, <a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> BufferSize)</td></tr>
<tr class="memdesc:a640e936614ebe9a68cf54e78f7d8f323"><td class="mdescLeft">&#160;</td><td class="mdescRight">Query details of active debugging threads.  <br /></td></tr>
<tr class="separator:a640e936614ebe9a68cf54e78f7d8f323"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a6fba37d8db6966c26c921887bcf11656" id="r_a6fba37d8db6966c26c921887bcf11656"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_basic_types_8h.html#a7f319bfc2492a2136964194204e7a8cf">VOID</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="#a6fba37d8db6966c26c921887bcf11656">AttachingTargetProcess</a> (<a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a> Request)</td></tr>
<tr class="memdesc:a6fba37d8db6966c26c921887bcf11656"><td class="mdescLeft">&#160;</td><td class="mdescRight">Dispatch and perform attaching tasks.  <br /></td></tr>
<tr class="separator:a6fba37d8db6966c26c921887bcf11656"><td class="memSeparator" colspan="2">&#160;</td></tr>
</table>
<a name="details" id="details"></a><h2 class="groupheader">Detailed Description</h2>
<div class="textblock"><p>Attaching and detaching for debugging user-mode processes. </p>
<dl class="section author"><dt>Author</dt><dd>Sina Karvandi (<a href="#" onclick="location.href='mai'+'lto:'+'sin'+'a@'+'hyp'+'er'+'dbg'+'.o'+'rg'; return false;">sina@<span class="obfuscator">.nosp@m.</span>hype<span class="obfuscator">.nosp@m.</span>rdbg.<span class="obfuscator">.nosp@m.</span>org</a>)</dd></dl>
<dl class="section version"><dt>Version</dt><dd>0.1 </dd></dl>
<dl class="section date"><dt>Date</dt><dd>2021-12-28</dd></dl>
<dl class="section copyright"><dt>Copyright</dt><dd>This project is released under the GNU Public License v3. </dd></dl>
</div><h2 class="groupheader">Function Documentation</h2>
<a id="a5d48d4a604f0d7effefad660da3aaf4a" name="a5d48d4a604f0d7effefad660da3aaf4a"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a5d48d4a604f0d7effefad660da3aaf4a">&#9670;&#160;</a></span>AttachingAdjustNopSledBuffer()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingAdjustNopSledBuffer </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>ReservedBuffAddress</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>ProcessId</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Allocate a nop-sled buffer. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">ReservedBuffAddress</td><td></td></tr>
    <tr><td class="paramname">ProcessId</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  558</span>{</div>
<div class="line"><span class="lineno">  559</span>    PEPROCESS  SourceProcess;</div>
<div class="line"><span class="lineno">  560</span>    KAPC_STATE State = {0};</div>
<div class="line"><span class="lineno">  561</span> </div>
<div class="line"><span class="lineno">  562</span>    <span class="keywordflow">if</span> (PsLookupProcessByProcessId((HANDLE)ProcessId, &amp;SourceProcess) != STATUS_SUCCESS)</div>
<div class="line"><span class="lineno">  563</span>    {</div>
<div class="line"><span class="lineno">  564</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  565</span>        <span class="comment">// if the process not found</span></div>
<div class="line"><span class="lineno">  566</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  567</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  568</span>    }</div>
<div class="line"><span class="lineno">  569</span> </div>
<div class="line"><span class="lineno">  570</span>    __try</div>
<div class="line"><span class="lineno">  571</span>    {</div>
<div class="line"><span class="lineno">  572</span>        KeStackAttachProcess(SourceProcess, &amp;State);</div>
<div class="line"><span class="lineno">  573</span> </div>
<div class="line"><span class="lineno">  574</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  575</span>        <span class="comment">// Fill the memory with nops</span></div>
<div class="line"><span class="lineno">  576</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  577</span>        memset((<span class="keywordtype">void</span> *)ReservedBuffAddress, 0x90, <a class="code hl_define" href="libhyperdbg_2header_2_common_8h.html#a7d467c1d283fdfa1f2081ba1e0d01b6e">PAGE_SIZE</a>);</div>
<div class="line"><span class="lineno">  578</span> </div>
<div class="line"><span class="lineno">  579</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  580</span>        <span class="comment">// Set jmps to form a loop (little endians)</span></div>
<div class="line"><span class="lineno">  581</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  582</span>        <span class="comment">// Disassembly of section .text:</span></div>
<div class="line"><span class="lineno">  583</span>        <span class="comment">// 0000000000000000 &lt;NopLoop&gt;:</span></div>
<div class="line"><span class="lineno">  584</span>        <span class="comment">// 0:  90                      nop</span></div>
<div class="line"><span class="lineno">  585</span>        <span class="comment">// 1:  90                      nop</span></div>
<div class="line"><span class="lineno">  586</span>        <span class="comment">// 2:  90                      nop</span></div>
<div class="line"><span class="lineno">  587</span>        <span class="comment">// 3:  90                      nop</span></div>
<div class="line"><span class="lineno">  588</span>        <span class="comment">// 4:  90                      nop</span></div>
<div class="line"><span class="lineno">  589</span>        <span class="comment">// 5:  90                      nop</span></div>
<div class="line"><span class="lineno">  590</span>        <span class="comment">// 6:  90                      nop</span></div>
<div class="line"><span class="lineno">  591</span>        <span class="comment">// 7:  90                      nop</span></div>
<div class="line"><span class="lineno">  592</span>        <span class="comment">// 8:  0f a2                   cpuid</span></div>
<div class="line"><span class="lineno">  593</span>        <span class="comment">// a:  eb f4                   jmp    0 &lt;NopLoop&gt;</span></div>
<div class="line"><span class="lineno">  594</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  595</span>        *(<a class="code hl_typedef" href="_basic_types_8h.html#a09f1a1fb2293e33483cc8d44aefb1eb1">UINT16</a> *)(ReservedBuffAddress + <a class="code hl_define" href="libhyperdbg_2header_2_common_8h.html#a7d467c1d283fdfa1f2081ba1e0d01b6e">PAGE_SIZE</a> - 4) = 0xa20f;</div>
<div class="line"><span class="lineno">  596</span>        *(<a class="code hl_typedef" href="_basic_types_8h.html#a09f1a1fb2293e33483cc8d44aefb1eb1">UINT16</a> *)(ReservedBuffAddress + <a class="code hl_define" href="libhyperdbg_2header_2_common_8h.html#a7d467c1d283fdfa1f2081ba1e0d01b6e">PAGE_SIZE</a> - 2) = 0xf4eb;</div>
<div class="line"><span class="lineno">  597</span> </div>
<div class="line"><span class="lineno">  598</span>        KeUnstackDetachProcess(&amp;State);</div>
<div class="line"><span class="lineno">  599</span> </div>
<div class="line"><span class="lineno">  600</span>        ObDereferenceObject(SourceProcess);</div>
<div class="line"><span class="lineno">  601</span>    }</div>
<div class="line"><span class="lineno">  602</span>    __except (EXCEPTION_EXECUTE_HANDLER)</div>
<div class="line"><span class="lineno">  603</span>    {</div>
<div class="line"><span class="lineno">  604</span>        KeUnstackDetachProcess(&amp;State);</div>
<div class="line"><span class="lineno">  605</span> </div>
<div class="line"><span class="lineno">  606</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  607</span>    }</div>
<div class="line"><span class="lineno">  608</span> </div>
<div class="line"><span class="lineno">  609</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  610</span>}</div>
<div class="ttc" id="a_basic_types_8h_html_a09f1a1fb2293e33483cc8d44aefb1eb1"><div class="ttname"><a href="_basic_types_8h.html#a09f1a1fb2293e33483cc8d44aefb1eb1">UINT16</a></div><div class="ttdeci">unsigned short UINT16</div><div class="ttdef"><b>Definition</b> BasicTypes.h:47</div></div>
<div class="ttc" id="a_basic_types_8h_html_aa8cecfc5c5c054d2875c03e77b7be15d"><div class="ttname"><a href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a></div><div class="ttdeci">#define TRUE</div><div class="ttdef"><b>Definition</b> BasicTypes.h:55</div></div>
<div class="ttc" id="a_basic_types_8h_html_aa93f0eb578d23995850d61f7d61c55c1"><div class="ttname"><a href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a></div><div class="ttdeci">#define FALSE</div><div class="ttdef"><b>Definition</b> BasicTypes.h:54</div></div>
<div class="ttc" id="alibhyperdbg_2header_2_common_8h_html_a7d467c1d283fdfa1f2081ba1e0d01b6e"><div class="ttname"><a href="libhyperdbg_2header_2_common_8h.html#a7d467c1d283fdfa1f2081ba1e0d01b6e">PAGE_SIZE</a></div><div class="ttdeci">#define PAGE_SIZE</div><div class="ttdoc">Size of each page (4096 bytes)</div><div class="ttdef"><b>Definition</b> common.h:69</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="a96029792901bb04ae2baa8acfacdd5a7" name="a96029792901bb04ae2baa8acfacdd5a7"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a96029792901bb04ae2baa8acfacdd5a7">&#9670;&#160;</a></span>AttachingCheckForSafeCallbackRequestedInitializations()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingCheckForSafeCallbackRequestedInitializations </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>AttachRequest</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>ProcessDebuggingToken</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>This function checks whether any special initialization is needed while attaching to a process that requests a callback. </p>
<p>this function should not be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">AttachRequest</td><td></td></tr>
    <tr><td class="paramname">ProcessDebuggingToken</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  787</span>{</div>
<div class="line"><span class="lineno">  788</span>    UNREFERENCED_PARAMETER(AttachRequest);</div>
<div class="line"><span class="lineno">  789</span>    UNREFERENCED_PARAMETER(ProcessDebuggingToken);</div>
<div class="line"><span class="lineno">  790</span> </div>
<div class="line"><span class="lineno">  791</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  792</span>    <span class="comment">// Enable the memory access logging</span></div>
<div class="line"><span class="lineno">  793</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  794</span>    <a class="code hl_function" href="_configuration_8c.html#a1b26f0e861226a28347668799ce3f45e">ConfigureInitializeExecTrapOnAllProcessors</a>();</div>
<div class="line"><span class="lineno">  795</span> </div>
<div class="line"><span class="lineno">  796</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  797</span>}</div>
<div class="ttc" id="a_configuration_8c_html_a1b26f0e861226a28347668799ce3f45e"><div class="ttname"><a href="_configuration_8c.html#a1b26f0e861226a28347668799ce3f45e">ConfigureInitializeExecTrapOnAllProcessors</a></div><div class="ttdeci">BOOLEAN ConfigureInitializeExecTrapOnAllProcessors()</div><div class="ttdoc">routines for initializing user-mode, kernel-mode exec trap</div><div class="ttdef"><b>Definition</b> Configuration.c:37</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="af709328759d9b5fb6d0213ee458723dd" name="af709328759d9b5fb6d0213ee458723dd"></a>
<h2 class="memtitle"><span class="permalink"><a href="#af709328759d9b5fb6d0213ee458723dd">&#9670;&#160;</a></span>AttachingCheckPageFaultsWithUserDebugger()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingCheckPageFaultsWithUserDebugger </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>CoreId</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>Address</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>PageFaultErrorCode</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Check page-faults with user-debugger. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">CoreId</td><td></td></tr>
    <tr><td class="paramname">Address</td><td></td></tr>
    <tr><td class="paramname">PageFaultErrorCode</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN if TRUE show that the page-fault injection should be ignored </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  624</span>{</div>
<div class="line"><span class="lineno">  625</span>    UNREFERENCED_PARAMETER(<a class="code hl_variable" href="_hyper_dbg_script_imports_8h.html#a3f7c5b71d899e923be0a80d4ac7902fe">Address</a>);</div>
<div class="line"><span class="lineno">  626</span>    UNREFERENCED_PARAMETER(PageFaultErrorCode);</div>
<div class="line"><span class="lineno">  627</span> </div>
<div class="line"><span class="lineno">  628</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail;</div>
<div class="line"><span class="lineno">  629</span>    <a class="code hl_struct" href="struct___p_r_o_c_e_s_s_o_r___d_e_b_u_g_g_i_n_g___s_t_a_t_e.html">PROCESSOR_DEBUGGING_STATE</a> *         DbgState = &amp;<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a349ee1adc363d2e4323a35a68fae5646">g_DbgState</a>[CoreId];</div>
<div class="line"><span class="lineno">  630</span> </div>
<div class="line"><span class="lineno">  631</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  632</span>    <span class="comment">// Check whether user-debugger is initialized or not</span></div>
<div class="line"><span class="lineno">  633</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  634</span>    <span class="keywordflow">if</span> (<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae304ded1a8cbb4e772d97aec7510c9d2">g_UserDebuggerState</a> == <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>)</div>
<div class="line"><span class="lineno">  635</span>    {</div>
<div class="line"><span class="lineno">  636</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  637</span>    }</div>
<div class="line"><span class="lineno">  638</span> </div>
<div class="line"><span class="lineno">  639</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  640</span>    <span class="comment">// Check if thread is in user-mode</span></div>
<div class="line"><span class="lineno">  641</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  642</span>    <span class="keywordflow">if</span> (<a class="code hl_function" href="_export_8c.html#ab49740d6ce5d1c5f90828b66496dcb4c">VmFuncGetLastVmexitRip</a>(CoreId) &amp; 0xf000000000000000)</div>
<div class="line"><span class="lineno">  643</span>    {</div>
<div class="line"><span class="lineno">  644</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  645</span>        <span class="comment">// We won&#39;t intercept threads in kernel-mode</span></div>
<div class="line"><span class="lineno">  646</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  647</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  648</span>    }</div>
<div class="line"><span class="lineno">  649</span> </div>
<div class="line"><span class="lineno">  650</span>    ProcessDebuggingDetail = <a class="code hl_function" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a>(<a class="code hl_define" href="_meta_macros_8h.html#ad790279846c85a5a453f2e7a4e02abad">HANDLE_TO_UINT32</a>(PsGetCurrentProcessId()));</div>
<div class="line"><span class="lineno">  651</span> </div>
<div class="line"><span class="lineno">  652</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetail)</div>
<div class="line"><span class="lineno">  653</span>    {</div>
<div class="line"><span class="lineno">  654</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  655</span>        <span class="comment">// not related to user debugger</span></div>
<div class="line"><span class="lineno">  656</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  657</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  658</span>    }</div>
<div class="line"><span class="lineno">  659</span> </div>
<div class="line"><span class="lineno">  660</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  661</span>    <span class="comment">// Check if thread is in intercepting phase</span></div>
<div class="line"><span class="lineno">  662</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  663</span>    <span class="keywordflow">if</span> (ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ad3d6574cef84c00d549493d88c62e68f">IsOnThreadInterceptingPhase</a>)</div>
<div class="line"><span class="lineno">  664</span>    {</div>
<div class="line"><span class="lineno">  665</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  666</span>        <span class="comment">// Handling state through the user-mode debugger</span></div>
<div class="line"><span class="lineno">  667</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  668</span>        <a class="code hl_function" href="_ud_8c.html#a5ebe34618715108270c71344983e4af3">UdCheckAndHandleBreakpointsAndDebugBreaks</a>(DbgState,</div>
<div class="line"><span class="lineno">  669</span>                                                  <a class="code hl_enumvalue" href="_connection_8h.html#a6e2be89205e735ebae644cf4850ac21ba1d3a5d418b8e74a9d4fae15b9db0f9cd">DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED</a>,</div>
<div class="line"><span class="lineno">  670</span>                                                  NULL);</div>
<div class="line"><span class="lineno">  671</span> </div>
<div class="line"><span class="lineno">  672</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  673</span>        <span class="comment">// related to user debugger</span></div>
<div class="line"><span class="lineno">  674</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  675</span>        <a class="code hl_function" href="_export_8c.html#ad357512be8732352fac0e4a03676e458">VmFuncSuppressRipIncrement</a>(CoreId);</div>
<div class="line"><span class="lineno">  676</span> </div>
<div class="line"><span class="lineno">  677</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  678</span>    }</div>
<div class="line"><span class="lineno">  679</span> </div>
<div class="line"><span class="lineno">  680</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  681</span>    <span class="comment">// this thread is not in intercepting phase</span></div>
<div class="line"><span class="lineno">  682</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  683</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  684</span>}</div>
<div class="ttc" id="a_attaching_8c_html_a733d0f343ddcccaeec221bbbb20483c7"><div class="ttname"><a href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a></div><div class="ttdeci">PUSERMODE_DEBUGGING_PROCESS_DETAILS AttachingFindProcessDebuggingDetailsByProcessId(UINT32 ProcessId)</div><div class="ttdoc">Find user-mode debugging details for threads by process Id.</div><div class="ttdef"><b>Definition</b> Attaching.c:187</div></div>
<div class="ttc" id="a_connection_8h_html_a6e2be89205e735ebae644cf4850ac21ba1d3a5d418b8e74a9d4fae15b9db0f9cd"><div class="ttname"><a href="_connection_8h.html#a6e2be89205e735ebae644cf4850ac21ba1d3a5d418b8e74a9d4fae15b9db0f9cd">DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED</a></div><div class="ttdeci">@ DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED</div><div class="ttdef"><b>Definition</b> Connection.h:42</div></div>
<div class="ttc" id="a_export_8c_html_ab49740d6ce5d1c5f90828b66496dcb4c"><div class="ttname"><a href="_export_8c.html#ab49740d6ce5d1c5f90828b66496dcb4c">VmFuncGetLastVmexitRip</a></div><div class="ttdeci">UINT64 VmFuncGetLastVmexitRip(UINT32 CoreId)</div><div class="ttdoc">get the last vm-exit RIP</div><div class="ttdef"><b>Definition</b> Export.c:318</div></div>
<div class="ttc" id="a_export_8c_html_ad357512be8732352fac0e4a03676e458"><div class="ttname"><a href="_export_8c.html#ad357512be8732352fac0e4a03676e458">VmFuncSuppressRipIncrement</a></div><div class="ttdeci">VOID VmFuncSuppressRipIncrement(UINT32 CoreId)</div><div class="ttdoc">Suppress the incrementation of RIP.</div><div class="ttdef"><b>Definition</b> Export.c:34</div></div>
<div class="ttc" id="a_hyper_dbg_script_imports_8h_html_a3f7c5b71d899e923be0a80d4ac7902fe"><div class="ttname"><a href="_hyper_dbg_script_imports_8h.html#a3f7c5b71d899e923be0a80d4ac7902fe">Address</a></div><div class="ttdeci">UINT64 Address</div><div class="ttdef"><b>Definition</b> HyperDbgScriptImports.h:67</div></div>
<div class="ttc" id="a_meta_macros_8h_html_ad790279846c85a5a453f2e7a4e02abad"><div class="ttname"><a href="_meta_macros_8h.html#ad790279846c85a5a453f2e7a4e02abad">HANDLE_TO_UINT32</a></div><div class="ttdeci">#define HANDLE_TO_UINT32(_var)</div><div class="ttdef"><b>Definition</b> MetaMacros.h:39</div></div>
<div class="ttc" id="a_ud_8c_html_a5ebe34618715108270c71344983e4af3"><div class="ttname"><a href="_ud_8c.html#a5ebe34618715108270c71344983e4af3">UdCheckAndHandleBreakpointsAndDebugBreaks</a></div><div class="ttdeci">BOOLEAN UdCheckAndHandleBreakpointsAndDebugBreaks(PROCESSOR_DEBUGGING_STATE *DbgState, DEBUGGEE_PAUSING_REASON Reason, PDEBUGGER_TRIGGERED_EVENT_DETAILS EventDetails)</div><div class="ttdoc">Handle #DBs and #BPs for kernel debugger.</div><div class="ttdef"><b>Definition</b> Ud.c:443</div></div>
<div class="ttc" id="ahyperkd_2header_2globals_2_global_8h_html_a349ee1adc363d2e4323a35a68fae5646"><div class="ttname"><a href="hyperkd_2header_2globals_2_global_8h.html#a349ee1adc363d2e4323a35a68fae5646">g_DbgState</a></div><div class="ttdeci">PROCESSOR_DEBUGGING_STATE * g_DbgState</div><div class="ttdoc">Save the state and variables related to debugging on each to logical core.</div><div class="ttdef"><b>Definition</b> Global.h:17</div></div>
<div class="ttc" id="ahyperkd_2header_2globals_2_global_8h_html_ae304ded1a8cbb4e772d97aec7510c9d2"><div class="ttname"><a href="hyperkd_2header_2globals_2_global_8h.html#ae304ded1a8cbb4e772d97aec7510c9d2">g_UserDebuggerState</a></div><div class="ttdeci">BOOLEAN g_UserDebuggerState</div><div class="ttdoc">shows whether the user debugger is enabled or disabled</div><div class="ttdef"><b>Definition</b> Global.h:109</div></div>
<div class="ttc" id="astruct___p_r_o_c_e_s_s_o_r___d_e_b_u_g_g_i_n_g___s_t_a_t_e_html"><div class="ttname"><a href="struct___p_r_o_c_e_s_s_o_r___d_e_b_u_g_g_i_n_g___s_t_a_t_e.html">_PROCESSOR_DEBUGGING_STATE</a></div><div class="ttdoc">Saves the debugger state.</div><div class="ttdef"><b>Definition</b> State.h:165</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">_USERMODE_DEBUGGING_PROCESS_DETAILS</a></div><div class="ttdoc">Description of each active thread in user-mode attaching mechanism.</div><div class="ttdef"><b>Definition</b> Attaching.h:49</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_ad3d6574cef84c00d549493d88c62e68f"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ad3d6574cef84c00d549493d88c62e68f">_USERMODE_DEBUGGING_PROCESS_DETAILS::IsOnThreadInterceptingPhase</a></div><div class="ttdeci">BOOLEAN IsOnThreadInterceptingPhase</div><div class="ttdef"><b>Definition</b> Attaching.h:64</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="af92565f7d626021eb2e7312480126fa5" name="af92565f7d626021eb2e7312480126fa5"></a>
<h2 class="memtitle"><span class="permalink"><a href="#af92565f7d626021eb2e7312480126fa5">&#9670;&#160;</a></span>AttachingCheckUnhandledEptViolation()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingCheckUnhandledEptViolation </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>CoreId</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>ViolationQualification</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>GuestPhysicalAddr</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>handling unhandled EPT violations </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">CoreId</td><td></td></tr>
    <tr><td class="paramname">ViolationQualification</td><td></td></tr>
    <tr><td class="paramname">GuestPhysicalAddr</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1105</span>{</div>
<div class="line"><span class="lineno"> 1106</span>    UNREFERENCED_PARAMETER(CoreId);</div>
<div class="line"><span class="lineno"> 1107</span>    UNREFERENCED_PARAMETER(ViolationQualification);</div>
<div class="line"><span class="lineno"> 1108</span>    UNREFERENCED_PARAMETER(GuestPhysicalAddr);</div>
<div class="line"><span class="lineno"> 1109</span> </div>
<div class="line"><span class="lineno"> 1110</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1111</span>    <span class="comment">// Not handled here</span></div>
<div class="line"><span class="lineno"> 1112</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1113</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1114</span>}</div>
</div><!-- fragment -->
</div>
</div>
<a id="a7f67611f7474cb9199c0b941fcf82a85" name="a7f67611f7474cb9199c0b941fcf82a85"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a7f67611f7474cb9199c0b941fcf82a85">&#9670;&#160;</a></span>AttachingConfigureInterceptingThreads()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingConfigureInterceptingThreads </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>ProcessDebuggingToken</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a></td>          <td class="paramname"><span class="paramname"><em>Enable</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Enable or disable the thread intercepting phase. </p>
<p>this function should be called in vmx non-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">ProcessDebuggingToken</td><td></td></tr>
    <tr><td class="paramname">Enable</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  696</span>{</div>
<div class="line"><span class="lineno">  697</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail;</div>
<div class="line"><span class="lineno">  698</span> </div>
<div class="line"><span class="lineno">  699</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  700</span>    <span class="comment">// Get the current process debugging detail</span></div>
<div class="line"><span class="lineno">  701</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  702</span>    ProcessDebuggingDetail = <a class="code hl_function" href="#ab826f65586e0a294b97e505c6affe8b5">AttachingFindProcessDebuggingDetailsByToken</a>(ProcessDebuggingToken);</div>
<div class="line"><span class="lineno">  703</span> </div>
<div class="line"><span class="lineno">  704</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetail)</div>
<div class="line"><span class="lineno">  705</span>    {</div>
<div class="line"><span class="lineno">  706</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  707</span>    }</div>
<div class="line"><span class="lineno">  708</span> </div>
<div class="line"><span class="lineno">  709</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  710</span>    <span class="comment">// If the thread is already in intercepting phase, we should return,</span></div>
<div class="line"><span class="lineno">  711</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  712</span>    <span class="keywordflow">if</span> (Enable &amp;&amp; ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ad3d6574cef84c00d549493d88c62e68f">IsOnThreadInterceptingPhase</a>)</div>
<div class="line"><span class="lineno">  713</span>    {</div>
<div class="line"><span class="lineno">  714</span>        <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a>(<span class="stringliteral">&quot;Err, thread is already in intercepting phase&quot;</span>);</div>
<div class="line"><span class="lineno">  715</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  716</span>    }</div>
<div class="line"><span class="lineno">  717</span> </div>
<div class="line"><span class="lineno">  718</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  719</span>    <span class="comment">// if the user want to disable the intercepting phase, we just ignore the</span></div>
<div class="line"><span class="lineno">  720</span>    <span class="comment">// request without a message</span></div>
<div class="line"><span class="lineno">  721</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  722</span>    <span class="keywordflow">if</span> (!Enable &amp;&amp; !ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ad3d6574cef84c00d549493d88c62e68f">IsOnThreadInterceptingPhase</a>)</div>
<div class="line"><span class="lineno">  723</span>    {</div>
<div class="line"><span class="lineno">  724</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  725</span>    }</div>
<div class="line"><span class="lineno">  726</span> </div>
<div class="line"><span class="lineno">  727</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  728</span>    <span class="comment">// We&#39;re or we&#39;re not in thread intercepting phase now</span></div>
<div class="line"><span class="lineno">  729</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  730</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ad3d6574cef84c00d549493d88c62e68f">IsOnThreadInterceptingPhase</a> = Enable;</div>
<div class="line"><span class="lineno">  731</span> </div>
<div class="line"><span class="lineno">  732</span>    <span class="keywordflow">if</span> (Enable)</div>
<div class="line"><span class="lineno">  733</span>    {</div>
<div class="line"><span class="lineno">  734</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  735</span>        <span class="comment">// Intercept all mov 2 cr3s</span></div>
<div class="line"><span class="lineno">  736</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  737</span>        <a class="code hl_function" href="_debugger_events_8c.html#a9fc0885a9799673255c0e61a4bf34a59">DebuggerEventEnableMovToCr3ExitingOnAllProcessors</a>();</div>
<div class="line"><span class="lineno">  738</span>    }</div>
<div class="line"><span class="lineno">  739</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno">  740</span>    {</div>
<div class="line"><span class="lineno">  741</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  742</span>        <span class="comment">// Removing the mov to cr3 vm-exits</span></div>
<div class="line"><span class="lineno">  743</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  744</span>        <a class="code hl_function" href="_debugger_events_8c.html#a29eb984baceb23c7c2a01cc947d4fe09">DebuggerEventDisableMovToCr3ExitingOnAllProcessors</a>();</div>
<div class="line"><span class="lineno">  745</span>    }</div>
<div class="line"><span class="lineno">  746</span> </div>
<div class="line"><span class="lineno">  747</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  748</span>    <span class="comment">// Set the supervisor bit to 1 when we want to continue all the threads</span></div>
<div class="line"><span class="lineno">  749</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  750</span>    <span class="keywordflow">if</span> (!Enable)</div>
<div class="line"><span class="lineno">  751</span>    {</div>
<div class="line"><span class="lineno">  752</span>        <span class="keywordflow">for</span> (<span class="keywordtype">size_t</span> i = 0; i &lt; <a class="code hl_define" href="_attaching_8h.html#a829d27c9709ca2e1f18c2b8661652b41">MAX_CR3_IN_A_PROCESS</a>; i++)</div>
<div class="line"><span class="lineno">  753</span>        {</div>
<div class="line"><span class="lineno">  754</span>            <span class="keywordflow">if</span> (ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#a03824d851e6ed19772d65969892f267e">InterceptedCr3</a>[i].<a class="code hl_variable" href="struct___c_r3___t_y_p_e.html#a04eb96cc99b0458be739bcc9c640e08b">Flags</a> != (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)NULL)</div>
<div class="line"><span class="lineno">  755</span>            {</div>
<div class="line"><span class="lineno">  756</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  757</span>                <span class="comment">// This cr3 should not be intercepted on threads&#39; user mode execution</span></div>
<div class="line"><span class="lineno">  758</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  759</span>                <span class="keywordflow">if</span> (!<a class="code hl_function" href="_memory_mapper_8c.html#ae48f36c16e0f72dfb25560c01b19423d">MemoryMapperSetSupervisorBitWithoutSwitchingByCr3</a>(NULL,</div>
<div class="line"><span class="lineno">  760</span>                                                                       <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>,</div>
<div class="line"><span class="lineno">  761</span>                                                                       <a class="code hl_enumvalue" href="_data_types_8h.html#a0e279f80607c232e77080fd6ab7efb90a9f4053f14ec81e29707f1ec4cec0659e">PagingLevelPageMapLevel4</a>,</div>
<div class="line"><span class="lineno">  762</span>                                                                       ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#a03824d851e6ed19772d65969892f267e">InterceptedCr3</a>[i]))</div>
<div class="line"><span class="lineno">  763</span>                {</div>
<div class="line"><span class="lineno">  764</span>                    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  765</span>                }</div>
<div class="line"><span class="lineno">  766</span>            }</div>
<div class="line"><span class="lineno">  767</span>        }</div>
<div class="line"><span class="lineno">  768</span>    }</div>
<div class="line"><span class="lineno">  769</span> </div>
<div class="line"><span class="lineno">  770</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  771</span>}</div>
<div class="ttc" id="a_attaching_8c_html_ab826f65586e0a294b97e505c6affe8b5"><div class="ttname"><a href="#ab826f65586e0a294b97e505c6affe8b5">AttachingFindProcessDebuggingDetailsByToken</a></div><div class="ttdeci">PUSERMODE_DEBUGGING_PROCESS_DETAILS AttachingFindProcessDebuggingDetailsByToken(UINT64 Token)</div><div class="ttdoc">Find user-mode debugging details for threads by token.</div><div class="ttdef"><b>Definition</b> Attaching.c:164</div></div>
<div class="ttc" id="a_attaching_8h_html_a829d27c9709ca2e1f18c2b8661652b41"><div class="ttname"><a href="_attaching_8h.html#a829d27c9709ca2e1f18c2b8661652b41">MAX_CR3_IN_A_PROCESS</a></div><div class="ttdeci">#define MAX_CR3_IN_A_PROCESS</div><div class="ttdoc">Maximum number of CR3 registers that a process can have.</div><div class="ttdef"><b>Definition</b> Attaching.h:37</div></div>
<div class="ttc" id="a_basic_types_8h_html_aae17ebb9ef7279d026817fb22f8aebe9"><div class="ttname"><a href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></div><div class="ttdeci">unsigned __int64 UINT64</div><div class="ttdef"><b>Definition</b> BasicTypes.h:21</div></div>
<div class="ttc" id="a_data_types_8h_html_a0e279f80607c232e77080fd6ab7efb90a9f4053f14ec81e29707f1ec4cec0659e"><div class="ttname"><a href="_data_types_8h.html#a0e279f80607c232e77080fd6ab7efb90a9f4053f14ec81e29707f1ec4cec0659e">PagingLevelPageMapLevel4</a></div><div class="ttdeci">@ PagingLevelPageMapLevel4</div><div class="ttdef"><b>Definition</b> DataTypes.h:28</div></div>
<div class="ttc" id="a_debugger_events_8c_html_a29eb984baceb23c7c2a01cc947d4fe09"><div class="ttname"><a href="_debugger_events_8c.html#a29eb984baceb23c7c2a01cc947d4fe09">DebuggerEventDisableMovToCr3ExitingOnAllProcessors</a></div><div class="ttdeci">VOID DebuggerEventDisableMovToCr3ExitingOnAllProcessors()</div><div class="ttdoc">routines for debugging threads (disable mov-to-cr3 exiting)</div><div class="ttdef"><b>Definition</b> DebuggerEvents.c:53</div></div>
<div class="ttc" id="a_debugger_events_8c_html_a9fc0885a9799673255c0e61a4bf34a59"><div class="ttname"><a href="_debugger_events_8c.html#a9fc0885a9799673255c0e61a4bf34a59">DebuggerEventEnableMovToCr3ExitingOnAllProcessors</a></div><div class="ttdeci">VOID DebuggerEventEnableMovToCr3ExitingOnAllProcessors()</div><div class="ttdoc">routines for debugging threads (enable mov-to-cr3 exiting)</div><div class="ttdef"><b>Definition</b> DebuggerEvents.c:42</div></div>
<div class="ttc" id="a_hyper_dbg_hyper_log_intrinsics_8h_html_a459b19922fecfbb9438dd56b66930d16"><div class="ttname"><a href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a></div><div class="ttdeci">#define LogError(format,...)</div><div class="ttdoc">Log in the case of error.</div><div class="ttdef"><b>Definition</b> HyperDbgHyperLogIntrinsics.h:113</div></div>
<div class="ttc" id="a_memory_mapper_8c_html_ae48f36c16e0f72dfb25560c01b19423d"><div class="ttname"><a href="_memory_mapper_8c.html#ae48f36c16e0f72dfb25560c01b19423d">MemoryMapperSetSupervisorBitWithoutSwitchingByCr3</a></div><div class="ttdeci">_Use_decl_annotations_ BOOLEAN MemoryMapperSetSupervisorBitWithoutSwitchingByCr3(PVOID Va, BOOLEAN Set, PAGING_LEVEL Level, CR3_TYPE TargetCr3)</div><div class="ttdoc">This function the Supervisor bit of the target PTE based on the specific cr3.</div><div class="ttdef"><b>Definition</b> MemoryMapper.c:1697</div></div>
<div class="ttc" id="astruct___c_r3___t_y_p_e_html_a04eb96cc99b0458be739bcc9c640e08b"><div class="ttname"><a href="struct___c_r3___t_y_p_e.html#a04eb96cc99b0458be739bcc9c640e08b">_CR3_TYPE::Flags</a></div><div class="ttdeci">UINT64 Flags</div><div class="ttdef"><b>Definition</b> BasicTypes.h:133</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_a03824d851e6ed19772d65969892f267e"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#a03824d851e6ed19772d65969892f267e">_USERMODE_DEBUGGING_PROCESS_DETAILS::InterceptedCr3</a></div><div class="ttdeci">CR3_TYPE InterceptedCr3[MAX_CR3_IN_A_PROCESS]</div><div class="ttdef"><b>Definition</b> Attaching.h:66</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="a593f7e7ea84362b61dad501869a7b998" name="a593f7e7ea84362b61dad501869a7b998"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a593f7e7ea84362b61dad501869a7b998">&#9670;&#160;</a></span>AttachingCreateProcessDebuggingDetails()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a> AttachingCreateProcessDebuggingDetails </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>ProcessId</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a></td>          <td class="paramname"><span class="paramname"><em>Enabled</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a></td>          <td class="paramname"><span class="paramname"><em>Is32Bit</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a></td>          <td class="paramname"><span class="paramname"><em>CheckCallbackAtFirstInstruction</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype">PEPROCESS</td>          <td class="paramname"><span class="paramname"><em>Eprocess</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>PebAddressToMonitor</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>UsermodeReservedBuffer</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Create user-mode debugging details for threads. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">ProcessId</td><td></td></tr>
    <tr><td class="paramname">Is32Bit</td><td></td></tr>
    <tr><td class="paramname">Eprocess</td><td></td></tr>
    <tr><td class="paramname">PebAddressToMonitor</td><td></td></tr>
    <tr><td class="paramname">UsermodeReservedBuffer</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>UINT64 returns the unique token </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  107</span>{</div>
<div class="line"><span class="lineno">  108</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail;</div>
<div class="line"><span class="lineno">  109</span> </div>
<div class="line"><span class="lineno">  110</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  111</span>    <span class="comment">// Allocate the buffer</span></div>
<div class="line"><span class="lineno">  112</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  113</span>    ProcessDebuggingDetail = (<a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">USERMODE_DEBUGGING_PROCESS_DETAILS</a> *)</div>
<div class="line"><span class="lineno">  114</span>        <a class="code hl_function" href="_mem_8c.html#a9bd46383a9f12e1a8a1b59c1658d1bc8">PlatformMemAllocateZeroedNonPagedPool</a>(<span class="keyword">sizeof</span>(<a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">USERMODE_DEBUGGING_PROCESS_DETAILS</a>));</div>
<div class="line"><span class="lineno">  115</span> </div>
<div class="line"><span class="lineno">  116</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetail)</div>
<div class="line"><span class="lineno">  117</span>    {</div>
<div class="line"><span class="lineno">  118</span>        <span class="keywordflow">return</span> (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)<a class="code hl_function" href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">NULL</a>;</div>
<div class="line"><span class="lineno">  119</span>    }</div>
<div class="line"><span class="lineno">  120</span> </div>
<div class="line"><span class="lineno">  121</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  122</span>    <span class="comment">// Set the unique tag and increment it</span></div>
<div class="line"><span class="lineno">  123</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  124</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">Token</a> = <a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a6cc09230cf7303d0513330bed82491b0">g_SeedOfUserDebuggingDetails</a>++;</div>
<div class="line"><span class="lineno">  125</span> </div>
<div class="line"><span class="lineno">  126</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  127</span>    <span class="comment">// Set the details of the created buffer</span></div>
<div class="line"><span class="lineno">  128</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  129</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ace267a6473505408e798a827e1b244f0">ProcessId</a>                                    = ProcessId;</div>
<div class="line"><span class="lineno">  130</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#acaf7519d69de4a28112b82f39d438ae0">Enabled</a>                                      = Enabled;</div>
<div class="line"><span class="lineno">  131</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ac1a80680491ceb043b754ab5e9a7eec8">Is32Bit</a>                                      = Is32Bit;</div>
<div class="line"><span class="lineno">  132</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ab748a7db00ec4b671fa65ef900986080">CheckCallBackForInterceptingFirstInstruction</a> = CheckCallbackAtFirstInstruction;</div>
<div class="line"><span class="lineno">  133</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af3376ddf4a0eed532aa22d4be1747764">Eprocess</a>                                     = Eprocess;</div>
<div class="line"><span class="lineno">  134</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aefb16ed28844461dfa42f40f062015b0">PebAddressToMonitor</a>                          = (PVOID)PebAddressToMonitor;</div>
<div class="line"><span class="lineno">  135</span>    ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ac2d3522e9585dce69980ff651c53cb1d">UsermodeReservedBuffer</a>                       = UsermodeReservedBuffer;</div>
<div class="line"><span class="lineno">  136</span> </div>
<div class="line"><span class="lineno">  137</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  138</span>    <span class="comment">// Allocate a thread holder buffer for this process</span></div>
<div class="line"><span class="lineno">  139</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  140</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="_thread_holder_8c.html#a2d845e6ff080bbb13aa08176a8c81fa7">ThreadHolderAssignThreadHolderToProcessDebuggingDetails</a>(ProcessDebuggingDetail))</div>
<div class="line"><span class="lineno">  141</span>    {</div>
<div class="line"><span class="lineno">  142</span>        <a class="code hl_function" href="_mem_8c.html#a8ad365cfb6c54c3d6fdd745e6b4666f1">PlatformMemFreePool</a>(ProcessDebuggingDetail);</div>
<div class="line"><span class="lineno">  143</span>        <span class="keywordflow">return</span> (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)<a class="code hl_function" href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">NULL</a>;</div>
<div class="line"><span class="lineno">  144</span>    }</div>
<div class="line"><span class="lineno">  145</span> </div>
<div class="line"><span class="lineno">  146</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  147</span>    <span class="comment">// Attach it to the list of active thread (LIST_ENTRY)</span></div>
<div class="line"><span class="lineno">  148</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  149</span>    <a class="code hl_function" href="_windows_8h.html#ad311db6648e5e4e2860aab6164cdb6c1">InsertHeadList</a>(&amp;<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a3a003d2c59562062fe921cd2754440f7">g_ProcessDebuggingDetailsListHead</a>, &amp;(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af9cc943c4e24dbad2df94819db2c2c72">AttachedProcessList</a>));</div>
<div class="line"><span class="lineno">  150</span> </div>
<div class="line"><span class="lineno">  151</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  152</span>    <span class="comment">// return the token</span></div>
<div class="line"><span class="lineno">  153</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  154</span>    <span class="keywordflow">return</span> ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">Token</a>;</div>
<div class="line"><span class="lineno">  155</span>}</div>
<div class="ttc" id="a_mem_8c_html_a8ad365cfb6c54c3d6fdd745e6b4666f1"><div class="ttname"><a href="_mem_8c.html#a8ad365cfb6c54c3d6fdd745e6b4666f1">PlatformMemFreePool</a></div><div class="ttdeci">VOID PlatformMemFreePool(PVOID BufferAddress)</div><div class="ttdoc">Free (dellocate) a non-paged buffer.</div><div class="ttdef"><b>Definition</b> Mem.c:86</div></div>
<div class="ttc" id="a_mem_8c_html_a9bd46383a9f12e1a8a1b59c1658d1bc8"><div class="ttname"><a href="_mem_8c.html#a9bd46383a9f12e1a8a1b59c1658d1bc8">PlatformMemAllocateZeroedNonPagedPool</a></div><div class="ttdeci">PVOID PlatformMemAllocateZeroedNonPagedPool(SIZE_T NumberOfBytes)</div><div class="ttdoc">Allocate a non-paged buffer (zeroed)</div><div class="ttdef"><b>Definition</b> Mem.c:69</div></div>
<div class="ttc" id="a_thread_holder_8c_html_a2d845e6ff080bbb13aa08176a8c81fa7"><div class="ttname"><a href="_thread_holder_8c.html#a2d845e6ff080bbb13aa08176a8c81fa7">ThreadHolderAssignThreadHolderToProcessDebuggingDetails</a></div><div class="ttdeci">BOOLEAN ThreadHolderAssignThreadHolderToProcessDebuggingDetails(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)</div><div class="ttdoc">Assign a thread holder to process debugging details.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:42</div></div>
<div class="ttc" id="a_windows_8h_html_ad311db6648e5e4e2860aab6164cdb6c1"><div class="ttname"><a href="_windows_8h.html#ad311db6648e5e4e2860aab6164cdb6c1">InsertHeadList</a></div><div class="ttdeci">FORCEINLINE VOID InsertHeadList(_Inout_ PLIST_ENTRY ListHead, _Inout_ PLIST_ENTRY Entry)</div><div class="ttdef"><b>Definition</b> Windows.h:115</div></div>
<div class="ttc" id="ahyperkd_2header_2globals_2_global_8h_html_a3a003d2c59562062fe921cd2754440f7"><div class="ttname"><a href="hyperkd_2header_2globals_2_global_8h.html#a3a003d2c59562062fe921cd2754440f7">g_ProcessDebuggingDetailsListHead</a></div><div class="ttdeci">LIST_ENTRY g_ProcessDebuggingDetailsListHead</div><div class="ttdoc">List header of thread debugging details.</div><div class="ttdef"><b>Definition</b> Global.h:152</div></div>
<div class="ttc" id="ahyperkd_2header_2globals_2_global_8h_html_a6cc09230cf7303d0513330bed82491b0"><div class="ttname"><a href="hyperkd_2header_2globals_2_global_8h.html#a6cc09230cf7303d0513330bed82491b0">g_SeedOfUserDebuggingDetails</a></div><div class="ttdeci">UINT64 g_SeedOfUserDebuggingDetails</div><div class="ttdoc">Seed for tokens of unique details buffer for threads.</div><div class="ttdef"><b>Definition</b> Global.h:139</div></div>
<div class="ttc" id="anamespacetest-case-generator_html_a9a4eff80432bb93d2796381610dd86c3"><div class="ttname"><a href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">test-case-generator.NULL</a></div><div class="ttdeci">NULL()</div><div class="ttdef"><b>Definition</b> test-case-generator.py:530</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_aac3f928359d06bdd7572a4bd67c86429"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">_USERMODE_DEBUGGING_PROCESS_DETAILS::Token</a></div><div class="ttdeci">UINT64 Token</div><div class="ttdef"><b>Definition</b> Attaching.h:50</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_ab748a7db00ec4b671fa65ef900986080"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ab748a7db00ec4b671fa65ef900986080">_USERMODE_DEBUGGING_PROCESS_DETAILS::CheckCallBackForInterceptingFirstInstruction</a></div><div class="ttdeci">BOOLEAN CheckCallBackForInterceptingFirstInstruction</div><div class="ttdef"><b>Definition</b> Attaching.h:65</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_ac1a80680491ceb043b754ab5e9a7eec8"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ac1a80680491ceb043b754ab5e9a7eec8">_USERMODE_DEBUGGING_PROCESS_DETAILS::Is32Bit</a></div><div class="ttdeci">BOOLEAN Is32Bit</div><div class="ttdef"><b>Definition</b> Attaching.h:62</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_ac2d3522e9585dce69980ff651c53cb1d"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ac2d3522e9585dce69980ff651c53cb1d">_USERMODE_DEBUGGING_PROCESS_DETAILS::UsermodeReservedBuffer</a></div><div class="ttdeci">UINT64 UsermodeReservedBuffer</div><div class="ttdef"><b>Definition</b> Attaching.h:57</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_acaf7519d69de4a28112b82f39d438ae0"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#acaf7519d69de4a28112b82f39d438ae0">_USERMODE_DEBUGGING_PROCESS_DETAILS::Enabled</a></div><div class="ttdeci">BOOLEAN Enabled</div><div class="ttdef"><b>Definition</b> Attaching.h:51</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_ace267a6473505408e798a827e1b244f0"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ace267a6473505408e798a827e1b244f0">_USERMODE_DEBUGGING_PROCESS_DETAILS::ProcessId</a></div><div class="ttdeci">UINT32 ProcessId</div><div class="ttdef"><b>Definition</b> Attaching.h:61</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_aefb16ed28844461dfa42f40f062015b0"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aefb16ed28844461dfa42f40f062015b0">_USERMODE_DEBUGGING_PROCESS_DETAILS::PebAddressToMonitor</a></div><div class="ttdeci">PVOID PebAddressToMonitor</div><div class="ttdef"><b>Definition</b> Attaching.h:52</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_af3376ddf4a0eed532aa22d4be1747764"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af3376ddf4a0eed532aa22d4be1747764">_USERMODE_DEBUGGING_PROCESS_DETAILS::Eprocess</a></div><div class="ttdeci">PEPROCESS Eprocess</div><div class="ttdef"><b>Definition</b> Attaching.h:60</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_af9cc943c4e24dbad2df94819db2c2c72"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af9cc943c4e24dbad2df94819db2c2c72">_USERMODE_DEBUGGING_PROCESS_DETAILS::AttachedProcessList</a></div><div class="ttdeci">LIST_ENTRY AttachedProcessList</div><div class="ttdef"><b>Definition</b> Attaching.h:56</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="a733d0f343ddcccaeec221bbbb20483c7" name="a733d0f343ddcccaeec221bbbb20483c7"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a733d0f343ddcccaeec221bbbb20483c7">&#9670;&#160;</a></span>AttachingFindProcessDebuggingDetailsByProcessId()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> AttachingFindProcessDebuggingDetailsByProcessId </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>ProcessId</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Find user-mode debugging details for threads by process Id. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">ProcessId</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>PUSERMODE_DEBUGGING_PROCESS_DETAILS </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  188</span>{</div>
<div class="line"><span class="lineno">  189</span>    <a class="code hl_define" href="_meta_macros_8h.html#ae6305b9ffbb1d946674b7b98431a67e9">LIST_FOR_EACH_LINK</a>(<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a3a003d2c59562062fe921cd2754440f7">g_ProcessDebuggingDetailsListHead</a>, <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">USERMODE_DEBUGGING_PROCESS_DETAILS</a>, AttachedProcessList, ProcessDebuggingDetails)</div>
<div class="line"><span class="lineno">  190</span>    {</div>
<div class="line"><span class="lineno">  191</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  192</span>        <span class="comment">// Check if we found the target thread and if it&#39;s enabled</span></div>
<div class="line"><span class="lineno">  193</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  194</span>        <span class="keywordflow">if</span> (ProcessDebuggingDetails-&gt;ProcessId == ProcessId &amp;&amp; ProcessDebuggingDetails-&gt;Enabled)</div>
<div class="line"><span class="lineno">  195</span>        {</div>
<div class="line"><span class="lineno">  196</span>            <span class="keywordflow">return</span> ProcessDebuggingDetails;</div>
<div class="line"><span class="lineno">  197</span>        }</div>
<div class="line"><span class="lineno">  198</span>    }</div>
<div class="line"><span class="lineno">  199</span> </div>
<div class="line"><span class="lineno">  200</span>    <span class="keywordflow">return</span> <a class="code hl_function" href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">NULL</a>;</div>
<div class="line"><span class="lineno">  201</span>}</div>
<div class="ttc" id="a_meta_macros_8h_html_ae6305b9ffbb1d946674b7b98431a67e9"><div class="ttname"><a href="_meta_macros_8h.html#ae6305b9ffbb1d946674b7b98431a67e9">LIST_FOR_EACH_LINK</a></div><div class="ttdeci">#define LIST_FOR_EACH_LINK(_head, _struct_type, _member, _var)</div><div class="ttdef"><b>Definition</b> MetaMacros.h:34</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="ab826f65586e0a294b97e505c6affe8b5" name="ab826f65586e0a294b97e505c6affe8b5"></a>
<h2 class="memtitle"><span class="permalink"><a href="#ab826f65586e0a294b97e505c6affe8b5">&#9670;&#160;</a></span>AttachingFindProcessDebuggingDetailsByToken()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> AttachingFindProcessDebuggingDetailsByToken </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>Token</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Find user-mode debugging details for threads by token. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">Token</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>PUSERMODE_DEBUGGING_PROCESS_DETAILS </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  165</span>{</div>
<div class="line"><span class="lineno">  166</span>    <a class="code hl_define" href="_meta_macros_8h.html#ae6305b9ffbb1d946674b7b98431a67e9">LIST_FOR_EACH_LINK</a>(<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a3a003d2c59562062fe921cd2754440f7">g_ProcessDebuggingDetailsListHead</a>, <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">USERMODE_DEBUGGING_PROCESS_DETAILS</a>, AttachedProcessList, ProcessDebuggingDetails)</div>
<div class="line"><span class="lineno">  167</span>    {</div>
<div class="line"><span class="lineno">  168</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  169</span>        <span class="comment">// Check if we found the target thread and if it&#39;s enabled</span></div>
<div class="line"><span class="lineno">  170</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  171</span>        <span class="keywordflow">if</span> (ProcessDebuggingDetails-&gt;Token == Token &amp;&amp; ProcessDebuggingDetails-&gt;Enabled)</div>
<div class="line"><span class="lineno">  172</span>        {</div>
<div class="line"><span class="lineno">  173</span>            <span class="keywordflow">return</span> ProcessDebuggingDetails;</div>
<div class="line"><span class="lineno">  174</span>        }</div>
<div class="line"><span class="lineno">  175</span>    }</div>
<div class="line"><span class="lineno">  176</span> </div>
<div class="line"><span class="lineno">  177</span>    <span class="keywordflow">return</span> <a class="code hl_function" href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">NULL</a>;</div>
<div class="line"><span class="lineno">  178</span>}</div>
</div><!-- fragment -->
</div>
</div>
<a id="a0890d6e4aaf7fd8bdb1663697ed6b717" name="a0890d6e4aaf7fd8bdb1663697ed6b717"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a0890d6e4aaf7fd8bdb1663697ed6b717">&#9670;&#160;</a></span>AttachingFindProcessDebuggingDetailsInStartingPhase()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> AttachingFindProcessDebuggingDetailsInStartingPhase </td>
          <td>(</td>
          <td class="paramname"><span class="paramname"><em></em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Find user-mode debugging details for threads that is in the start-up phase. </p>
<dl class="section return"><dt>Returns</dt><dd>PUSERMODE_DEBUGGING_PROCESS_DETAILS </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  211</span>{</div>
<div class="line"><span class="lineno">  212</span>    <a class="code hl_define" href="_meta_macros_8h.html#ae6305b9ffbb1d946674b7b98431a67e9">LIST_FOR_EACH_LINK</a>(<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a3a003d2c59562062fe921cd2754440f7">g_ProcessDebuggingDetailsListHead</a>, <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">USERMODE_DEBUGGING_PROCESS_DETAILS</a>, AttachedProcessList, ProcessDebuggingDetails)</div>
<div class="line"><span class="lineno">  213</span>    {</div>
<div class="line"><span class="lineno">  214</span>        <span class="keywordflow">if</span> (ProcessDebuggingDetails-&gt;IsOnTheStartingPhase)</div>
<div class="line"><span class="lineno">  215</span>        {</div>
<div class="line"><span class="lineno">  216</span>            <span class="keywordflow">return</span> ProcessDebuggingDetails;</div>
<div class="line"><span class="lineno">  217</span>        }</div>
<div class="line"><span class="lineno">  218</span>    }</div>
<div class="line"><span class="lineno">  219</span> </div>
<div class="line"><span class="lineno">  220</span>    <span class="keywordflow">return</span> <a class="code hl_function" href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">NULL</a>;</div>
<div class="line"><span class="lineno">  221</span>}</div>
</div><!-- fragment -->
</div>
</div>
<a id="a2a634f245bfc5d1ce07e9df31f37f26a" name="a2a634f245bfc5d1ce07e9df31f37f26a"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a2a634f245bfc5d1ce07e9df31f37f26a">&#9670;&#160;</a></span>AttachingHandleCr3VmexitsForThreadInterception()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingHandleCr3VmexitsForThreadInterception </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>CoreId</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aaeec30724d8f0c9d2acd894f41ee06fe">CR3_TYPE</a></td>          <td class="paramname"><span class="paramname"><em>NewCr3</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Handle the cr3 vm-exits for thread interception. </p>
<p>this function should be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">CoreId</td><td></td></tr>
    <tr><td class="paramname">NewCr3</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1037</span>{</div>
<div class="line"><span class="lineno"> 1038</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail;</div>
<div class="line"><span class="lineno"> 1039</span> </div>
<div class="line"><span class="lineno"> 1040</span>    ProcessDebuggingDetail = <a class="code hl_function" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a>(<a class="code hl_define" href="_meta_macros_8h.html#ad790279846c85a5a453f2e7a4e02abad">HANDLE_TO_UINT32</a>(PsGetCurrentProcessId()));</div>
<div class="line"><span class="lineno"> 1041</span> </div>
<div class="line"><span class="lineno"> 1042</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1043</span>    <span class="comment">// Check if process is valid or if thread is in intercepting phase</span></div>
<div class="line"><span class="lineno"> 1044</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1045</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetail || !ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ad3d6574cef84c00d549493d88c62e68f">IsOnThreadInterceptingPhase</a>)</div>
<div class="line"><span class="lineno"> 1046</span>    {</div>
<div class="line"><span class="lineno"> 1047</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1048</span>        <span class="comment">// not related to user debugger</span></div>
<div class="line"><span class="lineno"> 1049</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1050</span>        <a class="code hl_function" href="_export_8c.html#acabb4a88d5b23a655b48c81114c6779e">VmFuncUnsetExceptionBitmap</a>(CoreId, <a class="code hl_enumvalue" href="include_2_s_d_k_2_headers_2_events_8h.html#af9640e4f7e36f7a6bf7c56e30a860349a6a2e04f0e1552752bd9419a4019638a2">EXCEPTION_VECTOR_PAGE_FAULT</a>);</div>
<div class="line"><span class="lineno"> 1051</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1052</span>    }</div>
<div class="line"><span class="lineno"> 1053</span> </div>
<div class="line"><span class="lineno"> 1054</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1055</span>    <span class="comment">// Save the cr3 for future continuing the thread</span></div>
<div class="line"><span class="lineno"> 1056</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1057</span>    <span class="keywordflow">for</span> (<span class="keywordtype">size_t</span> i = 0; i &lt; <a class="code hl_define" href="_attaching_8h.html#a829d27c9709ca2e1f18c2b8661652b41">MAX_CR3_IN_A_PROCESS</a>; i++)</div>
<div class="line"><span class="lineno"> 1058</span>    {</div>
<div class="line"><span class="lineno"> 1059</span>        <span class="keywordflow">if</span> (ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#a03824d851e6ed19772d65969892f267e">InterceptedCr3</a>[i].<a class="code hl_variable" href="struct___c_r3___t_y_p_e.html#a04eb96cc99b0458be739bcc9c640e08b">Flags</a> == NewCr3.<a class="code hl_variable" href="struct___c_r3___t_y_p_e.html#a04eb96cc99b0458be739bcc9c640e08b">Flags</a>)</div>
<div class="line"><span class="lineno"> 1060</span>        {</div>
<div class="line"><span class="lineno"> 1061</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1062</span>            <span class="comment">// We found it saved previously, no need any further action</span></div>
<div class="line"><span class="lineno"> 1063</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1064</span>            <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1065</span>        }</div>
<div class="line"><span class="lineno"> 1066</span> </div>
<div class="line"><span class="lineno"> 1067</span>        <span class="keywordflow">if</span> (ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#a03824d851e6ed19772d65969892f267e">InterceptedCr3</a>[i].<a class="code hl_variable" href="struct___c_r3___t_y_p_e.html#a04eb96cc99b0458be739bcc9c640e08b">Flags</a> == (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)NULL)</div>
<div class="line"><span class="lineno"> 1068</span>        {</div>
<div class="line"><span class="lineno"> 1069</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1070</span>            <span class="comment">// Save the cr3</span></div>
<div class="line"><span class="lineno"> 1071</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1072</span>            ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#a03824d851e6ed19772d65969892f267e">InterceptedCr3</a>[i].<a class="code hl_variable" href="struct___c_r3___t_y_p_e.html#a04eb96cc99b0458be739bcc9c640e08b">Flags</a> = NewCr3.<a class="code hl_variable" href="struct___c_r3___t_y_p_e.html#a04eb96cc99b0458be739bcc9c640e08b">Flags</a>;</div>
<div class="line"><span class="lineno"> 1073</span>            <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1074</span>        }</div>
<div class="line"><span class="lineno"> 1075</span>    }</div>
<div class="line"><span class="lineno"> 1076</span> </div>
<div class="line"><span class="lineno"> 1077</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1078</span>    <span class="comment">// This thread should be intercepted</span></div>
<div class="line"><span class="lineno"> 1079</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1080</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="_memory_mapper_8c.html#ae48f36c16e0f72dfb25560c01b19423d">MemoryMapperSetSupervisorBitWithoutSwitchingByCr3</a>(NULL, <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>, <a class="code hl_enumvalue" href="_data_types_8h.html#a0e279f80607c232e77080fd6ab7efb90a9f4053f14ec81e29707f1ec4cec0659e">PagingLevelPageMapLevel4</a>, NewCr3))</div>
<div class="line"><span class="lineno"> 1081</span>    {</div>
<div class="line"><span class="lineno"> 1082</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1083</span>    }</div>
<div class="line"><span class="lineno"> 1084</span> </div>
<div class="line"><span class="lineno"> 1085</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1086</span>    <span class="comment">// Intercept #PFs</span></div>
<div class="line"><span class="lineno"> 1087</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1088</span>    <a class="code hl_function" href="_export_8c.html#a837024687fafd5d17e1020eb6157923f">VmFuncSetExceptionBitmap</a>(CoreId, <a class="code hl_enumvalue" href="include_2_s_d_k_2_headers_2_events_8h.html#af9640e4f7e36f7a6bf7c56e30a860349a6a2e04f0e1552752bd9419a4019638a2">EXCEPTION_VECTOR_PAGE_FAULT</a>);</div>
<div class="line"><span class="lineno"> 1089</span> </div>
<div class="line"><span class="lineno"> 1090</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1091</span>}</div>
<div class="ttc" id="a_export_8c_html_a837024687fafd5d17e1020eb6157923f"><div class="ttname"><a href="_export_8c.html#a837024687fafd5d17e1020eb6157923f">VmFuncSetExceptionBitmap</a></div><div class="ttdeci">VOID VmFuncSetExceptionBitmap(UINT32 CoreId, UINT32 IdtIndex)</div><div class="ttdoc">Set exception bitmap in VMCS.</div><div class="ttdef"><b>Definition</b> Export.c:253</div></div>
<div class="ttc" id="a_export_8c_html_acabb4a88d5b23a655b48c81114c6779e"><div class="ttname"><a href="_export_8c.html#acabb4a88d5b23a655b48c81114c6779e">VmFuncUnsetExceptionBitmap</a></div><div class="ttdeci">VOID VmFuncUnsetExceptionBitmap(UINT32 CoreId, UINT32 IdtIndex)</div><div class="ttdoc">Unset exception bitmap in VMCS.</div><div class="ttdef"><b>Definition</b> Export.c:267</div></div>
<div class="ttc" id="ainclude_2_s_d_k_2_headers_2_events_8h_html_af9640e4f7e36f7a6bf7c56e30a860349a6a2e04f0e1552752bd9419a4019638a2"><div class="ttname"><a href="include_2_s_d_k_2_headers_2_events_8h.html#af9640e4f7e36f7a6bf7c56e30a860349a6a2e04f0e1552752bd9419a4019638a2">EXCEPTION_VECTOR_PAGE_FAULT</a></div><div class="ttdeci">@ EXCEPTION_VECTOR_PAGE_FAULT</div><div class="ttdef"><b>Definition</b> Events.h:38</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="adadde19c6465b57b781fff52e7f8db85" name="adadde19c6465b57b781fff52e7f8db85"></a>
<h2 class="memtitle"><span class="permalink"><a href="#adadde19c6465b57b781fff52e7f8db85">&#9670;&#160;</a></span>AttachingHandleEntrypointInterception()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a7f319bfc2492a2136964194204e7a8cf">VOID</a> AttachingHandleEntrypointInterception </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="hyperkd_2header_2debugger_2core_2_state_8h.html#aa35afece6adc9a29a7bf7a2e76476037">PROCESSOR_DEBUGGING_STATE</a> *</td>          <td class="paramname"><span class="paramname"><em>DbgState</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Handle the interception of finding the entrypoint on attaching to user-mode process. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">DbgState</td><td>The state of the debugger on the current core </td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>VOID </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  437</span>{</div>
<div class="line"><span class="lineno">  438</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail = <a class="code hl_function" href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">NULL</a>;</div>
<div class="line"><span class="lineno">  439</span>    PAGE_FAULT_EXCEPTION                PageFaultErrorCode     = {0};</div>
<div class="line"><span class="lineno">  440</span> </div>
<div class="line"><span class="lineno">  441</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  442</span>    <span class="comment">// Not increment the RIP register as no instruction is intended to go</span></div>
<div class="line"><span class="lineno">  443</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  444</span>    <a class="code hl_function" href="_export_8c.html#ad357512be8732352fac0e4a03676e458">VmFuncSuppressRipIncrement</a>(DbgState-&gt;<a class="code hl_variable" href="struct___p_r_o_c_e_s_s_o_r___d_e_b_u_g_g_i_n_g___s_t_a_t_e.html#a090832a74d330cde891a17bdd5b236e3">CoreId</a>);</div>
<div class="line"><span class="lineno">  445</span> </div>
<div class="line"><span class="lineno">  446</span>    ProcessDebuggingDetail = <a class="code hl_function" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a>(<a class="code hl_define" href="_meta_macros_8h.html#ad790279846c85a5a453f2e7a4e02abad">HANDLE_TO_UINT32</a>(PsGetCurrentProcessId()));</div>
<div class="line"><span class="lineno">  447</span> </div>
<div class="line"><span class="lineno">  448</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  449</span>    <span class="comment">// Check to only break on the target process id and thread id and when</span></div>
<div class="line"><span class="lineno">  450</span>    <span class="comment">// the entrypoint is not called, if the thread debugging detail is found</span></div>
<div class="line"><span class="lineno">  451</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  452</span>    <span class="keywordflow">if</span> (ProcessDebuggingDetail != NULL)</div>
<div class="line"><span class="lineno">  453</span>    {</div>
<div class="line"><span class="lineno">  454</span>        <span class="keywordflow">if</span> (<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae4b7e6d3d73fbc5e36dab0e432cfda0e">g_IsWaitingForUserModeProcessEntryToBeCalled</a>)</div>
<div class="line"><span class="lineno">  455</span>        {</div>
<div class="line"><span class="lineno">  456</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  457</span>            <span class="comment">// Show a message that we reached to the entrypoint</span></div>
<div class="line"><span class="lineno">  458</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  459</span>            <span class="comment">// Log(&quot;Reached to the main module entrypoint (%016llx)\n&quot;, VmFuncGetLastVmexitRip(DbgState-&gt;CoreId));</span></div>
<div class="line"><span class="lineno">  460</span> </div>
<div class="line"><span class="lineno">  461</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  462</span>            <span class="comment">// Not waiting for these event anymore</span></div>
<div class="line"><span class="lineno">  463</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  464</span>            <a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae4b7e6d3d73fbc5e36dab0e432cfda0e">g_IsWaitingForUserModeProcessEntryToBeCalled</a> = <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  465</span> </div>
<div class="line"><span class="lineno">  466</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  467</span>            <span class="comment">// Whenever Windows calls the start entrypoint of the target PE, initially,</span></div>
<div class="line"><span class="lineno">  468</span>            <span class="comment">// the module is not loaded in the memory, thus a page-fault will happen and</span></div>
<div class="line"><span class="lineno">  469</span>            <span class="comment">// the page-fault handler will bring the module content to the memory and after</span></div>
<div class="line"><span class="lineno">  470</span>            <span class="comment">// that, the start entrypoint of PE is called again</span></div>
<div class="line"><span class="lineno">  471</span>            <span class="comment">// It&#39;s not possible for us to handle everything here without checking for the</span></div>
<div class="line"><span class="lineno">  472</span>            <span class="comment">// possible page-fault, it is because the first instruction is not available to be</span></div>
<div class="line"><span class="lineno">  473</span>            <span class="comment">// read from the memory, thus, it shows a wrong instruction and the user might not</span></div>
<div class="line"><span class="lineno">  474</span>            <span class="comment">// use the instrumentation step-in from the start up of the entrypoint.</span></div>
<div class="line"><span class="lineno">  475</span>            <span class="comment">// Because if the user uses the instrumentation step-in command then it should go</span></div>
<div class="line"><span class="lineno">  476</span>            <span class="comment">// the page-fault handler routine in the kernel and it&#39;s not what the user expects</span></div>
<div class="line"><span class="lineno">  477</span>            <span class="comment">// we inject a #PF here and let the Windows handle the page-fault. Meanwhile, we</span></div>
<div class="line"><span class="lineno">  478</span>            <span class="comment">// set the hardware debug breakpoint again at the start of the entrypoint, so, the</span></div>
<div class="line"><span class="lineno">  479</span>            <span class="comment">// next time that the instruction is about to be fetched, a vm-exit happens as a</span></div>
<div class="line"><span class="lineno">  480</span>            <span class="comment">// result of intercepting #DBs</span></div>
<div class="line"><span class="lineno">  481</span>            <span class="comment">// In some cases, there is no need to inject #PF to the guest. One example is when</span></div>
<div class="line"><span class="lineno">  482</span>            <span class="comment">// the target page is already available in the memory like the same process is also</span></div>
<div class="line"><span class="lineno">  483</span>            <span class="comment">// open in the debuggee. In these cases, we handle the break directly without injecting</span></div>
<div class="line"><span class="lineno">  484</span>            <span class="comment">// any page-fault</span></div>
<div class="line"><span class="lineno">  485</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  486</span> </div>
<div class="line"><span class="lineno">  487</span>            <span class="keywordflow">if</span> (!<a class="code hl_function" href="_address_check_8c.html#aec71cec56c29db61a23b2997ee8e2059">CheckAccessValidityAndSafety</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#adb588665a0fa72d6307d6f8577f2f946">EntrypointOfMainModule</a>, <span class="keyword">sizeof</span>(<a class="code hl_typedef" href="_basic_types_8h.html#aebb9e13210d88d43e32e735ada43a425">CHAR</a>)))</div>
<div class="line"><span class="lineno">  488</span>            {</div>
<div class="line"><span class="lineno">  489</span>                <span class="comment">// LogInfo(&quot;Injecting #PF for entrypoint at : %llx&quot;, ProcessDebuggingDetail-&gt;EntrypointOfMainModule);</span></div>
<div class="line"><span class="lineno">  490</span> </div>
<div class="line"><span class="lineno">  491</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  492</span>                <span class="comment">// We&#39;re waiting for this pointer to be called again after handling page-fault</span></div>
<div class="line"><span class="lineno">  493</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  494</span>                <a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a0b03446aa090036e1c29277857de9596">g_IsWaitingForReturnAndRunFromPageFault</a> = <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  495</span> </div>
<div class="line"><span class="lineno">  496</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  497</span>                <span class="comment">// Create page-fault error code (user, fetch #PF)</span></div>
<div class="line"><span class="lineno">  498</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  499</span>                PageFaultErrorCode.AsUInt = 0x14;</div>
<div class="line"><span class="lineno">  500</span> </div>
<div class="line"><span class="lineno">  501</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  502</span>                <span class="comment">// Inject the page-fault</span></div>
<div class="line"><span class="lineno">  503</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  504</span>                <a class="code hl_function" href="_export_8c.html#ad4cb8e5eaaa79a648e0b82a1a7af295f">VmFuncEventInjectPageFaultWithCr2</a>(DbgState-&gt;<a class="code hl_variable" href="struct___p_r_o_c_e_s_s_o_r___d_e_b_u_g_g_i_n_g___s_t_a_t_e.html#a090832a74d330cde891a17bdd5b236e3">CoreId</a>,</div>
<div class="line"><span class="lineno">  505</span>                                                  ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#adb588665a0fa72d6307d6f8577f2f946">EntrypointOfMainModule</a>,</div>
<div class="line"><span class="lineno">  506</span>                                                  PageFaultErrorCode.AsUInt);</div>
<div class="line"><span class="lineno">  507</span> </div>
<div class="line"><span class="lineno">  508</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  509</span>                <span class="comment">// Also, set the RFLAGS.TF to intercept the process (thread) again after inject #PF</span></div>
<div class="line"><span class="lineno">  510</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  511</span>                <a class="code hl_function" href="_export_8c.html#a8f68fa306b093e98466bd4f16cd16035">VmFuncSetRflagTrapFlag</a>(<a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>);</div>
<div class="line"><span class="lineno">  512</span> </div>
<div class="line"><span class="lineno">  513</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  514</span>                <span class="comment">// Indicate that we should set the trap flag to the FALSE next time on</span></div>
<div class="line"><span class="lineno">  515</span>                <span class="comment">// the same process/thread</span></div>
<div class="line"><span class="lineno">  516</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  517</span>                <span class="keywordflow">if</span> (!<a class="code hl_function" href="_breakpoint_commands_8c.html#ac0e535f6d443deb15a20ffbf8e2252c6">BreakpointRestoreTheTrapFlagOnceTriggered</a>(<a class="code hl_define" href="_meta_macros_8h.html#ad790279846c85a5a453f2e7a4e02abad">HANDLE_TO_UINT32</a>(PsGetCurrentProcessId()), <a class="code hl_define" href="_meta_macros_8h.html#ad790279846c85a5a453f2e7a4e02abad">HANDLE_TO_UINT32</a>(PsGetCurrentThreadId())))</div>
<div class="line"><span class="lineno">  518</span>                {</div>
<div class="line"><span class="lineno">  519</span>                    <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#abf506c814a6f717a87b5d808b828ef56">LogWarning</a>(<span class="stringliteral">&quot;Warning, it is currently not possible to add the current process/thread to the list of processes &quot;</span></div>
<div class="line"><span class="lineno">  520</span>                               <span class="stringliteral">&quot;where the trap flag should be masked. Please ensure that you manually unset the trap flag&quot;</span>);</div>
<div class="line"><span class="lineno">  521</span>                }</div>
<div class="line"><span class="lineno">  522</span>            }</div>
<div class="line"><span class="lineno">  523</span>            <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno">  524</span>            {</div>
<div class="line"><span class="lineno">  525</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  526</span>                <span class="comment">// Address is valid, probably the module is previously loaded</span></div>
<div class="line"><span class="lineno">  527</span>                <span class="comment">// or another process with same image is currently running</span></div>
<div class="line"><span class="lineno">  528</span>                <span class="comment">// Thus, there is no need to inject #PF, we&#39;ll handle it in debugger</span></div>
<div class="line"><span class="lineno">  529</span>                <span class="comment">//</span></div>
<div class="line"><span class="lineno">  530</span>                <a class="code hl_function" href="#afb4b04c662929a9dc3b74b45b634aff4">AttachingReachedToValidLoadedModule</a>(DbgState, ProcessDebuggingDetail);</div>
<div class="line"><span class="lineno">  531</span>            }</div>
<div class="line"><span class="lineno">  532</span>        }</div>
<div class="line"><span class="lineno">  533</span>        <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a0b03446aa090036e1c29277857de9596">g_IsWaitingForReturnAndRunFromPageFault</a>)</div>
<div class="line"><span class="lineno">  534</span>        {</div>
<div class="line"><span class="lineno">  535</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  536</span>            <span class="comment">// not waiting for a break after the page-fault anymore</span></div>
<div class="line"><span class="lineno">  537</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  538</span>            <a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a0b03446aa090036e1c29277857de9596">g_IsWaitingForReturnAndRunFromPageFault</a> = <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  539</span> </div>
<div class="line"><span class="lineno">  540</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  541</span>            <span class="comment">// We reached here as a result of setting the trap flag after</span></div>
<div class="line"><span class="lineno">  542</span>            <span class="comment">// injecting a page-fault</span></div>
<div class="line"><span class="lineno">  543</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  544</span>            <a class="code hl_function" href="#afb4b04c662929a9dc3b74b45b634aff4">AttachingReachedToValidLoadedModule</a>(DbgState, ProcessDebuggingDetail);</div>
<div class="line"><span class="lineno">  545</span>        }</div>
<div class="line"><span class="lineno">  546</span>    }</div>
<div class="line"><span class="lineno">  547</span>}</div>
<div class="ttc" id="a_address_check_8c_html_aec71cec56c29db61a23b2997ee8e2059"><div class="ttname"><a href="_address_check_8c.html#aec71cec56c29db61a23b2997ee8e2059">CheckAccessValidityAndSafety</a></div><div class="ttdeci">BOOLEAN CheckAccessValidityAndSafety(UINT64 TargetAddress, UINT32 Size)</div><div class="ttdoc">Check the safety to access the memory.</div><div class="ttdef"><b>Definition</b> AddressCheck.c:156</div></div>
<div class="ttc" id="a_attaching_8c_html_afb4b04c662929a9dc3b74b45b634aff4"><div class="ttname"><a href="#afb4b04c662929a9dc3b74b45b634aff4">AttachingReachedToValidLoadedModule</a></div><div class="ttdeci">BOOLEAN AttachingReachedToValidLoadedModule(PROCESSOR_DEBUGGING_STATE *DbgState, PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)</div><div class="ttdoc">Handle cases where we reached to the valid loaded module The main module should be loaded once we rea...</div><div class="ttdef"><b>Definition</b> Attaching.c:348</div></div>
<div class="ttc" id="a_basic_types_8h_html_aebb9e13210d88d43e32e735ada43a425"><div class="ttname"><a href="_basic_types_8h.html#aebb9e13210d88d43e32e735ada43a425">CHAR</a></div><div class="ttdeci">char CHAR</div><div class="ttdef"><b>Definition</b> BasicTypes.h:31</div></div>
<div class="ttc" id="a_breakpoint_commands_8c_html_ac0e535f6d443deb15a20ffbf8e2252c6"><div class="ttname"><a href="_breakpoint_commands_8c.html#ac0e535f6d443deb15a20ffbf8e2252c6">BreakpointRestoreTheTrapFlagOnceTriggered</a></div><div class="ttdeci">BOOLEAN BreakpointRestoreTheTrapFlagOnceTriggered(UINT32 ProcessId, UINT32 ThreadId)</div><div class="ttdoc">This function makes sure to unset the RFLAGS.TF on next trigger of #DB on the target process/thread.</div><div class="ttdef"><b>Definition</b> BreakpointCommands.c:174</div></div>
<div class="ttc" id="a_export_8c_html_a8f68fa306b093e98466bd4f16cd16035"><div class="ttname"><a href="_export_8c.html#a8f68fa306b093e98466bd4f16cd16035">VmFuncSetRflagTrapFlag</a></div><div class="ttdeci">VOID VmFuncSetRflagTrapFlag(BOOLEAN Set)</div><div class="ttdoc">Set Rflag's trap flag.</div><div class="ttdef"><b>Definition</b> Export.c:110</div></div>
<div class="ttc" id="a_export_8c_html_ad4cb8e5eaaa79a648e0b82a1a7af295f"><div class="ttname"><a href="_export_8c.html#ad4cb8e5eaaa79a648e0b82a1a7af295f">VmFuncEventInjectPageFaultWithCr2</a></div><div class="ttdeci">VOID VmFuncEventInjectPageFaultWithCr2(UINT32 CoreId, UINT64 Address, UINT32 PageFaultCode)</div><div class="ttdoc">Inject #PF and configure CR2 register.</div><div class="ttdef"><b>Definition</b> Export.c:626</div></div>
<div class="ttc" id="a_hyper_dbg_hyper_log_intrinsics_8h_html_abf506c814a6f717a87b5d808b828ef56"><div class="ttname"><a href="_hyper_dbg_hyper_log_intrinsics_8h.html#abf506c814a6f717a87b5d808b828ef56">LogWarning</a></div><div class="ttdeci">#define LogWarning(format,...)</div><div class="ttdoc">Log in the case of warning.</div><div class="ttdef"><b>Definition</b> HyperDbgHyperLogIntrinsics.h:99</div></div>
<div class="ttc" id="ahyperkd_2header_2globals_2_global_8h_html_a0b03446aa090036e1c29277857de9596"><div class="ttname"><a href="hyperkd_2header_2globals_2_global_8h.html#a0b03446aa090036e1c29277857de9596">g_IsWaitingForReturnAndRunFromPageFault</a></div><div class="ttdeci">BOOLEAN g_IsWaitingForReturnAndRunFromPageFault</div><div class="ttdoc">Whether the thread attaching mechanism is waiting for a page-fault finish or not.</div><div class="ttdef"><b>Definition</b> Global.h:146</div></div>
<div class="ttc" id="ahyperkd_2header_2globals_2_global_8h_html_ae4b7e6d3d73fbc5e36dab0e432cfda0e"><div class="ttname"><a href="hyperkd_2header_2globals_2_global_8h.html#ae4b7e6d3d73fbc5e36dab0e432cfda0e">g_IsWaitingForUserModeProcessEntryToBeCalled</a></div><div class="ttdeci">BOOLEAN g_IsWaitingForUserModeProcessEntryToBeCalled</div><div class="ttdoc">Whether the thread attaching mechanism is waiting for #DB or not.</div><div class="ttdef"><b>Definition</b> Global.h:158</div></div>
<div class="ttc" id="astruct___p_r_o_c_e_s_s_o_r___d_e_b_u_g_g_i_n_g___s_t_a_t_e_html_a090832a74d330cde891a17bdd5b236e3"><div class="ttname"><a href="struct___p_r_o_c_e_s_s_o_r___d_e_b_u_g_g_i_n_g___s_t_a_t_e.html#a090832a74d330cde891a17bdd5b236e3">_PROCESSOR_DEBUGGING_STATE::CoreId</a></div><div class="ttdeci">UINT32 CoreId</div><div class="ttdef"><b>Definition</b> State.h:169</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_adb588665a0fa72d6307d6f8577f2f946"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#adb588665a0fa72d6307d6f8577f2f946">_USERMODE_DEBUGGING_PROCESS_DETAILS::EntrypointOfMainModule</a></div><div class="ttdeci">UINT64 EntrypointOfMainModule</div><div class="ttdef"><b>Definition</b> Attaching.h:58</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="ac973601a8671bd7f982fb9f7fd13ccc4" name="ac973601a8671bd7f982fb9f7fd13ccc4"></a>
<h2 class="memtitle"><span class="permalink"><a href="#ac973601a8671bd7f982fb9f7fd13ccc4">&#9670;&#160;</a></span>AttachingInitialize()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingInitialize </td>
          <td>(</td>
          <td class="paramname"><span class="paramname"><em></em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Initialize the attaching mechanism. </p>
<p>as we use the functionalities for these functions, we initialize them from the debugger at start up of debugger (not initialization of user-debugger) </p><dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">   23</span>{</div>
<div class="line"><span class="lineno">   24</span>    <a class="code hl_struct" href="struct___u_n_i_c_o_d_e___s_t_r_i_n_g.html">UNICODE_STRING</a> FunctionName;</div>
<div class="line"><span class="lineno">   25</span> </div>
<div class="line"><span class="lineno">   26</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">   27</span>    <span class="comment">// Find address of PsGetProcessPeb</span></div>
<div class="line"><span class="lineno">   28</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">   29</span>    <span class="keywordflow">if</span> (<a class="code hl_variable" href="_user_access_8h.html#a2e58e91ee1d41c311736e026efcfe134">g_PsGetProcessPeb</a> == NULL)</div>
<div class="line"><span class="lineno">   30</span>    {</div>
<div class="line"><span class="lineno">   31</span>        RtlInitUnicodeString(&amp;FunctionName, L<span class="stringliteral">&quot;PsGetProcessPeb&quot;</span>);</div>
<div class="line"><span class="lineno">   32</span>        <a class="code hl_variable" href="_user_access_8h.html#a2e58e91ee1d41c311736e026efcfe134">g_PsGetProcessPeb</a> = (<a class="code hl_typedef" href="_user_access_8h.html#aeea4e249b597d96d35bd6b3d310f940b">PsGetProcessPeb</a>)MmGetSystemRoutineAddress(&amp;FunctionName);</div>
<div class="line"><span class="lineno">   33</span> </div>
<div class="line"><span class="lineno">   34</span>        <span class="keywordflow">if</span> (<a class="code hl_variable" href="_user_access_8h.html#a2e58e91ee1d41c311736e026efcfe134">g_PsGetProcessPeb</a> == NULL)</div>
<div class="line"><span class="lineno">   35</span>        {</div>
<div class="line"><span class="lineno">   36</span>            <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a>(<span class="stringliteral">&quot;Err, cannot resolve PsGetProcessPeb&quot;</span>);</div>
<div class="line"><span class="lineno">   37</span> </div>
<div class="line"><span class="lineno">   38</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">   39</span>            <span class="comment">// Won&#39;t fail the entire debugger for not finding this</span></div>
<div class="line"><span class="lineno">   40</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">   41</span>            <span class="comment">// return FALSE;</span></div>
<div class="line"><span class="lineno">   42</span>        }</div>
<div class="line"><span class="lineno">   43</span>    }</div>
<div class="line"><span class="lineno">   44</span> </div>
<div class="line"><span class="lineno">   45</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">   46</span>    <span class="comment">// Find address of PsGetProcessWow64Process</span></div>
<div class="line"><span class="lineno">   47</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">   48</span>    <span class="keywordflow">if</span> (<a class="code hl_variable" href="_user_access_8h.html#a7e5eee7c3615d4c3a4b2e080eebf3046">g_PsGetProcessWow64Process</a> == NULL)</div>
<div class="line"><span class="lineno">   49</span>    {</div>
<div class="line"><span class="lineno">   50</span>        RtlInitUnicodeString(&amp;FunctionName, L<span class="stringliteral">&quot;PsGetProcessWow64Process&quot;</span>);</div>
<div class="line"><span class="lineno">   51</span>        <a class="code hl_variable" href="_user_access_8h.html#a7e5eee7c3615d4c3a4b2e080eebf3046">g_PsGetProcessWow64Process</a> = (<a class="code hl_typedef" href="_user_access_8h.html#a586171a43627dbaf3dd3a68eef7d2954">PsGetProcessWow64Process</a>)MmGetSystemRoutineAddress(&amp;FunctionName);</div>
<div class="line"><span class="lineno">   52</span> </div>
<div class="line"><span class="lineno">   53</span>        <span class="keywordflow">if</span> (<a class="code hl_variable" href="_user_access_8h.html#a7e5eee7c3615d4c3a4b2e080eebf3046">g_PsGetProcessWow64Process</a> == NULL)</div>
<div class="line"><span class="lineno">   54</span>        {</div>
<div class="line"><span class="lineno">   55</span>            <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a>(<span class="stringliteral">&quot;Err, cannot resolve PsGetProcessPeb&quot;</span>);</div>
<div class="line"><span class="lineno">   56</span> </div>
<div class="line"><span class="lineno">   57</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">   58</span>            <span class="comment">// Won&#39;t fail the entire debugger for not finding this</span></div>
<div class="line"><span class="lineno">   59</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">   60</span>            <span class="comment">// return FALSE;</span></div>
<div class="line"><span class="lineno">   61</span>        }</div>
<div class="line"><span class="lineno">   62</span>    }</div>
<div class="line"><span class="lineno">   63</span> </div>
<div class="line"><span class="lineno">   64</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">   65</span>    <span class="comment">// Find address of ZwQueryInformationProcess</span></div>
<div class="line"><span class="lineno">   66</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">   67</span>    <span class="keywordflow">if</span> (<a class="code hl_variable" href="_user_access_8h.html#a114772f502575fa8e6ff36c9fab0bf3e">g_ZwQueryInformationProcess</a> == NULL)</div>
<div class="line"><span class="lineno">   68</span>    {</div>
<div class="line"><span class="lineno">   69</span>        <a class="code hl_struct" href="struct___u_n_i_c_o_d_e___s_t_r_i_n_g.html">UNICODE_STRING</a> RoutineName;</div>
<div class="line"><span class="lineno">   70</span> </div>
<div class="line"><span class="lineno">   71</span>        RtlInitUnicodeString(&amp;RoutineName, L<span class="stringliteral">&quot;ZwQueryInformationProcess&quot;</span>);</div>
<div class="line"><span class="lineno">   72</span> </div>
<div class="line"><span class="lineno">   73</span>        <a class="code hl_variable" href="_user_access_8h.html#a114772f502575fa8e6ff36c9fab0bf3e">g_ZwQueryInformationProcess</a> = (<a class="code hl_typedef" href="_user_access_8h.html#aeb00925a7719b80558821f57265bf112">ZwQueryInformationProcess</a>)MmGetSystemRoutineAddress(&amp;RoutineName);</div>
<div class="line"><span class="lineno">   74</span> </div>
<div class="line"><span class="lineno">   75</span>        <span class="keywordflow">if</span> (<a class="code hl_variable" href="_user_access_8h.html#a114772f502575fa8e6ff36c9fab0bf3e">g_ZwQueryInformationProcess</a> == NULL)</div>
<div class="line"><span class="lineno">   76</span>        {</div>
<div class="line"><span class="lineno">   77</span>            <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a>(<span class="stringliteral">&quot;Err, cannot resolve ZwQueryInformationProcess&quot;</span>);</div>
<div class="line"><span class="lineno">   78</span> </div>
<div class="line"><span class="lineno">   79</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">   80</span>            <span class="comment">// Won&#39;t fail the entire debugger for not finding this</span></div>
<div class="line"><span class="lineno">   81</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">   82</span>            <span class="comment">// return FALSE;</span></div>
<div class="line"><span class="lineno">   83</span>        }</div>
<div class="line"><span class="lineno">   84</span>    }</div>
<div class="line"><span class="lineno">   85</span> </div>
<div class="line"><span class="lineno">   86</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">   87</span>}</div>
<div class="ttc" id="a_user_access_8h_html_a114772f502575fa8e6ff36c9fab0bf3e"><div class="ttname"><a href="_user_access_8h.html#a114772f502575fa8e6ff36c9fab0bf3e">g_ZwQueryInformationProcess</a></div><div class="ttdeci">ZwQueryInformationProcess g_ZwQueryInformationProcess</div><div class="ttdoc">Address of ZwQueryInformationProcess.</div><div class="ttdef"><b>Definition</b> UserAccess.h:187</div></div>
<div class="ttc" id="a_user_access_8h_html_a2e58e91ee1d41c311736e026efcfe134"><div class="ttname"><a href="_user_access_8h.html#a2e58e91ee1d41c311736e026efcfe134">g_PsGetProcessPeb</a></div><div class="ttdeci">PsGetProcessPeb g_PsGetProcessPeb</div><div class="ttdoc">Address of PsGetProcessPeb.</div><div class="ttdef"><b>Definition</b> UserAccess.h:193</div></div>
<div class="ttc" id="a_user_access_8h_html_a586171a43627dbaf3dd3a68eef7d2954"><div class="ttname"><a href="_user_access_8h.html#a586171a43627dbaf3dd3a68eef7d2954">PsGetProcessWow64Process</a></div><div class="ttdeci">PPEB32(NTAPI * PsGetProcessWow64Process)(PEPROCESS Process)</div><div class="ttdef"><b>Definition</b> UserAccess.h:177</div></div>
<div class="ttc" id="a_user_access_8h_html_a7e5eee7c3615d4c3a4b2e080eebf3046"><div class="ttname"><a href="_user_access_8h.html#a7e5eee7c3615d4c3a4b2e080eebf3046">g_PsGetProcessWow64Process</a></div><div class="ttdeci">PsGetProcessWow64Process g_PsGetProcessWow64Process</div><div class="ttdoc">Address of PsGetProcessWow64Process.</div><div class="ttdef"><b>Definition</b> UserAccess.h:199</div></div>
<div class="ttc" id="a_user_access_8h_html_aeb00925a7719b80558821f57265bf112"><div class="ttname"><a href="_user_access_8h.html#aeb00925a7719b80558821f57265bf112">ZwQueryInformationProcess</a></div><div class="ttdeci">NTSTATUS(* ZwQueryInformationProcess)(__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __out_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength, __out_opt PULONG ReturnLength)</div><div class="ttdef"><b>Definition</b> UserAccess.h:168</div></div>
<div class="ttc" id="a_user_access_8h_html_aeea4e249b597d96d35bd6b3d310f940b"><div class="ttname"><a href="_user_access_8h.html#aeea4e249b597d96d35bd6b3d310f940b">PsGetProcessPeb</a></div><div class="ttdeci">PPEB(NTAPI * PsGetProcessPeb)(PEPROCESS Process)</div><div class="ttdef"><b>Definition</b> UserAccess.h:175</div></div>
<div class="ttc" id="astruct___u_n_i_c_o_d_e___s_t_r_i_n_g_html"><div class="ttname"><a href="struct___u_n_i_c_o_d_e___s_t_r_i_n_g.html">_UNICODE_STRING</a></div><div class="ttdef"><b>Definition</b> casting.cpp:25</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="ae631c2803c19685c4517a36470b7f169" name="ae631c2803c19685c4517a36470b7f169"></a>
<h2 class="memtitle"><span class="permalink"><a href="#ae631c2803c19685c4517a36470b7f169">&#9670;&#160;</a></span>AttachingKillProcess()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingKillProcess </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>KillRequest</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Kill the target process from kernel-mode. </p>
<p>this function should not be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">KillRequest</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1211</span>{</div>
<div class="line"><span class="lineno"> 1212</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail;</div>
<div class="line"><span class="lineno"> 1213</span>    <a class="code hl_typedef" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>                             WasKilled = <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1214</span> </div>
<div class="line"><span class="lineno"> 1215</span>    ProcessDebuggingDetail = <a class="code hl_function" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a>(KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>);</div>
<div class="line"><span class="lineno"> 1216</span> </div>
<div class="line"><span class="lineno"> 1217</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1218</span>    <span class="comment">// Check if process is valid in process debugging details</span></div>
<div class="line"><span class="lineno"> 1219</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1220</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetail)</div>
<div class="line"><span class="lineno"> 1221</span>    {</div>
<div class="line"><span class="lineno"> 1222</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1223</span>        <span class="comment">// not found</span></div>
<div class="line"><span class="lineno"> 1224</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1225</span>        KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a754ded78e3c9bd7cb2fef5c2212d6217">DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS</a>;</div>
<div class="line"><span class="lineno"> 1226</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1227</span>    }</div>
<div class="line"><span class="lineno"> 1228</span> </div>
<div class="line"><span class="lineno"> 1229</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1230</span>    <span class="comment">// Check if process exists or not</span></div>
<div class="line"><span class="lineno"> 1231</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1232</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="hyperkd_2code_2common_2_common_8c.html#ae93e2ecf590a45b6ef7e67e137cc2e62">CommonIsProcessExist</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ace267a6473505408e798a827e1b244f0">ProcessId</a>))</div>
<div class="line"><span class="lineno"> 1233</span>    {</div>
<div class="line"><span class="lineno"> 1234</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1235</span>        <span class="comment">// Process was killed before killing it here (not exists)</span></div>
<div class="line"><span class="lineno"> 1236</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1237</span> </div>
<div class="line"><span class="lineno"> 1238</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1239</span>        <span class="comment">// Remove the entry from the process debugging details list</span></div>
<div class="line"><span class="lineno"> 1240</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1241</span>        <a class="code hl_function" href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">Token</a>);</div>
<div class="line"><span class="lineno"> 1242</span> </div>
<div class="line"><span class="lineno"> 1243</span>        KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a886de0e26cbac524fa738ddb6c6ffa29">DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS</a>;</div>
<div class="line"><span class="lineno"> 1244</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1245</span>    }</div>
<div class="line"><span class="lineno"> 1246</span> </div>
<div class="line"><span class="lineno"> 1247</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1248</span>    <span class="comment">// Check if we can kill it using the first method</span></div>
<div class="line"><span class="lineno"> 1249</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1250</span>    WasKilled = <a class="code hl_function" href="hyperkd_2code_2common_2_common_8c.html#ac13f40af631c6a2bd02f137007d54998">CommonKillProcess</a>(KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>, <a class="code hl_enumvalue" href="hyperkd_2header_2common_2_common_8h.html#a6b5ea74a23199b25cd91da7cb7307f5fa8a7a9cbb4d530cb0fcd48b9c39a1ada7">PROCESS_KILL_METHOD_1</a>);</div>
<div class="line"><span class="lineno"> 1251</span> </div>
<div class="line"><span class="lineno"> 1252</span>    <span class="keywordflow">if</span> (WasKilled)</div>
<div class="line"><span class="lineno"> 1253</span>    {</div>
<div class="line"><span class="lineno"> 1254</span>        <span class="keywordflow">goto</span> Success;</div>
<div class="line"><span class="lineno"> 1255</span>    }</div>
<div class="line"><span class="lineno"> 1256</span> </div>
<div class="line"><span class="lineno"> 1257</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1258</span>    <span class="comment">// Check if we can kill it using the second method</span></div>
<div class="line"><span class="lineno"> 1259</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1260</span>    WasKilled = <a class="code hl_function" href="hyperkd_2code_2common_2_common_8c.html#ac13f40af631c6a2bd02f137007d54998">CommonKillProcess</a>(KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>, <a class="code hl_enumvalue" href="hyperkd_2header_2common_2_common_8h.html#a6b5ea74a23199b25cd91da7cb7307f5fa5fd6f785eb4eb8f824f4110f59c64483">PROCESS_KILL_METHOD_2</a>);</div>
<div class="line"><span class="lineno"> 1261</span> </div>
<div class="line"><span class="lineno"> 1262</span>    <span class="keywordflow">if</span> (WasKilled)</div>
<div class="line"><span class="lineno"> 1263</span>    {</div>
<div class="line"><span class="lineno"> 1264</span>        <span class="keywordflow">goto</span> Success;</div>
<div class="line"><span class="lineno"> 1265</span>    }</div>
<div class="line"><span class="lineno"> 1266</span> </div>
<div class="line"><span class="lineno"> 1267</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1268</span>    <span class="comment">// Check if we can kill it using the third method</span></div>
<div class="line"><span class="lineno"> 1269</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1270</span>    WasKilled = <a class="code hl_function" href="hyperkd_2code_2common_2_common_8c.html#ac13f40af631c6a2bd02f137007d54998">CommonKillProcess</a>(KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>, <a class="code hl_enumvalue" href="hyperkd_2header_2common_2_common_8h.html#a6b5ea74a23199b25cd91da7cb7307f5facdd6ffa2c41cbb645d9eb6339f845a43">PROCESS_KILL_METHOD_3</a>);</div>
<div class="line"><span class="lineno"> 1271</span> </div>
<div class="line"><span class="lineno"> 1272</span>    <span class="keywordflow">if</span> (WasKilled)</div>
<div class="line"><span class="lineno"> 1273</span>    {</div>
<div class="line"><span class="lineno"> 1274</span>        <span class="keywordflow">goto</span> Success;</div>
<div class="line"><span class="lineno"> 1275</span>    }</div>
<div class="line"><span class="lineno"> 1276</span> </div>
<div class="line"><span class="lineno"> 1277</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1278</span>    <span class="comment">// No way we can kill the shit :(</span></div>
<div class="line"><span class="lineno"> 1279</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1280</span>    KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a64fcd677a4690cae672a532e9e2b24bf">DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS</a>;</div>
<div class="line"><span class="lineno"> 1281</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1282</span> </div>
<div class="line"><span class="lineno"> 1283</span>Success:</div>
<div class="line"><span class="lineno"> 1284</span> </div>
<div class="line"><span class="lineno"> 1285</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1286</span>    <span class="comment">// Remove the entry from the process debugging details list</span></div>
<div class="line"><span class="lineno"> 1287</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1288</span>    <a class="code hl_function" href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">Token</a>);</div>
<div class="line"><span class="lineno"> 1289</span> </div>
<div class="line"><span class="lineno"> 1290</span>    KillRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a>;</div>
<div class="line"><span class="lineno"> 1291</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1292</span>}</div>
<div class="ttc" id="a_attaching_8c_html_aaadea1225d670dcdb595dafb4f8e6022"><div class="ttname"><a href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a></div><div class="ttdeci">BOOLEAN AttachingRemoveProcessDebuggingDetailsByToken(UINT64 Token)</div><div class="ttdoc">Remove user-mode debugging details for threads by its token.</div><div class="ttdef"><b>Definition</b> Attaching.c:257</div></div>
<div class="ttc" id="a_basic_types_8h_html_a1cb18096b299d23458d3c7b85fd86555"><div class="ttname"><a href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a></div><div class="ttdeci">UCHAR BOOLEAN</div><div class="ttdef"><b>Definition</b> BasicTypes.h:39</div></div>
<div class="ttc" id="a_error_codes_8h_html_a64fcd677a4690cae672a532e9e2b24bf"><div class="ttname"><a href="_error_codes_8h.html#a64fcd677a4690cae672a532e9e2b24bf">DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS</div><div class="ttdoc">error, unable to kill the target process</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:326</div></div>
<div class="ttc" id="a_error_codes_8h_html_a754ded78e3c9bd7cb2fef5c2212d6217"><div class="ttname"><a href="_error_codes_8h.html#a754ded78e3c9bd7cb2fef5c2212d6217">DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS</div><div class="ttdoc">error, the user debugger is not attached to the target process</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:350</div></div>
<div class="ttc" id="a_error_codes_8h_html_a886de0e26cbac524fa738ddb6c6ffa29"><div class="ttname"><a href="_error_codes_8h.html#a886de0e26cbac524fa738ddb6c6ffa29">DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS</div><div class="ttdoc">error, unable to kill the target process. process does not exists</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:417</div></div>
<div class="ttc" id="a_error_codes_8h_html_aed656c58434eecb2d7e8c10e93aecff4"><div class="ttname"><a href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a></div><div class="ttdeci">#define DEBUGGER_OPERATION_WAS_SUCCESSFUL</div><div class="ttdoc">General value to indicate that the operation or request was successful.</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:23</div></div>
<div class="ttc" id="ahyperkd_2code_2common_2_common_8c_html_ac13f40af631c6a2bd02f137007d54998"><div class="ttname"><a href="hyperkd_2code_2common_2_common_8c.html#ac13f40af631c6a2bd02f137007d54998">CommonKillProcess</a></div><div class="ttdeci">_Use_decl_annotations_ BOOLEAN CommonKillProcess(UINT32 ProcessId, PROCESS_KILL_METHODS KillingMethod)</div><div class="ttdoc">Kill a user-mode process with different methods.</div><div class="ttdef"><b>Definition</b> Common.c:159</div></div>
<div class="ttc" id="ahyperkd_2code_2common_2_common_8c_html_ae93e2ecf590a45b6ef7e67e137cc2e62"><div class="ttname"><a href="hyperkd_2code_2common_2_common_8c.html#ae93e2ecf590a45b6ef7e67e137cc2e62">CommonIsProcessExist</a></div><div class="ttdeci">BOOLEAN CommonIsProcessExist(UINT32 ProcId)</div><div class="ttdoc">Checks whether the process with ProcId exists or not.</div><div class="ttdef"><b>Definition</b> Common.c:24</div></div>
<div class="ttc" id="ahyperkd_2header_2common_2_common_8h_html_a6b5ea74a23199b25cd91da7cb7307f5fa5fd6f785eb4eb8f824f4110f59c64483"><div class="ttname"><a href="hyperkd_2header_2common_2_common_8h.html#a6b5ea74a23199b25cd91da7cb7307f5fa5fd6f785eb4eb8f824f4110f59c64483">PROCESS_KILL_METHOD_2</a></div><div class="ttdeci">@ PROCESS_KILL_METHOD_2</div><div class="ttdef"><b>Definition</b> Common.h:66</div></div>
<div class="ttc" id="ahyperkd_2header_2common_2_common_8h_html_a6b5ea74a23199b25cd91da7cb7307f5fa8a7a9cbb4d530cb0fcd48b9c39a1ada7"><div class="ttname"><a href="hyperkd_2header_2common_2_common_8h.html#a6b5ea74a23199b25cd91da7cb7307f5fa8a7a9cbb4d530cb0fcd48b9c39a1ada7">PROCESS_KILL_METHOD_1</a></div><div class="ttdeci">@ PROCESS_KILL_METHOD_1</div><div class="ttdef"><b>Definition</b> Common.h:65</div></div>
<div class="ttc" id="ahyperkd_2header_2common_2_common_8h_html_a6b5ea74a23199b25cd91da7cb7307f5facdd6ffa2c41cbb645d9eb6339f845a43"><div class="ttname"><a href="hyperkd_2header_2common_2_common_8h.html#a6b5ea74a23199b25cd91da7cb7307f5facdd6ffa2c41cbb645d9eb6339f845a43">PROCESS_KILL_METHOD_3</a></div><div class="ttdeci">@ PROCESS_KILL_METHOD_3</div><div class="ttdef"><b>Definition</b> Common.h:67</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_a33b1c240af7027649bf87dcc6a18d8d2"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::ProcessId</a></div><div class="ttdeci">UINT32 ProcessId</div><div class="ttdef"><b>Definition</b> RequestStructures.h:633</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_a59469a1f2267eabd6b5ce5e1fc826145"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::Result</a></div><div class="ttdeci">UINT64 Result</div><div class="ttdef"><b>Definition</b> RequestStructures.h:641</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="aa9fb4120d9e11c187b7a722ba6c7818c" name="aa9fb4120d9e11c187b7a722ba6c7818c"></a>
<h2 class="memtitle"><span class="permalink"><a href="#aa9fb4120d9e11c187b7a722ba6c7818c">&#9670;&#160;</a></span>AttachingPauseProcess()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingPauseProcess </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>PauseRequest</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Pauses the target process. </p>
<p>this function should not be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">PauseRequest</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1186</span>{</div>
<div class="line"><span class="lineno"> 1187</span>    <span class="keywordflow">if</span> (<a class="code hl_function" href="#a7f67611f7474cb9199c0b941fcf82a85">AttachingConfigureInterceptingThreads</a>(PauseRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a5b25bfe616f7a120d2a4ab6921c64540">Token</a>, <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>))</div>
<div class="line"><span class="lineno"> 1188</span>    {</div>
<div class="line"><span class="lineno"> 1189</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1190</span>        <span class="comment">// The pausing operation was successful</span></div>
<div class="line"><span class="lineno"> 1191</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1192</span>        PauseRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a>;</div>
<div class="line"><span class="lineno"> 1193</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1194</span>    }</div>
<div class="line"><span class="lineno"> 1195</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno"> 1196</span>    {</div>
<div class="line"><span class="lineno"> 1197</span>        PauseRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a53a93f9aeaa69e1ee26c2c88cf5aa818">DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS</a>;</div>
<div class="line"><span class="lineno"> 1198</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1199</span>    }</div>
<div class="line"><span class="lineno"> 1200</span>}</div>
<div class="ttc" id="a_attaching_8c_html_a7f67611f7474cb9199c0b941fcf82a85"><div class="ttname"><a href="#a7f67611f7474cb9199c0b941fcf82a85">AttachingConfigureInterceptingThreads</a></div><div class="ttdeci">BOOLEAN AttachingConfigureInterceptingThreads(UINT64 ProcessDebuggingToken, BOOLEAN Enable)</div><div class="ttdoc">Enable or disable the thread intercepting phase.</div><div class="ttdef"><b>Definition</b> Attaching.c:695</div></div>
<div class="ttc" id="a_error_codes_8h_html_a53a93f9aeaa69e1ee26c2c88cf5aa818"><div class="ttname"><a href="_error_codes_8h.html#a53a93f9aeaa69e1ee26c2c88cf5aa818">DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS</div><div class="ttdoc">error, unable to pause the process's threads</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:338</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_a5b25bfe616f7a120d2a4ab6921c64540"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a5b25bfe616f7a120d2a4ab6921c64540">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::Token</a></div><div class="ttdeci">UINT64 Token</div><div class="ttdef"><b>Definition</b> RequestStructures.h:640</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="aa2294a8797b41cc7787eeb68672689b9" name="aa2294a8797b41cc7787eeb68672689b9"></a>
<h2 class="memtitle"><span class="permalink"><a href="#aa2294a8797b41cc7787eeb68672689b9">&#9670;&#160;</a></span>AttachingPerformAttachToProcess()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingPerformAttachToProcess </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>AttachRequest</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a></td>          <td class="paramname"><span class="paramname"><em>IsAttachingToEntrypoint</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Attach to the target process. </p>
<p>this function should not be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">AttachRequest</td><td></td></tr>
    <tr><td class="paramname">IsAttachingToEntrypoint</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  809</span>{</div>
<div class="line"><span class="lineno">  810</span>    PEPROCESS                                    SourceProcess;</div>
<div class="line"><span class="lineno">  811</span>    <a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>                                       ProcessDebuggingToken;</div>
<div class="line"><span class="lineno">  812</span>    <a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>                                       PebAddressToMonitor;</div>
<div class="line"><span class="lineno">  813</span>    <a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>                                       UsermodeReservedBuffer;</div>
<div class="line"><span class="lineno">  814</span>    <a class="code hl_typedef" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>                                      ResultOfApplyingEvent;</div>
<div class="line"><span class="lineno">  815</span>    <a class="code hl_typedef" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a>                                      Is32Bit;</div>
<div class="line"><span class="lineno">  816</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a>          TempProcessDebuggingDetail;</div>
<div class="line"><span class="lineno">  817</span>    <a class="code hl_struct" href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html">EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR</a> EptHookDetails = {0};</div>
<div class="line"><span class="lineno">  818</span> </div>
<div class="line"><span class="lineno">  819</span>    <span class="keywordflow">if</span> (<a class="code hl_variable" href="_user_access_8h.html#a7e5eee7c3615d4c3a4b2e080eebf3046">g_PsGetProcessWow64Process</a> == NULL || <a class="code hl_variable" href="_user_access_8h.html#a2e58e91ee1d41c311736e026efcfe134">g_PsGetProcessPeb</a> == NULL)</div>
<div class="line"><span class="lineno">  820</span>    {</div>
<div class="line"><span class="lineno">  821</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aacd04c209d36dbdb4318221a16b80f3a">DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED</a>;</div>
<div class="line"><span class="lineno">  822</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  823</span>    }</div>
<div class="line"><span class="lineno">  824</span> </div>
<div class="line"><span class="lineno">  825</span>    <span class="keywordflow">if</span> (PsLookupProcessByProcessId((HANDLE)AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>, &amp;SourceProcess) != STATUS_SUCCESS)</div>
<div class="line"><span class="lineno">  826</span>    {</div>
<div class="line"><span class="lineno">  827</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  828</span>        <span class="comment">// if the process not found</span></div>
<div class="line"><span class="lineno">  829</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  830</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno">  831</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  832</span>    }</div>
<div class="line"><span class="lineno">  833</span> </div>
<div class="line"><span class="lineno">  834</span>    ObDereferenceObject(SourceProcess);</div>
<div class="line"><span class="lineno">  835</span> </div>
<div class="line"><span class="lineno">  836</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  837</span>    <span class="comment">// Check to avoid double attaching to a process</span></div>
<div class="line"><span class="lineno">  838</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  839</span>    TempProcessDebuggingDetail = <a class="code hl_function" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a>(AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>);</div>
<div class="line"><span class="lineno">  840</span> </div>
<div class="line"><span class="lineno">  841</span>    <span class="keywordflow">if</span> (TempProcessDebuggingDetail != NULL &amp;&amp; TempProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af3376ddf4a0eed532aa22d4be1747764">Eprocess</a> == SourceProcess)</div>
<div class="line"><span class="lineno">  842</span>    {</div>
<div class="line"><span class="lineno">  843</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  844</span>        <span class="comment">// The user already attached to this process</span></div>
<div class="line"><span class="lineno">  845</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  846</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a875e9c33a86932bdca49301c76c9eba5">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS</a>;</div>
<div class="line"><span class="lineno">  847</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  848</span>    }</div>
<div class="line"><span class="lineno">  849</span> </div>
<div class="line"><span class="lineno">  850</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  851</span>    <span class="comment">// check whether the target process is 32-bit or 64-bit</span></div>
<div class="line"><span class="lineno">  852</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  853</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="_user_access_8c.html#afea1379e1a9acca82a320d700b63a7b8">UserAccessIsWow64Process</a>((HANDLE)AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>, &amp;Is32Bit))</div>
<div class="line"><span class="lineno">  854</span>    {</div>
<div class="line"><span class="lineno">  855</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  856</span>        <span class="comment">// Unable to detect whether it&#39;s 32-bit or 64-bit</span></div>
<div class="line"><span class="lineno">  857</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  858</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a0cddf5a29ba54e91a4307ec8b82b9bd8">DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS</a>;</div>
<div class="line"><span class="lineno">  859</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  860</span>    }</div>
<div class="line"><span class="lineno">  861</span> </div>
<div class="line"><span class="lineno">  862</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  863</span>    <span class="comment">// Set the Is32Bit flag of attach request</span></div>
<div class="line"><span class="lineno">  864</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  865</span>    AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aaa51248611cfb936485165be2b3b4a4d">Is32Bit</a> = Is32Bit;</div>
<div class="line"><span class="lineno">  866</span> </div>
<div class="line"><span class="lineno">  867</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  868</span>    <span class="comment">// Get 32-bit or 64-bit PEB</span></div>
<div class="line"><span class="lineno">  869</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  870</span>    <span class="keywordflow">if</span> (Is32Bit)</div>
<div class="line"><span class="lineno">  871</span>    {</div>
<div class="line"><span class="lineno">  872</span>        PebAddressToMonitor = (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)((<a class="code hl_struct" href="struct___p_e_b32.html">PPEB32</a>)<a class="code hl_variable" href="_user_access_8h.html#a7e5eee7c3615d4c3a4b2e080eebf3046">g_PsGetProcessWow64Process</a>(SourceProcess));</div>
<div class="line"><span class="lineno">  873</span>    }</div>
<div class="line"><span class="lineno">  874</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno">  875</span>    {</div>
<div class="line"><span class="lineno">  876</span>        PebAddressToMonitor = (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)((<a class="code hl_struct" href="struct___p_e_b.html">PPEB</a>)<a class="code hl_variable" href="_user_access_8h.html#a2e58e91ee1d41c311736e026efcfe134">g_PsGetProcessPeb</a>(SourceProcess));</div>
<div class="line"><span class="lineno">  877</span>    }</div>
<div class="line"><span class="lineno">  878</span> </div>
<div class="line"><span class="lineno">  879</span>    <span class="keywordflow">if</span> (PebAddressToMonitor == (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)<a class="code hl_function" href="namespacetest-case-generator.html#a9a4eff80432bb93d2796381610dd86c3">NULL</a>)</div>
<div class="line"><span class="lineno">  880</span>    {</div>
<div class="line"><span class="lineno">  881</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno">  882</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  883</span>    }</div>
<div class="line"><span class="lineno">  884</span> </div>
<div class="line"><span class="lineno">  885</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  886</span>    <span class="comment">// allocate memory in the target user-mode process</span></div>
<div class="line"><span class="lineno">  887</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  888</span>    UsermodeReservedBuffer = <a class="code hl_function" href="_memory_mapper_8c.html#af33b9ea11e566e581c2fded8dc23438f">MemoryMapperReserveUsermodeAddressOnTargetProcess</a>(AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>, <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>);</div>
<div class="line"><span class="lineno">  889</span> </div>
<div class="line"><span class="lineno">  890</span>    <span class="keywordflow">if</span> (UsermodeReservedBuffer == (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)NULL)</div>
<div class="line"><span class="lineno">  891</span>    {</div>
<div class="line"><span class="lineno">  892</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno">  893</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  894</span>    }</div>
<div class="line"><span class="lineno">  895</span> </div>
<div class="line"><span class="lineno">  896</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  897</span>    <span class="comment">// Adjust the nop sled buffer</span></div>
<div class="line"><span class="lineno">  898</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  899</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="#a5d48d4a604f0d7effefad660da3aaf4a">AttachingAdjustNopSledBuffer</a>(UsermodeReservedBuffer,</div>
<div class="line"><span class="lineno">  900</span>                                      AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>))</div>
<div class="line"><span class="lineno">  901</span>    {</div>
<div class="line"><span class="lineno">  902</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno">  903</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  904</span>    }</div>
<div class="line"><span class="lineno">  905</span> </div>
<div class="line"><span class="lineno">  906</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  907</span>    <span class="comment">// Log for test</span></div>
<div class="line"><span class="lineno">  908</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  909</span>    <span class="comment">// LogInfo(&quot;Reserved address on the target process: %llx\n&quot;, UsermodeReservedBuffer);</span></div>
<div class="line"><span class="lineno">  910</span> </div>
<div class="line"><span class="lineno">  911</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  912</span>    <span class="comment">// Create the debugging detail for process</span></div>
<div class="line"><span class="lineno">  913</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  914</span>    ProcessDebuggingToken = <a class="code hl_function" href="#a593f7e7ea84362b61dad501869a7b998">AttachingCreateProcessDebuggingDetails</a>(AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>,</div>
<div class="line"><span class="lineno">  915</span>                                                                   <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>,</div>
<div class="line"><span class="lineno">  916</span>                                                                   Is32Bit,</div>
<div class="line"><span class="lineno">  917</span>                                                                   AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a2352164ae6f06c5aefa934be518827ae">CheckCallbackAtFirstInstruction</a>,</div>
<div class="line"><span class="lineno">  918</span>                                                                   SourceProcess,</div>
<div class="line"><span class="lineno">  919</span>                                                                   PebAddressToMonitor,</div>
<div class="line"><span class="lineno">  920</span>                                                                   UsermodeReservedBuffer);</div>
<div class="line"><span class="lineno">  921</span> </div>
<div class="line"><span class="lineno">  922</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  923</span>    <span class="comment">// Check if we successfully get the token</span></div>
<div class="line"><span class="lineno">  924</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  925</span>    <span class="keywordflow">if</span> (ProcessDebuggingToken == (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)NULL)</div>
<div class="line"><span class="lineno">  926</span>    {</div>
<div class="line"><span class="lineno">  927</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno">  928</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  929</span>    }</div>
<div class="line"><span class="lineno">  930</span> </div>
<div class="line"><span class="lineno">  931</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  932</span>    <span class="comment">// Check if it&#39;s attaching at entrypoint or attaching to a previously running process</span></div>
<div class="line"><span class="lineno">  933</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  934</span>    <span class="keywordflow">if</span> (IsAttachingToEntrypoint)</div>
<div class="line"><span class="lineno">  935</span>    {</div>
<div class="line"><span class="lineno">  936</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  937</span>        <span class="comment">// *** attaching to the entrypoint of the process ***</span></div>
<div class="line"><span class="lineno">  938</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  939</span> </div>
<div class="line"><span class="lineno">  940</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  941</span>        <span class="comment">// Check whether any special initialization for thread safe features</span></div>
<div class="line"><span class="lineno">  942</span>        <span class="comment">// is needed or not</span></div>
<div class="line"><span class="lineno">  943</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  944</span>        <span class="keywordflow">if</span> (AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a2352164ae6f06c5aefa934be518827ae">CheckCallbackAtFirstInstruction</a>)</div>
<div class="line"><span class="lineno">  945</span>        {</div>
<div class="line"><span class="lineno">  946</span>            <a class="code hl_function" href="#a96029792901bb04ae2baa8acfacdd5a7">AttachingCheckForSafeCallbackRequestedInitializations</a>(AttachRequest, ProcessDebuggingToken);</div>
<div class="line"><span class="lineno">  947</span>        }</div>
<div class="line"><span class="lineno">  948</span> </div>
<div class="line"><span class="lineno">  949</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  950</span>        <span class="comment">// Waiting for #DB to be triggered</span></div>
<div class="line"><span class="lineno">  951</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  952</span>        <a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae4b7e6d3d73fbc5e36dab0e432cfda0e">g_IsWaitingForUserModeProcessEntryToBeCalled</a> = <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  953</span> </div>
<div class="line"><span class="lineno">  954</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  955</span>        <span class="comment">// Set the starting point of the thread</span></div>
<div class="line"><span class="lineno">  956</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  957</span>        <span class="keywordflow">if</span> (!<a class="code hl_function" href="#a3d3e20ec99d70f3b498c332625729a3d">AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken</a>(<a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>, ProcessDebuggingToken))</div>
<div class="line"><span class="lineno">  958</span>        {</div>
<div class="line"><span class="lineno">  959</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  960</span>            <span class="comment">// Remove the created thread debugging detail</span></div>
<div class="line"><span class="lineno">  961</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  962</span>            <a class="code hl_function" href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a>(ProcessDebuggingToken);</div>
<div class="line"><span class="lineno">  963</span> </div>
<div class="line"><span class="lineno">  964</span>            <a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae4b7e6d3d73fbc5e36dab0e432cfda0e">g_IsWaitingForUserModeProcessEntryToBeCalled</a> = <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  965</span>            AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a>                        = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno">  966</span>            <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  967</span>        }</div>
<div class="line"><span class="lineno">  968</span> </div>
<div class="line"><span class="lineno">  969</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  970</span>        <span class="comment">// Apply monitor memory range to the PEB address</span></div>
<div class="line"><span class="lineno">  971</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  972</span> </div>
<div class="line"><span class="lineno">  973</span>        EptHookDetails.<a class="code hl_variable" href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a021aecb95053d3afe80f0a352e18c1ed">StartAddress</a> = PebAddressToMonitor;</div>
<div class="line"><span class="lineno">  974</span> </div>
<div class="line"><span class="lineno">  975</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  976</span>        <span class="comment">// both start and the end are at the same address</span></div>
<div class="line"><span class="lineno">  977</span>        <span class="comment">// because it hooks an entire page anyway</span></div>
<div class="line"><span class="lineno">  978</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  979</span>        EptHookDetails.<a class="code hl_variable" href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a6c68c91d630210a1444aa81d84186552">EndAddress</a>      = PebAddressToMonitor;</div>
<div class="line"><span class="lineno">  980</span>        EptHookDetails.<a class="code hl_variable" href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a1f367f5b7efe248dbd47274bef74234d">SetHookForRead</a>  = <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  981</span>        EptHookDetails.<a class="code hl_variable" href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a524bb61dcc2c90eb0bb237b793cac170">SetHookForWrite</a> = <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  982</span>        EptHookDetails.<a class="code hl_variable" href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#af1b3604662e0d10b28c02b4f985621da">SetHookForExec</a>  = <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  983</span> </div>
<div class="line"><span class="lineno">  984</span>        ResultOfApplyingEvent = <a class="code hl_function" href="_debugger_events_8c.html#a11566aadb13e70f26cbe544cac96da18">DebuggerEventEnableMonitorReadWriteExec</a>(</div>
<div class="line"><span class="lineno">  985</span>            &amp;EptHookDetails,</div>
<div class="line"><span class="lineno">  986</span>            AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>,</div>
<div class="line"><span class="lineno">  987</span>            <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a> <span class="comment">// Applied from VMX non-root mode</span></div>
<div class="line"><span class="lineno">  988</span>        );</div>
<div class="line"><span class="lineno">  989</span> </div>
<div class="line"><span class="lineno">  990</span>        <span class="keywordflow">if</span> (!ResultOfApplyingEvent)</div>
<div class="line"><span class="lineno">  991</span>        {</div>
<div class="line"><span class="lineno">  992</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  993</span>            <span class="comment">// Remove the created thread debugging detail</span></div>
<div class="line"><span class="lineno">  994</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno">  995</span>            <a class="code hl_function" href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a>(ProcessDebuggingToken);</div>
<div class="line"><span class="lineno">  996</span> </div>
<div class="line"><span class="lineno">  997</span>            <a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae4b7e6d3d73fbc5e36dab0e432cfda0e">g_IsWaitingForUserModeProcessEntryToBeCalled</a> = <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  998</span>            AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a>                        = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno">  999</span>            <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1000</span>        }</div>
<div class="line"><span class="lineno"> 1001</span>    }</div>
<div class="line"><span class="lineno"> 1002</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno"> 1003</span>    {</div>
<div class="line"><span class="lineno"> 1004</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1005</span>        <span class="comment">// *** attaching to previously running process ***</span></div>
<div class="line"><span class="lineno"> 1006</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1007</span>        <span class="keywordflow">if</span> (!<a class="code hl_function" href="#a7f67611f7474cb9199c0b941fcf82a85">AttachingConfigureInterceptingThreads</a>(ProcessDebuggingToken, <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>))</div>
<div class="line"><span class="lineno"> 1008</span>        {</div>
<div class="line"><span class="lineno"> 1009</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1010</span>            <span class="comment">// Remove the created thread debugging details</span></div>
<div class="line"><span class="lineno"> 1011</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1012</span>            <a class="code hl_function" href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a>(ProcessDebuggingToken);</div>
<div class="line"><span class="lineno"> 1013</span> </div>
<div class="line"><span class="lineno"> 1014</span>            AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a>;</div>
<div class="line"><span class="lineno"> 1015</span>            <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1016</span>        }</div>
<div class="line"><span class="lineno"> 1017</span>    }</div>
<div class="line"><span class="lineno"> 1018</span> </div>
<div class="line"><span class="lineno"> 1019</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1020</span>    <span class="comment">// Operation was successful</span></div>
<div class="line"><span class="lineno"> 1021</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1022</span>    AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a5b25bfe616f7a120d2a4ab6921c64540">Token</a>  = ProcessDebuggingToken;</div>
<div class="line"><span class="lineno"> 1023</span>    AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a>;</div>
<div class="line"><span class="lineno"> 1024</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1025</span>}</div>
<div class="ttc" id="a_attaching_8c_html_a3d3e20ec99d70f3b498c332625729a3d"><div class="ttname"><a href="#a3d3e20ec99d70f3b498c332625729a3d">AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken</a></div><div class="ttdeci">BOOLEAN AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken(BOOLEAN Set, UINT64 Token)</div><div class="ttdoc">Set the start up phase of a debugging thread buffer by its token.</div><div class="ttdef"><b>Definition</b> Attaching.c:300</div></div>
<div class="ttc" id="a_attaching_8c_html_a593f7e7ea84362b61dad501869a7b998"><div class="ttname"><a href="#a593f7e7ea84362b61dad501869a7b998">AttachingCreateProcessDebuggingDetails</a></div><div class="ttdeci">UINT64 AttachingCreateProcessDebuggingDetails(UINT32 ProcessId, BOOLEAN Enabled, BOOLEAN Is32Bit, BOOLEAN CheckCallbackAtFirstInstruction, PEPROCESS Eprocess, UINT64 PebAddressToMonitor, UINT64 UsermodeReservedBuffer)</div><div class="ttdoc">Create user-mode debugging details for threads.</div><div class="ttdef"><b>Definition</b> Attaching.c:100</div></div>
<div class="ttc" id="a_attaching_8c_html_a5d48d4a604f0d7effefad660da3aaf4a"><div class="ttname"><a href="#a5d48d4a604f0d7effefad660da3aaf4a">AttachingAdjustNopSledBuffer</a></div><div class="ttdeci">BOOLEAN AttachingAdjustNopSledBuffer(UINT64 ReservedBuffAddress, UINT32 ProcessId)</div><div class="ttdoc">Allocate a nop-sled buffer.</div><div class="ttdef"><b>Definition</b> Attaching.c:557</div></div>
<div class="ttc" id="a_attaching_8c_html_a96029792901bb04ae2baa8acfacdd5a7"><div class="ttname"><a href="#a96029792901bb04ae2baa8acfacdd5a7">AttachingCheckForSafeCallbackRequestedInitializations</a></div><div class="ttdeci">BOOLEAN AttachingCheckForSafeCallbackRequestedInitializations(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS AttachRequest, UINT64 ProcessDebuggingToken)</div><div class="ttdoc">This function checks whether any special initialization is needed while attaching to a process that r...</div><div class="ttdef"><b>Definition</b> Attaching.c:785</div></div>
<div class="ttc" id="a_debugger_events_8c_html_a11566aadb13e70f26cbe544cac96da18"><div class="ttname"><a href="_debugger_events_8c.html#a11566aadb13e70f26cbe544cac96da18">DebuggerEventEnableMonitorReadWriteExec</a></div><div class="ttdeci">BOOLEAN DebuggerEventEnableMonitorReadWriteExec(EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *HookingDetails, UINT32 ProcessId, BOOLEAN ApplyDirectlyFromVmxRoot)</div><div class="ttdoc">Apply monitor ept hook events for address.</div><div class="ttdef"><b>Definition</b> DebuggerEvents.c:68</div></div>
<div class="ttc" id="a_error_codes_8h_html_a0cddf5a29ba54e91a4307ec8b82b9bd8"><div class="ttname"><a href="_error_codes_8h.html#a0cddf5a29ba54e91a4307ec8b82b9bd8">DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS</div><div class="ttdoc">error, unable to get 32-bit or 64-bit of the target process</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:320</div></div>
<div class="ttc" id="a_error_codes_8h_html_a875e9c33a86932bdca49301c76c9eba5"><div class="ttname"><a href="_error_codes_8h.html#a875e9c33a86932bdca49301c76c9eba5">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS</div><div class="ttdoc">error, user debugger already attached to this process</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:344</div></div>
<div class="ttc" id="a_error_codes_8h_html_aabd1822f9ddb38b6bc0f7b1bf6a451a7"><div class="ttname"><a href="_error_codes_8h.html#aabd1822f9ddb38b6bc0f7b1bf6a451a7">DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS</div><div class="ttdoc">error, failed to attach to the target user-mode process</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:294</div></div>
<div class="ttc" id="a_error_codes_8h_html_aacd04c209d36dbdb4318221a16b80f3a"><div class="ttname"><a href="_error_codes_8h.html#aacd04c209d36dbdb4318221a16b80f3a">DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED</a></div><div class="ttdeci">#define DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED</div><div class="ttdoc">error, the needed routines for debugging is not initialized</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:314</div></div>
<div class="ttc" id="a_memory_mapper_8c_html_af33b9ea11e566e581c2fded8dc23438f"><div class="ttname"><a href="_memory_mapper_8c.html#af33b9ea11e566e581c2fded8dc23438f">MemoryMapperReserveUsermodeAddressOnTargetProcess</a></div><div class="ttdeci">_Use_decl_annotations_ UINT64 MemoryMapperReserveUsermodeAddressOnTargetProcess(UINT32 ProcessId, BOOLEAN Allocate)</div><div class="ttdoc">Reserve user mode address (not allocated) in the target user mode application.</div><div class="ttdef"><b>Definition</b> MemoryMapper.c:1457</div></div>
<div class="ttc" id="a_user_access_8c_html_afea1379e1a9acca82a320d700b63a7b8"><div class="ttname"><a href="_user_access_8c.html#afea1379e1a9acca82a320d700b63a7b8">UserAccessIsWow64Process</a></div><div class="ttdeci">BOOLEAN UserAccessIsWow64Process(HANDLE ProcessId, PBOOLEAN Is32Bit)</div><div class="ttdoc">Detects whether process is 32-bit or 64-bit.</div><div class="ttdef"><b>Definition</b> UserAccess.c:753</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_a2352164ae6f06c5aefa934be518827ae"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a2352164ae6f06c5aefa934be518827ae">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::CheckCallbackAtFirstInstruction</a></div><div class="ttdeci">BOOLEAN CheckCallbackAtFirstInstruction</div><div class="ttdef"><b>Definition</b> RequestStructures.h:635</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_aaa51248611cfb936485165be2b3b4a4d"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aaa51248611cfb936485165be2b3b4a4d">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::Is32Bit</a></div><div class="ttdeci">BOOLEAN Is32Bit</div><div class="ttdef"><b>Definition</b> RequestStructures.h:636</div></div>
<div class="ttc" id="astruct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r_html"><div class="ttname"><a href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html">_EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR</a></div><div class="ttdoc">Setting details for EPT Hooks (!monitor)</div><div class="ttdef"><b>Definition</b> DataTypes.h:331</div></div>
<div class="ttc" id="astruct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r_html_a021aecb95053d3afe80f0a352e18c1ed"><div class="ttname"><a href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a021aecb95053d3afe80f0a352e18c1ed">_EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR::StartAddress</a></div><div class="ttdeci">UINT64 StartAddress</div><div class="ttdef"><b>Definition</b> DataTypes.h:332</div></div>
<div class="ttc" id="astruct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r_html_a1f367f5b7efe248dbd47274bef74234d"><div class="ttname"><a href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a1f367f5b7efe248dbd47274bef74234d">_EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR::SetHookForRead</a></div><div class="ttdeci">BOOLEAN SetHookForRead</div><div class="ttdef"><b>Definition</b> DataTypes.h:334</div></div>
<div class="ttc" id="astruct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r_html_a524bb61dcc2c90eb0bb237b793cac170"><div class="ttname"><a href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a524bb61dcc2c90eb0bb237b793cac170">_EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR::SetHookForWrite</a></div><div class="ttdeci">BOOLEAN SetHookForWrite</div><div class="ttdef"><b>Definition</b> DataTypes.h:335</div></div>
<div class="ttc" id="astruct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r_html_a6c68c91d630210a1444aa81d84186552"><div class="ttname"><a href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#a6c68c91d630210a1444aa81d84186552">_EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR::EndAddress</a></div><div class="ttdeci">UINT64 EndAddress</div><div class="ttdef"><b>Definition</b> DataTypes.h:333</div></div>
<div class="ttc" id="astruct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r_html_af1b3604662e0d10b28c02b4f985621da"><div class="ttname"><a href="struct___e_p_t___h_o_o_k_s___a_d_d_r_e_s_s___d_e_t_a_i_l_s___f_o_r___m_e_m_o_r_y___m_o_n_i_t_o_r.html#af1b3604662e0d10b28c02b4f985621da">_EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR::SetHookForExec</a></div><div class="ttdeci">BOOLEAN SetHookForExec</div><div class="ttdef"><b>Definition</b> DataTypes.h:336</div></div>
<div class="ttc" id="astruct___p_e_b32_html"><div class="ttname"><a href="struct___p_e_b32.html">_PEB32</a></div><div class="ttdoc">PEB 32-bit.</div><div class="ttdef"><b>Definition</b> UserAccess.h:82</div></div>
<div class="ttc" id="astruct___p_e_b_html"><div class="ttname"><a href="struct___p_e_b.html">_PEB</a></div><div class="ttdoc">PEB 64-bit.</div><div class="ttdef"><b>Definition</b> UserAccess.h:55</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="a8f5b7ae763989ea4c219eada9c8889c6" name="a8f5b7ae763989ea4c219eada9c8889c6"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a8f5b7ae763989ea4c219eada9c8889c6">&#9670;&#160;</a></span>AttachingPerformDetach()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingPerformDetach </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>DetachRequest</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Clearing hooks after resuming the process. </p>
<p>this function should not be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">DetachRequest</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1303</span>{</div>
<div class="line"><span class="lineno"> 1304</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail;</div>
<div class="line"><span class="lineno"> 1305</span> </div>
<div class="line"><span class="lineno"> 1306</span>    ProcessDebuggingDetail = <a class="code hl_function" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a>(DetachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>);</div>
<div class="line"><span class="lineno"> 1307</span> </div>
<div class="line"><span class="lineno"> 1308</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1309</span>    <span class="comment">// Check if process is valid in process debugging details</span></div>
<div class="line"><span class="lineno"> 1310</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1311</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetail)</div>
<div class="line"><span class="lineno"> 1312</span>    {</div>
<div class="line"><span class="lineno"> 1313</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1314</span>        <span class="comment">// not found</span></div>
<div class="line"><span class="lineno"> 1315</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1316</span>        DetachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a754ded78e3c9bd7cb2fef5c2212d6217">DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS</a>;</div>
<div class="line"><span class="lineno"> 1317</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1318</span>    }</div>
<div class="line"><span class="lineno"> 1319</span> </div>
<div class="line"><span class="lineno"> 1320</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1321</span>    <span class="comment">// If the threads are paused, we can&#39;t detach from the target process</span></div>
<div class="line"><span class="lineno"> 1322</span>    <span class="comment">// before sending this request, the debugger should continued all the</span></div>
<div class="line"><span class="lineno"> 1323</span>    <span class="comment">// threads by sending a continue packet</span></div>
<div class="line"><span class="lineno"> 1324</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1325</span>    <span class="keywordflow">if</span> (<a class="code hl_function" href="_thread_holder_8c.html#afd1b9edf45c36db1744c2253b4e84a34">ThreadHolderIsAnyPausedThreadInProcess</a>(ProcessDebuggingDetail))</div>
<div class="line"><span class="lineno"> 1326</span>    {</div>
<div class="line"><span class="lineno"> 1327</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1328</span>        <span class="comment">// We found a thread that is still pause</span></div>
<div class="line"><span class="lineno"> 1329</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1330</span>        DetachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a9349d9c56010c4b4ba24e0850c68a6aa">DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS</a>;</div>
<div class="line"><span class="lineno"> 1331</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1332</span>    }</div>
<div class="line"><span class="lineno"> 1333</span> </div>
<div class="line"><span class="lineno"> 1334</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1335</span>    <span class="comment">// Free the reserved memory in the target process</span></div>
<div class="line"><span class="lineno"> 1336</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1337</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="_memory_mapper_8c.html#aec048dd8d32ab2f799b69104fa03ddd6">MemoryMapperFreeMemoryOnTargetProcess</a>(DetachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>,</div>
<div class="line"><span class="lineno"> 1338</span>                                               (PVOID)ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ac2d3522e9585dce69980ff651c53cb1d">UsermodeReservedBuffer</a>))</div>
<div class="line"><span class="lineno"> 1339</span>    {</div>
<div class="line"><span class="lineno"> 1340</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1341</span>        <span class="comment">// Still, we continue, no need to abort the operation</span></div>
<div class="line"><span class="lineno"> 1342</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1343</span>        <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a>(<span class="stringliteral">&quot;Err, cannot deallocate reserved buffer in the detached process&quot;</span>);</div>
<div class="line"><span class="lineno"> 1344</span>    }</div>
<div class="line"><span class="lineno"> 1345</span> </div>
<div class="line"><span class="lineno"> 1346</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1347</span>    <span class="comment">// Remove the entry from the process debugging details list</span></div>
<div class="line"><span class="lineno"> 1348</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1349</span>    <a class="code hl_function" href="#aaadea1225d670dcdb595dafb4f8e6022">AttachingRemoveProcessDebuggingDetailsByToken</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">Token</a>);</div>
<div class="line"><span class="lineno"> 1350</span> </div>
<div class="line"><span class="lineno"> 1351</span>    DetachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a>;</div>
<div class="line"><span class="lineno"> 1352</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1353</span>}</div>
<div class="ttc" id="a_error_codes_8h_html_a9349d9c56010c4b4ba24e0850c68a6aa"><div class="ttname"><a href="_error_codes_8h.html#a9349d9c56010c4b4ba24e0850c68a6aa">DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS</div><div class="ttdoc">error, cannot detach from the process as there are paused threads</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:356</div></div>
<div class="ttc" id="a_memory_mapper_8c_html_aec048dd8d32ab2f799b69104fa03ddd6"><div class="ttname"><a href="_memory_mapper_8c.html#aec048dd8d32ab2f799b69104fa03ddd6">MemoryMapperFreeMemoryOnTargetProcess</a></div><div class="ttdeci">_Use_decl_annotations_ BOOLEAN MemoryMapperFreeMemoryOnTargetProcess(UINT32 ProcessId, PVOID BaseAddress)</div><div class="ttdoc">Deallocates a previously reserved user mode address in the target user mode application.</div><div class="ttdef"><b>Definition</b> MemoryMapper.c:1537</div></div>
<div class="ttc" id="a_thread_holder_8c_html_afd1b9edf45c36db1744c2253b4e84a34"><div class="ttname"><a href="_thread_holder_8c.html#afd1b9edf45c36db1744c2253b4e84a34">ThreadHolderIsAnyPausedThreadInProcess</a></div><div class="ttdeci">BOOLEAN ThreadHolderIsAnyPausedThreadInProcess(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)</div><div class="ttdoc">Check if there is any thread paused by checking process debugging details.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:77</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="aab87bdbf88894b1c9986c88a16298e38" name="aab87bdbf88894b1c9986c88a16298e38"></a>
<h2 class="memtitle"><span class="permalink"><a href="#aab87bdbf88894b1c9986c88a16298e38">&#9670;&#160;</a></span>AttachingQueryCountOfActiveDebuggingThreadsAndProcesses()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingQueryCountOfActiveDebuggingThreadsAndProcesses </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>QueryCountOfDebugThreadsRequest</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Query count of active debugging threads. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">QueryCountOfDebugThreadsRequest</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1451</span>{</div>
<div class="line"><span class="lineno"> 1452</span>    <a class="code hl_typedef" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> CountOfProcessesAndThreads;</div>
<div class="line"><span class="lineno"> 1453</span> </div>
<div class="line"><span class="lineno"> 1454</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1455</span>    <span class="comment">// Count the result</span></div>
<div class="line"><span class="lineno"> 1456</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1457</span>    CountOfProcessesAndThreads = <a class="code hl_function" href="_thread_holder_8c.html#affb7e7920935c0f6e29a3401242b155b">ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses</a>();</div>
<div class="line"><span class="lineno"> 1458</span> </div>
<div class="line"><span class="lineno"> 1459</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1460</span>    <span class="comment">// Set the results</span></div>
<div class="line"><span class="lineno"> 1461</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1462</span>    QueryCountOfDebugThreadsRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aff31c2022b45d4de799fa16c3b3f6bbd">CountOfActiveDebuggingThreadsAndProcesses</a> = CountOfProcessesAndThreads;</div>
<div class="line"><span class="lineno"> 1463</span>    QueryCountOfDebugThreadsRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a>                                    = <a class="code hl_define" href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a>;</div>
<div class="line"><span class="lineno"> 1464</span> </div>
<div class="line"><span class="lineno"> 1465</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1466</span>}</div>
<div class="ttc" id="a_basic_types_8h_html_ae1e6edbbc26d6fbc71a90190d0266018"><div class="ttname"><a href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></div><div class="ttdeci">unsigned int UINT32</div><div class="ttdef"><b>Definition</b> BasicTypes.h:48</div></div>
<div class="ttc" id="a_thread_holder_8c_html_affb7e7920935c0f6e29a3401242b155b"><div class="ttname"><a href="_thread_holder_8c.html#affb7e7920935c0f6e29a3401242b155b">ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses</a></div><div class="ttdeci">UINT32 ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses()</div><div class="ttdoc">Query count of active debugging threads and processes.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:491</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_aff31c2022b45d4de799fa16c3b3f6bbd"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aff31c2022b45d4de799fa16c3b3f6bbd">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::CountOfActiveDebuggingThreadsAndProcesses</a></div><div class="ttdeci">UINT32 CountOfActiveDebuggingThreadsAndProcesses</div><div class="ttdef"><b>Definition</b> RequestStructures.h:639</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="a640e936614ebe9a68cf54e78f7d8f323" name="a640e936614ebe9a68cf54e78f7d8f323"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a640e936614ebe9a68cf54e78f7d8f323">&#9670;&#160;</a></span>AttachingQueryDetailsOfActiveDebuggingThreadsAndProcesses()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingQueryDetailsOfActiveDebuggingThreadsAndProcesses </td>
          <td>(</td>
          <td class="paramtype">PVOID</td>          <td class="paramname"><span class="paramname"><em>BufferToStoreDetails</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a></td>          <td class="paramname"><span class="paramname"><em>BufferSize</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Query details of active debugging threads. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">BufferToStoreDetails</td><td></td></tr>
    <tr><td class="paramname">BufferSize</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1477</span>{</div>
<div class="line"><span class="lineno"> 1478</span>    <a class="code hl_typedef" href="_basic_types_8h.html#ae1e6edbbc26d6fbc71a90190d0266018">UINT32</a> CountOfProcessesAndThreadsToStore;</div>
<div class="line"><span class="lineno"> 1479</span> </div>
<div class="line"><span class="lineno"> 1480</span>    CountOfProcessesAndThreadsToStore = BufferSize / <a class="code hl_define" href="_request_structures_8h.html#a09aea4145f7df682c4513602c5b2a9c6">SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS</a>;</div>
<div class="line"><span class="lineno"> 1481</span> </div>
<div class="line"><span class="lineno"> 1482</span>    <span class="keywordflow">if</span> (CountOfProcessesAndThreadsToStore == 0)</div>
<div class="line"><span class="lineno"> 1483</span>    {</div>
<div class="line"><span class="lineno"> 1484</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1485</span>        <span class="comment">// No active thread or process</span></div>
<div class="line"><span class="lineno"> 1486</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1487</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1488</span>    }</div>
<div class="line"><span class="lineno"> 1489</span> </div>
<div class="line"><span class="lineno"> 1490</span>    <span class="comment">// LogInfo(&quot;Count of active process and threads : %x&quot;, CountOfProcessesAndThreadsToStore);</span></div>
<div class="line"><span class="lineno"> 1491</span> </div>
<div class="line"><span class="lineno"> 1492</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1493</span>    <span class="comment">// Get the results</span></div>
<div class="line"><span class="lineno"> 1494</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1495</span>    <a class="code hl_function" href="_thread_holder_8c.html#abefefca1094887640b64fb4405d1504e">ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses</a>(BufferToStoreDetails, CountOfProcessesAndThreadsToStore);</div>
<div class="line"><span class="lineno"> 1496</span> </div>
<div class="line"><span class="lineno"> 1497</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1498</span>}</div>
<div class="ttc" id="a_request_structures_8h_html_a09aea4145f7df682c4513602c5b2a9c6"><div class="ttname"><a href="_request_structures_8h.html#a09aea4145f7df682c4513602c5b2a9c6">SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS</a></div><div class="ttdeci">#define SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS</div><div class="ttdef"><b>Definition</b> RequestStructures.h:806</div></div>
<div class="ttc" id="a_thread_holder_8c_html_abefefca1094887640b64fb4405d1504e"><div class="ttname"><a href="_thread_holder_8c.html#abefefca1094887640b64fb4405d1504e">ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses</a></div><div class="ttdeci">VOID ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses(USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS *BufferToStoreDetails, UINT32 MaxCount)</div><div class="ttdoc">Query details of active debugging threads and processes.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:549</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="afb4b04c662929a9dc3b74b45b634aff4" name="afb4b04c662929a9dc3b74b45b634aff4"></a>
<h2 class="memtitle"><span class="permalink"><a href="#afb4b04c662929a9dc3b74b45b634aff4">&#9670;&#160;</a></span>AttachingReachedToValidLoadedModule()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingReachedToValidLoadedModule </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="hyperkd_2header_2debugger_2core_2_state_8h.html#aa35afece6adc9a29a7bf7a2e76476037">PROCESSOR_DEBUGGING_STATE</a> *</td>          <td class="paramname"><span class="paramname"><em>DbgState</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_attaching_8h.html#ac289d6b25a670c70d1f6a5105788fb04">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a></td>          <td class="paramname"><span class="paramname"><em>ProcessDebuggingDetail</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Handle cases where we reached to the valid loaded module The main module should be loaded once we reach to this function. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">DbgState</td><td>The state of the debugger on the current core </td></tr>
    <tr><td class="paramname">ProcessDebuggingDetail</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  350</span>{</div>
<div class="line"><span class="lineno">  351</span>    <a class="code hl_struct" href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html">DEBUGGEE_BP_PACKET</a> BpRequest = {0};</div>
<div class="line"><span class="lineno">  352</span> </div>
<div class="line"><span class="lineno">  353</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  354</span>    <span class="comment">// Double check to make sure the main module is loaded</span></div>
<div class="line"><span class="lineno">  355</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  356</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="_address_check_8c.html#aec71cec56c29db61a23b2997ee8e2059">CheckAccessValidityAndSafety</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#adb588665a0fa72d6307d6f8577f2f946">EntrypointOfMainModule</a>, <span class="keyword">sizeof</span>(<a class="code hl_typedef" href="_basic_types_8h.html#aebb9e13210d88d43e32e735ada43a425">CHAR</a>)))</div>
<div class="line"><span class="lineno">  357</span>    {</div>
<div class="line"><span class="lineno">  358</span>        <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a>(<span class="stringliteral">&quot;Err, the main module is not loaded or the main entrypoint is not valid&quot;</span>);</div>
<div class="line"><span class="lineno">  359</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  360</span>    }</div>
<div class="line"><span class="lineno">  361</span> </div>
<div class="line"><span class="lineno">  362</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  363</span>    <span class="comment">// Setting a breakpoint to the main entrypoint of the module</span></div>
<div class="line"><span class="lineno">  364</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  365</span>    BpRequest.<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#aa58a4dcb7c01e3412eac7dd3b428f309">Address</a> = ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#adb588665a0fa72d6307d6f8577f2f946">EntrypointOfMainModule</a>;</div>
<div class="line"><span class="lineno">  366</span>    BpRequest.<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a7285098a69927e556cbc61864a1d7e62">Core</a>    = <a class="code hl_define" href="_constants_8h.html#aa145d6235b4996c241ae08d13de243a0">DEBUGGEE_BP_APPLY_TO_ALL_CORES</a>;</div>
<div class="line"><span class="lineno">  367</span>    BpRequest.<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#aae09270daf430ca348d56079a35ed1b8">Pid</a>     = <a class="code hl_define" href="_constants_8h.html#a772442c9aa9acb6567a6d79ddc8c171b">DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES</a>;</div>
<div class="line"><span class="lineno">  368</span>    BpRequest.<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a13aeaf024d8bea5bd40692b08a8ed3ee">Tid</a>     = <a class="code hl_define" href="_constants_8h.html#a83c229c2fbc9b06f560b3b78ae873f50">DEBUGGEE_BP_APPLY_TO_ALL_THREADS</a>;</div>
<div class="line"><span class="lineno">  369</span> </div>
<div class="line"><span class="lineno">  370</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  371</span>    <span class="comment">// Remove the breakpoint after hit</span></div>
<div class="line"><span class="lineno">  372</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  373</span>    BpRequest.<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a69d6b93ae09e735b05232e69700e0e2f">RemoveAfterHit</a> = <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  374</span> </div>
<div class="line"><span class="lineno">  375</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  376</span>    <span class="comment">// Check if the process needs to check for callbacks for the very first instruction</span></div>
<div class="line"><span class="lineno">  377</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  378</span>    <span class="keywordflow">if</span> (ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ab748a7db00ec4b671fa65ef900986080">CheckCallBackForInterceptingFirstInstruction</a>)</div>
<div class="line"><span class="lineno">  379</span>    {</div>
<div class="line"><span class="lineno">  380</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  381</span>        <span class="comment">// This breakpoint should check for callbacks</span></div>
<div class="line"><span class="lineno">  382</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  383</span>        BpRequest.<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a8e09c5b964a09cafcf316b8aea8879fb">CheckForCallbacks</a> = <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  384</span>    }</div>
<div class="line"><span class="lineno">  385</span> </div>
<div class="line"><span class="lineno">  386</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  387</span>    <span class="comment">// Register the breakpoint</span></div>
<div class="line"><span class="lineno">  388</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  389</span>    <span class="keywordflow">if</span> (!<a class="code hl_function" href="_breakpoint_commands_8c.html#a295701da4a28b591937893cfbb3dcd75">BreakpointAddNew</a>(&amp;BpRequest))</div>
<div class="line"><span class="lineno">  390</span>    {</div>
<div class="line"><span class="lineno">  391</span>        <a class="code hl_define" href="_hyper_dbg_hyper_log_intrinsics_8h.html#a459b19922fecfbb9438dd56b66930d16">LogError</a>(<span class="stringliteral">&quot;Err, unable to set breakpoint on the entrypoint module&quot;</span>);</div>
<div class="line"><span class="lineno">  392</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  393</span>    }</div>
<div class="line"><span class="lineno">  394</span> </div>
<div class="line"><span class="lineno">  395</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  396</span>    <span class="comment">// Finish the starting point of the thread</span></div>
<div class="line"><span class="lineno">  397</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  398</span>    <a class="code hl_function" href="#a3d3e20ec99d70f3b498c332625729a3d">AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken</a>(<a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>, ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">Token</a>);</div>
<div class="line"><span class="lineno">  399</span> </div>
<div class="line"><span class="lineno">  400</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  401</span>    <span class="comment">// Check if we&#39;re connect to the kHyperDbg or uHyperDbg</span></div>
<div class="line"><span class="lineno">  402</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  403</span>    <span class="keywordflow">if</span> (<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae4b5afa957e3e26377135b91b60eda4e">g_KernelDebuggerState</a>)</div>
<div class="line"><span class="lineno">  404</span>    {</div>
<div class="line"><span class="lineno">  405</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  406</span>        <span class="comment">// Handling state through the kernel-mode debugger</span></div>
<div class="line"><span class="lineno">  407</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  408</span>        <a class="code hl_function" href="_kd_8c.html#a732bca2051e444c16d2d9a5080978981">KdHandleBreakpointAndDebugBreakpoints</a>(DbgState,</div>
<div class="line"><span class="lineno">  409</span>                                              <a class="code hl_enumvalue" href="_connection_8h.html#a6e2be89205e735ebae644cf4850ac21baa654237d7e0c71770e84147a65842463">DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED</a>,</div>
<div class="line"><span class="lineno">  410</span>                                              NULL);</div>
<div class="line"><span class="lineno">  411</span>    }</div>
<div class="line"><span class="lineno">  412</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno">  413</span>    {</div>
<div class="line"><span class="lineno">  414</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  415</span>        <span class="comment">// Handling state through the user-mode debugger</span></div>
<div class="line"><span class="lineno">  416</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  417</span>        <a class="code hl_function" href="_ud_8c.html#a5ebe34618715108270c71344983e4af3">UdCheckAndHandleBreakpointsAndDebugBreaks</a>(DbgState,</div>
<div class="line"><span class="lineno">  418</span>                                                  <a class="code hl_enumvalue" href="_connection_8h.html#a6e2be89205e735ebae644cf4850ac21baa654237d7e0c71770e84147a65842463">DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED</a>,</div>
<div class="line"><span class="lineno">  419</span>                                                  NULL);</div>
<div class="line"><span class="lineno">  420</span>    }</div>
<div class="line"><span class="lineno">  421</span> </div>
<div class="line"><span class="lineno">  422</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  423</span>    <span class="comment">// Handled successfully</span></div>
<div class="line"><span class="lineno">  424</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  425</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  426</span>}</div>
<div class="ttc" id="a_breakpoint_commands_8c_html_a295701da4a28b591937893cfbb3dcd75"><div class="ttname"><a href="_breakpoint_commands_8c.html#a295701da4a28b591937893cfbb3dcd75">BreakpointAddNew</a></div><div class="ttdeci">BOOLEAN BreakpointAddNew(PDEBUGGEE_BP_PACKET BpDescriptorArg)</div><div class="ttdoc">Add new breakpoints.</div><div class="ttdef"><b>Definition</b> BreakpointCommands.c:893</div></div>
<div class="ttc" id="a_connection_8h_html_a6e2be89205e735ebae644cf4850ac21baa654237d7e0c71770e84147a65842463"><div class="ttname"><a href="_connection_8h.html#a6e2be89205e735ebae644cf4850ac21baa654237d7e0c71770e84147a65842463">DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED</a></div><div class="ttdeci">@ DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED</div><div class="ttdef"><b>Definition</b> Connection.h:36</div></div>
<div class="ttc" id="a_constants_8h_html_a772442c9aa9acb6567a6d79ddc8c171b"><div class="ttname"><a href="_constants_8h.html#a772442c9aa9acb6567a6d79ddc8c171b">DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES</a></div><div class="ttdeci">#define DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES</div><div class="ttdoc">The constant to apply to all processes for bp command.</div><div class="ttdef"><b>Definition</b> Constants.h:653</div></div>
<div class="ttc" id="a_constants_8h_html_a83c229c2fbc9b06f560b3b78ae873f50"><div class="ttname"><a href="_constants_8h.html#a83c229c2fbc9b06f560b3b78ae873f50">DEBUGGEE_BP_APPLY_TO_ALL_THREADS</a></div><div class="ttdeci">#define DEBUGGEE_BP_APPLY_TO_ALL_THREADS</div><div class="ttdoc">The constant to apply to all threads for bp command.</div><div class="ttdef"><b>Definition</b> Constants.h:659</div></div>
<div class="ttc" id="a_constants_8h_html_aa145d6235b4996c241ae08d13de243a0"><div class="ttname"><a href="_constants_8h.html#aa145d6235b4996c241ae08d13de243a0">DEBUGGEE_BP_APPLY_TO_ALL_CORES</a></div><div class="ttdeci">#define DEBUGGEE_BP_APPLY_TO_ALL_CORES</div><div class="ttdoc">The constant to apply to all cores for bp command.</div><div class="ttdef"><b>Definition</b> Constants.h:647</div></div>
<div class="ttc" id="a_kd_8c_html_a732bca2051e444c16d2d9a5080978981"><div class="ttname"><a href="_kd_8c.html#a732bca2051e444c16d2d9a5080978981">KdHandleBreakpointAndDebugBreakpoints</a></div><div class="ttdeci">_Use_decl_annotations_ VOID KdHandleBreakpointAndDebugBreakpoints(PROCESSOR_DEBUGGING_STATE *DbgState, DEBUGGEE_PAUSING_REASON Reason, PDEBUGGER_TRIGGERED_EVENT_DETAILS EventDetails)</div><div class="ttdoc">Handle #DBs and #BPs for kernel debugger.</div><div class="ttdef"><b>Definition</b> Kd.c:1214</div></div>
<div class="ttc" id="ahyperkd_2header_2globals_2_global_8h_html_ae4b5afa957e3e26377135b91b60eda4e"><div class="ttname"><a href="hyperkd_2header_2globals_2_global_8h.html#ae4b5afa957e3e26377135b91b60eda4e">g_KernelDebuggerState</a></div><div class="ttdeci">BOOLEAN g_KernelDebuggerState</div><div class="ttdoc">shows whether the kernel debugger is enabled or disabled</div><div class="ttdef"><b>Definition</b> Global.h:103</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t_html"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html">_DEBUGGEE_BP_PACKET</a></div><div class="ttdoc">The structure of bp command packet in HyperDbg.</div><div class="ttdef"><b>Definition</b> RequestStructures.h:1060</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t_html_a13aeaf024d8bea5bd40692b08a8ed3ee"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a13aeaf024d8bea5bd40692b08a8ed3ee">_DEBUGGEE_BP_PACKET::Tid</a></div><div class="ttdeci">UINT32 Tid</div><div class="ttdef"><b>Definition</b> RequestStructures.h:1063</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t_html_a69d6b93ae09e735b05232e69700e0e2f"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a69d6b93ae09e735b05232e69700e0e2f">_DEBUGGEE_BP_PACKET::RemoveAfterHit</a></div><div class="ttdeci">BOOLEAN RemoveAfterHit</div><div class="ttdef"><b>Definition</b> RequestStructures.h:1065</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t_html_a7285098a69927e556cbc61864a1d7e62"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a7285098a69927e556cbc61864a1d7e62">_DEBUGGEE_BP_PACKET::Core</a></div><div class="ttdeci">UINT32 Core</div><div class="ttdef"><b>Definition</b> RequestStructures.h:1064</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t_html_a8e09c5b964a09cafcf316b8aea8879fb"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#a8e09c5b964a09cafcf316b8aea8879fb">_DEBUGGEE_BP_PACKET::CheckForCallbacks</a></div><div class="ttdeci">BOOLEAN CheckForCallbacks</div><div class="ttdef"><b>Definition</b> RequestStructures.h:1066</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t_html_aa58a4dcb7c01e3412eac7dd3b428f309"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#aa58a4dcb7c01e3412eac7dd3b428f309">_DEBUGGEE_BP_PACKET::Address</a></div><div class="ttdeci">UINT64 Address</div><div class="ttdef"><b>Definition</b> RequestStructures.h:1061</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t_html_aae09270daf430ca348d56079a35ed1b8"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_e___b_p___p_a_c_k_e_t.html#aae09270daf430ca348d56079a35ed1b8">_DEBUGGEE_BP_PACKET::Pid</a></div><div class="ttdeci">UINT32 Pid</div><div class="ttdef"><b>Definition</b> RequestStructures.h:1062</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="ad16b106f9f7b6a857bafc12252bcfadd" name="ad16b106f9f7b6a857bafc12252bcfadd"></a>
<h2 class="memtitle"><span class="permalink"><a href="#ad16b106f9f7b6a857bafc12252bcfadd">&#9670;&#160;</a></span>AttachingRemoveAndFreeAllProcessDebuggingDetails()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a7f319bfc2492a2136964194204e7a8cf">VOID</a> AttachingRemoveAndFreeAllProcessDebuggingDetails </td>
          <td>(</td>
          <td class="paramname"><span class="paramname"><em></em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Remove and deallocate all thread debuggig details. </p>
<dl class="section return"><dt>Returns</dt><dd>VOID </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  230</span>{</div>
<div class="line"><span class="lineno">  231</span>    <a class="code hl_define" href="_meta_macros_8h.html#ae6305b9ffbb1d946674b7b98431a67e9">LIST_FOR_EACH_LINK</a>(<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#a3a003d2c59562062fe921cd2754440f7">g_ProcessDebuggingDetailsListHead</a>, <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">USERMODE_DEBUGGING_PROCESS_DETAILS</a>, AttachedProcessList, ProcessDebuggingDetails)</div>
<div class="line"><span class="lineno">  232</span>    {</div>
<div class="line"><span class="lineno">  233</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  234</span>        <span class="comment">// Free the thread holding structure(s)</span></div>
<div class="line"><span class="lineno">  235</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  236</span>        <a class="code hl_function" href="_thread_holder_8c.html#a3b4a9b1b679bae96959ca1f7a8a8d2aa">ThreadHolderFreeHoldingStructures</a>(ProcessDebuggingDetails);</div>
<div class="line"><span class="lineno">  237</span> </div>
<div class="line"><span class="lineno">  238</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  239</span>        <span class="comment">// Remove thread debugging detail from the list active threads</span></div>
<div class="line"><span class="lineno">  240</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  241</span>        <a class="code hl_function" href="_windows_8h.html#aac75b07955a17d40e91325491bbac645">RemoveEntryList</a>(&amp;ProcessDebuggingDetails-&gt;AttachedProcessList);</div>
<div class="line"><span class="lineno">  242</span> </div>
<div class="line"><span class="lineno">  243</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  244</span>        <span class="comment">// Unallocate the pool</span></div>
<div class="line"><span class="lineno">  245</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  246</span>        <a class="code hl_function" href="_mem_8c.html#a8ad365cfb6c54c3d6fdd745e6b4666f1">PlatformMemFreePool</a>(ProcessDebuggingDetails);</div>
<div class="line"><span class="lineno">  247</span>    }</div>
<div class="line"><span class="lineno">  248</span>}</div>
<div class="ttc" id="a_thread_holder_8c_html_a3b4a9b1b679bae96959ca1f7a8a8d2aa"><div class="ttname"><a href="_thread_holder_8c.html#a3b4a9b1b679bae96959ca1f7a8a8d2aa">ThreadHolderFreeHoldingStructures</a></div><div class="ttdeci">VOID ThreadHolderFreeHoldingStructures(PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)</div><div class="ttdoc">Free all of thread holder structures.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:465</div></div>
<div class="ttc" id="a_windows_8h_html_aac75b07955a17d40e91325491bbac645"><div class="ttname"><a href="_windows_8h.html#aac75b07955a17d40e91325491bbac645">RemoveEntryList</a></div><div class="ttdeci">FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)</div><div class="ttdef"><b>Definition</b> Windows.h:56</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="aba0a55c32fa1b903bbb0b4408b238f62" name="aba0a55c32fa1b903bbb0b4408b238f62"></a>
<h2 class="memtitle"><span class="permalink"><a href="#aba0a55c32fa1b903bbb0b4408b238f62">&#9670;&#160;</a></span>AttachingRemoveHooks()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingRemoveHooks </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>AttachRequest</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Clearing hooks after resuming the process. </p>
<p>this function should not be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">AttachRequest</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1125</span>{</div>
<div class="line"><span class="lineno"> 1126</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetails;</div>
<div class="line"><span class="lineno"> 1127</span> </div>
<div class="line"><span class="lineno"> 1128</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1129</span>    <span class="comment">// Get the thread debugging detail</span></div>
<div class="line"><span class="lineno"> 1130</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1131</span>    ProcessDebuggingDetails = <a class="code hl_function" href="#ab826f65586e0a294b97e505c6affe8b5">AttachingFindProcessDebuggingDetailsByToken</a>(AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a5b25bfe616f7a120d2a4ab6921c64540">Token</a>);</div>
<div class="line"><span class="lineno"> 1132</span> </div>
<div class="line"><span class="lineno"> 1133</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1134</span>    <span class="comment">// Check if token is valid or not</span></div>
<div class="line"><span class="lineno"> 1135</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1136</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetails)</div>
<div class="line"><span class="lineno"> 1137</span>    {</div>
<div class="line"><span class="lineno"> 1138</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a92d093e7a21735223e9bd4821f428dd5">DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN</a>;</div>
<div class="line"><span class="lineno"> 1139</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1140</span>    }</div>
<div class="line"><span class="lineno"> 1141</span> </div>
<div class="line"><span class="lineno"> 1142</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1143</span>    <span class="comment">// Check if the entrypoint is reached or not,</span></div>
<div class="line"><span class="lineno"> 1144</span>    <span class="comment">// if it&#39;s not reached then we won&#39;t remove the hooks</span></div>
<div class="line"><span class="lineno"> 1145</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1146</span>    <span class="keywordflow">if</span> (!<a class="code hl_variable" href="hyperkd_2header_2globals_2_global_8h.html#ae4b7e6d3d73fbc5e36dab0e432cfda0e">g_IsWaitingForUserModeProcessEntryToBeCalled</a>)</div>
<div class="line"><span class="lineno"> 1147</span>    {</div>
<div class="line"><span class="lineno"> 1148</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1149</span>        <span class="comment">// The entrypoint is called, we should remove the hook</span></div>
<div class="line"><span class="lineno"> 1150</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1151</span>        <span class="keywordflow">if</span> (!<a class="code hl_function" href="_configuration_8c.html#ad6129e5f85312a405e0509e2c45351bf">ConfigureEptHookUnHookSingleAddress</a>((<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)ProcessDebuggingDetails-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aefb16ed28844461dfa42f40f062015b0">PebAddressToMonitor</a>,</div>
<div class="line"><span class="lineno"> 1152</span>                                                 (<a class="code hl_typedef" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a>)NULL,</div>
<div class="line"><span class="lineno"> 1153</span>                                                 ProcessDebuggingDetails-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ace267a6473505408e798a827e1b244f0">ProcessId</a>))</div>
<div class="line"><span class="lineno"> 1154</span>        {</div>
<div class="line"><span class="lineno"> 1155</span>            AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a223336de64e9b75e117c1d7c34cce413">DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS</a>;</div>
<div class="line"><span class="lineno"> 1156</span>            <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1157</span>        }</div>
<div class="line"><span class="lineno"> 1158</span>        <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno"> 1159</span>        {</div>
<div class="line"><span class="lineno"> 1160</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1161</span>            <span class="comment">// The unhooking operation was successful</span></div>
<div class="line"><span class="lineno"> 1162</span>            <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1163</span>            AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a>;</div>
<div class="line"><span class="lineno"> 1164</span>            <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1165</span>        }</div>
<div class="line"><span class="lineno"> 1166</span>    }</div>
<div class="line"><span class="lineno"> 1167</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno"> 1168</span>    {</div>
<div class="line"><span class="lineno"> 1169</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1170</span>        <span class="comment">// The entrypoint is not called, we shouldn&#39;t remove the hook</span></div>
<div class="line"><span class="lineno"> 1171</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1172</span>        AttachRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#ac5b15a65eca7c3d19dd0375563c15ab3">DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED</a>;</div>
<div class="line"><span class="lineno"> 1173</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1174</span>    }</div>
<div class="line"><span class="lineno"> 1175</span>}</div>
<div class="ttc" id="a_configuration_8c_html_ad6129e5f85312a405e0509e2c45351bf"><div class="ttname"><a href="_configuration_8c.html#ad6129e5f85312a405e0509e2c45351bf">ConfigureEptHookUnHookSingleAddress</a></div><div class="ttdeci">BOOLEAN ConfigureEptHookUnHookSingleAddress(UINT64 VirtualAddress, UINT64 PhysAddress, UINT32 ProcessId)</div><div class="ttdoc">Remove single hook from the hooked pages list and invalidate TLB.</div><div class="ttdef"><b>Definition</b> Configuration.c:188</div></div>
<div class="ttc" id="a_error_codes_8h_html_a223336de64e9b75e117c1d7c34cce413"><div class="ttname"><a href="_error_codes_8h.html#a223336de64e9b75e117c1d7c34cce413">DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS</div><div class="ttdoc">error, could not remove the previous hook</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:308</div></div>
<div class="ttc" id="a_error_codes_8h_html_a92d093e7a21735223e9bd4821f428dd5"><div class="ttname"><a href="_error_codes_8h.html#a92d093e7a21735223e9bd4821f428dd5">DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN</a></div><div class="ttdeci">#define DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN</div><div class="ttdoc">error, invalid thread debugging token</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:332</div></div>
<div class="ttc" id="a_error_codes_8h_html_ac5b15a65eca7c3d19dd0375563c15ab3"><div class="ttname"><a href="_error_codes_8h.html#ac5b15a65eca7c3d19dd0375563c15ab3">DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED</div><div class="ttdoc">error, failed to remove hooks as entrypoint is not reached yet</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:302</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="aaadea1225d670dcdb595dafb4f8e6022" name="aaadea1225d670dcdb595dafb4f8e6022"></a>
<h2 class="memtitle"><span class="permalink"><a href="#aaadea1225d670dcdb595dafb4f8e6022">&#9670;&#160;</a></span>AttachingRemoveProcessDebuggingDetailsByToken()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingRemoveProcessDebuggingDetailsByToken </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>Token</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Remove user-mode debugging details for threads by its token. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">Token</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  258</span>{</div>
<div class="line"><span class="lineno">  259</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetails;</div>
<div class="line"><span class="lineno">  260</span> </div>
<div class="line"><span class="lineno">  261</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  262</span>    <span class="comment">// Find the entry</span></div>
<div class="line"><span class="lineno">  263</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  264</span>    ProcessDebuggingDetails = <a class="code hl_function" href="#ab826f65586e0a294b97e505c6affe8b5">AttachingFindProcessDebuggingDetailsByToken</a>(Token);</div>
<div class="line"><span class="lineno">  265</span> </div>
<div class="line"><span class="lineno">  266</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetails)</div>
<div class="line"><span class="lineno">  267</span>    {</div>
<div class="line"><span class="lineno">  268</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  269</span>        <span class="comment">// Token not found!</span></div>
<div class="line"><span class="lineno">  270</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  271</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  272</span>    }</div>
<div class="line"><span class="lineno">  273</span> </div>
<div class="line"><span class="lineno">  274</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  275</span>    <span class="comment">// Free the thread holding structure(s)</span></div>
<div class="line"><span class="lineno">  276</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  277</span>    <a class="code hl_function" href="_thread_holder_8c.html#a3b4a9b1b679bae96959ca1f7a8a8d2aa">ThreadHolderFreeHoldingStructures</a>(ProcessDebuggingDetails);</div>
<div class="line"><span class="lineno">  278</span> </div>
<div class="line"><span class="lineno">  279</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  280</span>    <span class="comment">// Remove thread debugging detail from the list active threads</span></div>
<div class="line"><span class="lineno">  281</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  282</span>    <a class="code hl_function" href="_windows_8h.html#aac75b07955a17d40e91325491bbac645">RemoveEntryList</a>(&amp;ProcessDebuggingDetails-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af9cc943c4e24dbad2df94819db2c2c72">AttachedProcessList</a>);</div>
<div class="line"><span class="lineno">  283</span> </div>
<div class="line"><span class="lineno">  284</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  285</span>    <span class="comment">// Unallocate the pool</span></div>
<div class="line"><span class="lineno">  286</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  287</span>    <a class="code hl_function" href="_mem_8c.html#a8ad365cfb6c54c3d6fdd745e6b4666f1">PlatformMemFreePool</a>(ProcessDebuggingDetails);</div>
<div class="line"><span class="lineno">  288</span> </div>
<div class="line"><span class="lineno">  289</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  290</span>}</div>
</div><!-- fragment -->
</div>
</div>
<a id="a3d3e20ec99d70f3b498c332625729a3d" name="a3d3e20ec99d70f3b498c332625729a3d"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a3d3e20ec99d70f3b498c332625729a3d">&#9670;&#160;</a></span>AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a></td>          <td class="paramname"><span class="paramname"><em>Set</em></span>, </td>
        </tr>
        <tr>
          <td class="paramkey"></td>
          <td></td>
          <td class="paramtype"><a class="el" href="_basic_types_8h.html#aae17ebb9ef7279d026817fb22f8aebe9">UINT64</a></td>          <td class="paramname"><span class="paramname"><em>Token</em></span>&#160;)</td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Set the start up phase of a debugging thread buffer by its token. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">Set</td><td></td></tr>
    <tr><td class="paramname">Token</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno">  301</span>{</div>
<div class="line"><span class="lineno">  302</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetails;</div>
<div class="line"><span class="lineno">  303</span> </div>
<div class="line"><span class="lineno">  304</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  305</span>    <span class="comment">// If it&#39;s set to TRUE, then we check to only put 1 thread at the time</span></div>
<div class="line"><span class="lineno">  306</span>    <span class="comment">// to the starting phase</span></div>
<div class="line"><span class="lineno">  307</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  308</span>    ProcessDebuggingDetails = <a class="code hl_function" href="#a0890d6e4aaf7fd8bdb1663697ed6b717">AttachingFindProcessDebuggingDetailsInStartingPhase</a>();</div>
<div class="line"><span class="lineno">  309</span> </div>
<div class="line"><span class="lineno">  310</span>    <span class="keywordflow">if</span> (Set &amp;&amp; ProcessDebuggingDetails != NULL)</div>
<div class="line"><span class="lineno">  311</span>    {</div>
<div class="line"><span class="lineno">  312</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  313</span>        <span class="comment">// There is another thread in starting phase!</span></div>
<div class="line"><span class="lineno">  314</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  315</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  316</span>    }</div>
<div class="line"><span class="lineno">  317</span> </div>
<div class="line"><span class="lineno">  318</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  319</span>    <span class="comment">// Find the entry</span></div>
<div class="line"><span class="lineno">  320</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  321</span>    ProcessDebuggingDetails = <a class="code hl_function" href="#ab826f65586e0a294b97e505c6affe8b5">AttachingFindProcessDebuggingDetailsByToken</a>(Token);</div>
<div class="line"><span class="lineno">  322</span> </div>
<div class="line"><span class="lineno">  323</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetails)</div>
<div class="line"><span class="lineno">  324</span>    {</div>
<div class="line"><span class="lineno">  325</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  326</span>        <span class="comment">// Token not found!</span></div>
<div class="line"><span class="lineno">  327</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno">  328</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno">  329</span>    }</div>
<div class="line"><span class="lineno">  330</span> </div>
<div class="line"><span class="lineno">  331</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  332</span>    <span class="comment">// Set the starting phase</span></div>
<div class="line"><span class="lineno">  333</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno">  334</span>    ProcessDebuggingDetails-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af2d10b22659ae7fab7f797a4332c0808">IsOnTheStartingPhase</a> = Set;</div>
<div class="line"><span class="lineno">  335</span> </div>
<div class="line"><span class="lineno">  336</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno">  337</span>}</div>
<div class="ttc" id="a_attaching_8c_html_a0890d6e4aaf7fd8bdb1663697ed6b717"><div class="ttname"><a href="#a0890d6e4aaf7fd8bdb1663697ed6b717">AttachingFindProcessDebuggingDetailsInStartingPhase</a></div><div class="ttdeci">PUSERMODE_DEBUGGING_PROCESS_DETAILS AttachingFindProcessDebuggingDetailsInStartingPhase()</div><div class="ttdoc">Find user-mode debugging details for threads that is in the start-up phase.</div><div class="ttdef"><b>Definition</b> Attaching.c:210</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s_html_af2d10b22659ae7fab7f797a4332c0808"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#af2d10b22659ae7fab7f797a4332c0808">_USERMODE_DEBUGGING_PROCESS_DETAILS::IsOnTheStartingPhase</a></div><div class="ttdeci">BOOLEAN IsOnTheStartingPhase</div><div class="ttdef"><b>Definition</b> Attaching.h:63</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="a7275aab09d377c86c14c6a7613897597" name="a7275aab09d377c86c14c6a7613897597"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a7275aab09d377c86c14c6a7613897597">&#9670;&#160;</a></span>AttachingSwitchProcess()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a1cb18096b299d23458d3c7b85fd86555">BOOLEAN</a> AttachingSwitchProcess </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>SwitchRequest</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Switch to the target thread. </p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">SwitchRequest</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>BOOLEAN </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1363</span>{</div>
<div class="line"><span class="lineno"> 1364</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_PROCESS_DETAILS</a> ProcessDebuggingDetail;</div>
<div class="line"><span class="lineno"> 1365</span>    <a class="code hl_struct" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s.html">PUSERMODE_DEBUGGING_THREAD_DETAILS</a>  ThreadDebuggingDetail;</div>
<div class="line"><span class="lineno"> 1366</span> </div>
<div class="line"><span class="lineno"> 1367</span>    <span class="keywordflow">if</span> (SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a> != <a class="code hl_define" href="_basic_types_8h.html#a32ab457827837bf5ac123dd0fd8326ae">NULL_ZERO</a>)</div>
<div class="line"><span class="lineno"> 1368</span>    {</div>
<div class="line"><span class="lineno"> 1369</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1370</span>        <span class="comment">// Switch by process id</span></div>
<div class="line"><span class="lineno"> 1371</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1372</span>        ProcessDebuggingDetail = <a class="code hl_function" href="#a733d0f343ddcccaeec221bbbb20483c7">AttachingFindProcessDebuggingDetailsByProcessId</a>(SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a>);</div>
<div class="line"><span class="lineno"> 1373</span>    }</div>
<div class="line"><span class="lineno"> 1374</span>    <span class="keywordflow">else</span> <span class="keywordflow">if</span> (SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa88d767559c47476e7e0bfa912065d96">ThreadId</a> != <a class="code hl_define" href="_basic_types_8h.html#a32ab457827837bf5ac123dd0fd8326ae">NULL_ZERO</a>)</div>
<div class="line"><span class="lineno"> 1375</span>    {</div>
<div class="line"><span class="lineno"> 1376</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1377</span>        <span class="comment">// Switch by thread id</span></div>
<div class="line"><span class="lineno"> 1378</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1379</span>        ProcessDebuggingDetail = <a class="code hl_function" href="_thread_holder_8c.html#acba2daedbfe8905ff43917a1ccf7c401">ThreadHolderGetProcessDebuggingDetailsByThreadId</a>(SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa88d767559c47476e7e0bfa912065d96">ThreadId</a>);</div>
<div class="line"><span class="lineno"> 1380</span>    }</div>
<div class="line"><span class="lineno"> 1381</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno"> 1382</span>    {</div>
<div class="line"><span class="lineno"> 1383</span>        SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a7c127830691148c810f4d78b8320bfa1">DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID</a>;</div>
<div class="line"><span class="lineno"> 1384</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1385</span>    }</div>
<div class="line"><span class="lineno"> 1386</span> </div>
<div class="line"><span class="lineno"> 1387</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1388</span>    <span class="comment">// Check if process is valid in process debugging details</span></div>
<div class="line"><span class="lineno"> 1389</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1390</span>    <span class="keywordflow">if</span> (!ProcessDebuggingDetail)</div>
<div class="line"><span class="lineno"> 1391</span>    {</div>
<div class="line"><span class="lineno"> 1392</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1393</span>        <span class="comment">// not found</span></div>
<div class="line"><span class="lineno"> 1394</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1395</span>        SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#a7c127830691148c810f4d78b8320bfa1">DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID</a>;</div>
<div class="line"><span class="lineno"> 1396</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1397</span>    }</div>
<div class="line"><span class="lineno"> 1398</span> </div>
<div class="line"><span class="lineno"> 1399</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1400</span>    <span class="comment">// Set the IsPaused field</span></div>
<div class="line"><span class="lineno"> 1401</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1402</span>    <span class="keywordflow">if</span> (SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa88d767559c47476e7e0bfa912065d96">ThreadId</a> != <a class="code hl_define" href="_basic_types_8h.html#a32ab457827837bf5ac123dd0fd8326ae">NULL_ZERO</a>)</div>
<div class="line"><span class="lineno"> 1403</span>    {</div>
<div class="line"><span class="lineno"> 1404</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1405</span>        <span class="comment">// Find the thread&#39;s state</span></div>
<div class="line"><span class="lineno"> 1406</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1407</span>        ThreadDebuggingDetail = <a class="code hl_function" href="_thread_holder_8c.html#aae54fde00233fd8e30b197ab1a64a555">ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ace267a6473505408e798a827e1b244f0">ProcessId</a>,</div>
<div class="line"><span class="lineno"> 1408</span>                                                                                          SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa88d767559c47476e7e0bfa912065d96">ThreadId</a>);</div>
<div class="line"><span class="lineno"> 1409</span>    }</div>
<div class="line"><span class="lineno"> 1410</span>    <span class="keywordflow">else</span></div>
<div class="line"><span class="lineno"> 1411</span>    {</div>
<div class="line"><span class="lineno"> 1412</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1413</span>        <span class="comment">// Find the first thread in the process</span></div>
<div class="line"><span class="lineno"> 1414</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1415</span>        ThreadDebuggingDetail = <a class="code hl_function" href="_thread_holder_8c.html#ab07678c8fe445f2a876f6bee3b42dcd8">ThreadHolderGetProcessFirstThreadDetailsByProcessId</a>(ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ace267a6473505408e798a827e1b244f0">ProcessId</a>);</div>
<div class="line"><span class="lineno"> 1416</span>    }</div>
<div class="line"><span class="lineno"> 1417</span> </div>
<div class="line"><span class="lineno"> 1418</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1419</span>    <span class="comment">// Check if we find the target thread</span></div>
<div class="line"><span class="lineno"> 1420</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1421</span>    <span class="keywordflow">if</span> (!ThreadDebuggingDetail)</div>
<div class="line"><span class="lineno"> 1422</span>    {</div>
<div class="line"><span class="lineno"> 1423</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1424</span>        <span class="comment">// not found</span></div>
<div class="line"><span class="lineno"> 1425</span>        <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1426</span>        SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#ae76c1ea4286bfb5ef09548125670254f">DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS</a>;</div>
<div class="line"><span class="lineno"> 1427</span>        <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa93f0eb578d23995850d61f7d61c55c1">FALSE</a>;</div>
<div class="line"><span class="lineno"> 1428</span>    }</div>
<div class="line"><span class="lineno"> 1429</span> </div>
<div class="line"><span class="lineno"> 1430</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1431</span>    <span class="comment">// Fill the needed details by user mode</span></div>
<div class="line"><span class="lineno"> 1432</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1433</span>    SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a5b25bfe616f7a120d2a4ab6921c64540">Token</a>     = ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#aac3f928359d06bdd7572a4bd67c86429">Token</a>;</div>
<div class="line"><span class="lineno"> 1434</span>    SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a33b1c240af7027649bf87dcc6a18d8d2">ProcessId</a> = ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ace267a6473505408e798a827e1b244f0">ProcessId</a>;</div>
<div class="line"><span class="lineno"> 1435</span>    SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa88d767559c47476e7e0bfa912065d96">ThreadId</a>  = ThreadDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s.html#a726606b3498458de98f6cb19e6873df0">ThreadId</a>;</div>
<div class="line"><span class="lineno"> 1436</span>    SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aaa51248611cfb936485165be2b3b4a4d">Is32Bit</a>   = ProcessDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___p_r_o_c_e_s_s___d_e_t_a_i_l_s.html#ac1a80680491ceb043b754ab5e9a7eec8">Is32Bit</a>;</div>
<div class="line"><span class="lineno"> 1437</span>    SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa20810ff2bd553304ad18ee7c4c42eaa">IsPaused</a>  = ThreadDebuggingDetail-&gt;<a class="code hl_variable" href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s.html#afcd7f63e2118dbfefdac3e7c79fda7fc">IsPaused</a>;</div>
<div class="line"><span class="lineno"> 1438</span> </div>
<div class="line"><span class="lineno"> 1439</span>    SwitchRequest-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#aed656c58434eecb2d7e8c10e93aecff4">DEBUGGER_OPERATION_WAS_SUCCESSFUL</a>;</div>
<div class="line"><span class="lineno"> 1440</span>    <span class="keywordflow">return</span> <a class="code hl_define" href="_basic_types_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d">TRUE</a>;</div>
<div class="line"><span class="lineno"> 1441</span>}</div>
<div class="ttc" id="a_basic_types_8h_html_a32ab457827837bf5ac123dd0fd8326ae"><div class="ttname"><a href="_basic_types_8h.html#a32ab457827837bf5ac123dd0fd8326ae">NULL_ZERO</a></div><div class="ttdeci">#define NULL_ZERO</div><div class="ttdef"><b>Definition</b> BasicTypes.h:51</div></div>
<div class="ttc" id="a_error_codes_8h_html_a7c127830691148c810f4d78b8320bfa1"><div class="ttname"><a href="_error_codes_8h.html#a7c127830691148c810f4d78b8320bfa1">DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID</div><div class="ttdoc">error, cannot switch to new thread as the process id or thread id is not found</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:362</div></div>
<div class="ttc" id="a_error_codes_8h_html_ae76c1ea4286bfb5ef09548125670254f"><div class="ttname"><a href="_error_codes_8h.html#ae76c1ea4286bfb5ef09548125670254f">DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS</a></div><div class="ttdeci">#define DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS</div><div class="ttdoc">error, cannot switch to new thread the process doesn't contain an active thread</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:368</div></div>
<div class="ttc" id="a_thread_holder_8c_html_aae54fde00233fd8e30b197ab1a64a555"><div class="ttname"><a href="_thread_holder_8c.html#aae54fde00233fd8e30b197ab1a64a555">ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId</a></div><div class="ttdeci">PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId(UINT32 ProcessId, UINT32 ThreadId)</div><div class="ttdoc">Find the active threads of the process from process id.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:109</div></div>
<div class="ttc" id="a_thread_holder_8c_html_ab07678c8fe445f2a876f6bee3b42dcd8"><div class="ttname"><a href="_thread_holder_8c.html#ab07678c8fe445f2a876f6bee3b42dcd8">ThreadHolderGetProcessFirstThreadDetailsByProcessId</a></div><div class="ttdeci">PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadHolderGetProcessFirstThreadDetailsByProcessId(UINT32 ProcessId)</div><div class="ttdoc">Find the first active threads of the process from process id.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:157</div></div>
<div class="ttc" id="a_thread_holder_8c_html_acba2daedbfe8905ff43917a1ccf7c401"><div class="ttname"><a href="_thread_holder_8c.html#acba2daedbfe8905ff43917a1ccf7c401">ThreadHolderGetProcessDebuggingDetailsByThreadId</a></div><div class="ttdeci">PUSERMODE_DEBUGGING_PROCESS_DETAILS ThreadHolderGetProcessDebuggingDetailsByThreadId(UINT32 ThreadId)</div><div class="ttdoc">Find the active process debugging detail from the thread id.</div><div class="ttdef"><b>Definition</b> ThreadHolder.c:205</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_aa20810ff2bd553304ad18ee7c4c42eaa"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa20810ff2bd553304ad18ee7c4c42eaa">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::IsPaused</a></div><div class="ttdeci">BOOLEAN IsPaused</div><div class="ttdef"><b>Definition</b> RequestStructures.h:637</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_aa88d767559c47476e7e0bfa912065d96"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#aa88d767559c47476e7e0bfa912065d96">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::ThreadId</a></div><div class="ttdeci">UINT32 ThreadId</div><div class="ttdef"><b>Definition</b> RequestStructures.h:634</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s_html"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s.html">_USERMODE_DEBUGGING_THREAD_DETAILS</a></div><div class="ttdoc">Details of each thread in process.</div><div class="ttdef"><b>Definition</b> ThreadHolder.h:33</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s_html_a726606b3498458de98f6cb19e6873df0"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s.html#a726606b3498458de98f6cb19e6873df0">_USERMODE_DEBUGGING_THREAD_DETAILS::ThreadId</a></div><div class="ttdeci">UINT32 ThreadId</div><div class="ttdef"><b>Definition</b> ThreadHolder.h:34</div></div>
<div class="ttc" id="astruct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s_html_afcd7f63e2118dbfefdac3e7c79fda7fc"><div class="ttname"><a href="struct___u_s_e_r_m_o_d_e___d_e_b_u_g_g_i_n_g___t_h_r_e_a_d___d_e_t_a_i_l_s.html#afcd7f63e2118dbfefdac3e7c79fda7fc">_USERMODE_DEBUGGING_THREAD_DETAILS::IsPaused</a></div><div class="ttdeci">BOOLEAN IsPaused</div><div class="ttdef"><b>Definition</b> ThreadHolder.h:36</div></div>
</div><!-- fragment -->
</div>
</div>
<a id="a6fba37d8db6966c26c921887bcf11656" name="a6fba37d8db6966c26c921887bcf11656"></a>
<h2 class="memtitle"><span class="permalink"><a href="#a6fba37d8db6966c26c921887bcf11656">&#9670;&#160;</a></span>AttachingTargetProcess()</h2>

<div class="memitem">
<div class="memproto">
      <table class="memname">
        <tr>
          <td class="memname"><a class="el" href="_basic_types_8h.html#a7f319bfc2492a2136964194204e7a8cf">VOID</a> AttachingTargetProcess </td>
          <td>(</td>
          <td class="paramtype"><a class="el" href="_request_structures_8h.html#afd35adb8eff27c6c99326eb010e53b77">PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS</a></td>          <td class="paramname"><span class="paramname"><em>Request</em></span></td><td>)</td>
          <td></td>
        </tr>
      </table>
</div><div class="memdoc">

<p>Dispatch and perform attaching tasks. </p>
<p>this function should not be called in vmx-root</p>
<dl class="params"><dt>Parameters</dt><dd>
  <table class="params">
    <tr><td class="paramname">AttachRequest</td><td></td></tr>
  </table>
  </dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>VOID </dd></dl>
<div class="fragment"><div class="line"><span class="lineno"> 1509</span>{</div>
<div class="line"><span class="lineno"> 1510</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1511</span>    <span class="comment">// As we&#39;re here, we need to initialize the user-mode debugger</span></div>
<div class="line"><span class="lineno"> 1512</span>    <span class="comment">//</span></div>
<div class="line"><span class="lineno"> 1513</span>    <a class="code hl_function" href="_ud_8c.html#a86574ff4fedfd90b7552bf5d4f8d66a2">UdInitializeUserDebugger</a>();</div>
<div class="line"><span class="lineno"> 1514</span> </div>
<div class="line"><span class="lineno"> 1515</span>    <span class="keywordflow">switch</span> (Request-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a26284438b6d878b8737ac98b145e88ab">Action</a>)</div>
<div class="line"><span class="lineno"> 1516</span>    {</div>
<div class="line"><span class="lineno"> 1517</span>    <span class="keywordflow">case</span> <a class="code hl_enumvalue" href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99cab17712208c714d138fcd997164997140">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH</a>:</div>
<div class="line"><span class="lineno"> 1518</span> </div>
<div class="line"><span class="lineno"> 1519</span>        <a class="code hl_function" href="#aa2294a8797b41cc7787eeb68672689b9">AttachingPerformAttachToProcess</a>(Request, Request-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a2ac67b5f8f56470548ff82d1109782cf">IsStartingNewProcess</a>);</div>
<div class="line"><span class="lineno"> 1520</span> </div>
<div class="line"><span class="lineno"> 1521</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1522</span> </div>
<div class="line"><span class="lineno"> 1523</span>    <span class="keywordflow">case</span> <a class="code hl_enumvalue" href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca05d16ccfe495253cceaf6689a431ac69">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH</a>:</div>
<div class="line"><span class="lineno"> 1524</span> </div>
<div class="line"><span class="lineno"> 1525</span>        <a class="code hl_function" href="#a8f5b7ae763989ea4c219eada9c8889c6">AttachingPerformDetach</a>(Request);</div>
<div class="line"><span class="lineno"> 1526</span> </div>
<div class="line"><span class="lineno"> 1527</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1528</span> </div>
<div class="line"><span class="lineno"> 1529</span>    <span class="keywordflow">case</span> <a class="code hl_enumvalue" href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99cadac0916fcec7699dbf1a256bc7d68502">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS</a>:</div>
<div class="line"><span class="lineno"> 1530</span> </div>
<div class="line"><span class="lineno"> 1531</span>        <a class="code hl_function" href="#aba0a55c32fa1b903bbb0b4408b238f62">AttachingRemoveHooks</a>(Request);</div>
<div class="line"><span class="lineno"> 1532</span> </div>
<div class="line"><span class="lineno"> 1533</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1534</span> </div>
<div class="line"><span class="lineno"> 1535</span>    <span class="keywordflow">case</span> <a class="code hl_enumvalue" href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca77756390b09628021d10addc2fe94575">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS</a>:</div>
<div class="line"><span class="lineno"> 1536</span> </div>
<div class="line"><span class="lineno"> 1537</span>        <a class="code hl_function" href="#ae631c2803c19685c4517a36470b7f169">AttachingKillProcess</a>(Request);</div>
<div class="line"><span class="lineno"> 1538</span> </div>
<div class="line"><span class="lineno"> 1539</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1540</span> </div>
<div class="line"><span class="lineno"> 1541</span>    <span class="keywordflow">case</span> <a class="code hl_enumvalue" href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca89147ff1156d4c3e21df1adfb7052573">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS</a>:</div>
<div class="line"><span class="lineno"> 1542</span> </div>
<div class="line"><span class="lineno"> 1543</span>        <a class="code hl_function" href="#aa9fb4120d9e11c187b7a722ba6c7818c">AttachingPauseProcess</a>(Request);</div>
<div class="line"><span class="lineno"> 1544</span> </div>
<div class="line"><span class="lineno"> 1545</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1546</span> </div>
<div class="line"><span class="lineno"> 1547</span>    <span class="keywordflow">case</span> <a class="code hl_enumvalue" href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca81c1d2df73311ed5eaae743cc7503cb0">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD</a>:</div>
<div class="line"><span class="lineno"> 1548</span> </div>
<div class="line"><span class="lineno"> 1549</span>        <a class="code hl_function" href="#a7275aab09d377c86c14c6a7613897597">AttachingSwitchProcess</a>(Request);</div>
<div class="line"><span class="lineno"> 1550</span> </div>
<div class="line"><span class="lineno"> 1551</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1552</span> </div>
<div class="line"><span class="lineno"> 1553</span>    <span class="keywordflow">case</span> <a class="code hl_enumvalue" href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca17d8c76cc0b6231ecaea14138b4fce8f">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS</a>:</div>
<div class="line"><span class="lineno"> 1554</span> </div>
<div class="line"><span class="lineno"> 1555</span>        <a class="code hl_function" href="#aab87bdbf88894b1c9986c88a16298e38">AttachingQueryCountOfActiveDebuggingThreadsAndProcesses</a>(Request);</div>
<div class="line"><span class="lineno"> 1556</span> </div>
<div class="line"><span class="lineno"> 1557</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1558</span> </div>
<div class="line"><span class="lineno"> 1559</span>    <span class="keywordflow">default</span>:</div>
<div class="line"><span class="lineno"> 1560</span> </div>
<div class="line"><span class="lineno"> 1561</span>        Request-&gt;<a class="code hl_variable" href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a59469a1f2267eabd6b5ce5e1fc826145">Result</a> = <a class="code hl_define" href="_error_codes_8h.html#ac6f030856a8800eb9f8a0d12742d268a">DEBUGGER_ERROR_INVALID_ACTION_TYPE</a>;</div>
<div class="line"><span class="lineno"> 1562</span> </div>
<div class="line"><span class="lineno"> 1563</span>        <span class="keywordflow">break</span>;</div>
<div class="line"><span class="lineno"> 1564</span>    }</div>
<div class="line"><span class="lineno"> 1565</span>}</div>
<div class="ttc" id="a_attaching_8c_html_a7275aab09d377c86c14c6a7613897597"><div class="ttname"><a href="#a7275aab09d377c86c14c6a7613897597">AttachingSwitchProcess</a></div><div class="ttdeci">BOOLEAN AttachingSwitchProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS SwitchRequest)</div><div class="ttdoc">Switch to the target thread.</div><div class="ttdef"><b>Definition</b> Attaching.c:1362</div></div>
<div class="ttc" id="a_attaching_8c_html_a8f5b7ae763989ea4c219eada9c8889c6"><div class="ttname"><a href="#a8f5b7ae763989ea4c219eada9c8889c6">AttachingPerformDetach</a></div><div class="ttdeci">BOOLEAN AttachingPerformDetach(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS DetachRequest)</div><div class="ttdoc">Clearing hooks after resuming the process.</div><div class="ttdef"><b>Definition</b> Attaching.c:1302</div></div>
<div class="ttc" id="a_attaching_8c_html_aa2294a8797b41cc7787eeb68672689b9"><div class="ttname"><a href="#aa2294a8797b41cc7787eeb68672689b9">AttachingPerformAttachToProcess</a></div><div class="ttdeci">BOOLEAN AttachingPerformAttachToProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS AttachRequest, BOOLEAN IsAttachingToEntrypoint)</div><div class="ttdoc">Attach to the target process.</div><div class="ttdef"><b>Definition</b> Attaching.c:808</div></div>
<div class="ttc" id="a_attaching_8c_html_aa9fb4120d9e11c187b7a722ba6c7818c"><div class="ttname"><a href="#aa9fb4120d9e11c187b7a722ba6c7818c">AttachingPauseProcess</a></div><div class="ttdeci">BOOLEAN AttachingPauseProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS PauseRequest)</div><div class="ttdoc">Pauses the target process.</div><div class="ttdef"><b>Definition</b> Attaching.c:1185</div></div>
<div class="ttc" id="a_attaching_8c_html_aab87bdbf88894b1c9986c88a16298e38"><div class="ttname"><a href="#aab87bdbf88894b1c9986c88a16298e38">AttachingQueryCountOfActiveDebuggingThreadsAndProcesses</a></div><div class="ttdeci">BOOLEAN AttachingQueryCountOfActiveDebuggingThreadsAndProcesses(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS QueryCountOfDebugThreadsRequest)</div><div class="ttdoc">Query count of active debugging threads.</div><div class="ttdef"><b>Definition</b> Attaching.c:1450</div></div>
<div class="ttc" id="a_attaching_8c_html_aba0a55c32fa1b903bbb0b4408b238f62"><div class="ttname"><a href="#aba0a55c32fa1b903bbb0b4408b238f62">AttachingRemoveHooks</a></div><div class="ttdeci">BOOLEAN AttachingRemoveHooks(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS AttachRequest)</div><div class="ttdoc">Clearing hooks after resuming the process.</div><div class="ttdef"><b>Definition</b> Attaching.c:1124</div></div>
<div class="ttc" id="a_attaching_8c_html_ae631c2803c19685c4517a36470b7f169"><div class="ttname"><a href="#ae631c2803c19685c4517a36470b7f169">AttachingKillProcess</a></div><div class="ttdeci">BOOLEAN AttachingKillProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS KillRequest)</div><div class="ttdoc">Kill the target process from kernel-mode.</div><div class="ttdef"><b>Definition</b> Attaching.c:1210</div></div>
<div class="ttc" id="a_error_codes_8h_html_ac6f030856a8800eb9f8a0d12742d268a"><div class="ttname"><a href="_error_codes_8h.html#ac6f030856a8800eb9f8a0d12742d268a">DEBUGGER_ERROR_INVALID_ACTION_TYPE</a></div><div class="ttdeci">#define DEBUGGER_ERROR_INVALID_ACTION_TYPE</div><div class="ttdoc">error, invalid type of action</div><div class="ttdef"><b>Definition</b> ErrorCodes.h:39</div></div>
<div class="ttc" id="a_request_structures_8h_html_adae2fe215e407510cfb3fc5037aaf99ca05d16ccfe495253cceaf6689a431ac69"><div class="ttname"><a href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca05d16ccfe495253cceaf6689a431ac69">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH</a></div><div class="ttdeci">@ DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH</div><div class="ttdef"><b>Definition</b> RequestStructures.h:617</div></div>
<div class="ttc" id="a_request_structures_8h_html_adae2fe215e407510cfb3fc5037aaf99ca17d8c76cc0b6231ecaea14138b4fce8f"><div class="ttname"><a href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca17d8c76cc0b6231ecaea14138b4fce8f">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS</a></div><div class="ttdeci">@ DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS</div><div class="ttdef"><b>Definition</b> RequestStructures.h:622</div></div>
<div class="ttc" id="a_request_structures_8h_html_adae2fe215e407510cfb3fc5037aaf99ca77756390b09628021d10addc2fe94575"><div class="ttname"><a href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca77756390b09628021d10addc2fe94575">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS</a></div><div class="ttdeci">@ DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS</div><div class="ttdef"><b>Definition</b> RequestStructures.h:619</div></div>
<div class="ttc" id="a_request_structures_8h_html_adae2fe215e407510cfb3fc5037aaf99ca81c1d2df73311ed5eaae743cc7503cb0"><div class="ttname"><a href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca81c1d2df73311ed5eaae743cc7503cb0">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD</a></div><div class="ttdeci">@ DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD</div><div class="ttdef"><b>Definition</b> RequestStructures.h:621</div></div>
<div class="ttc" id="a_request_structures_8h_html_adae2fe215e407510cfb3fc5037aaf99ca89147ff1156d4c3e21df1adfb7052573"><div class="ttname"><a href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99ca89147ff1156d4c3e21df1adfb7052573">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS</a></div><div class="ttdeci">@ DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS</div><div class="ttdef"><b>Definition</b> RequestStructures.h:620</div></div>
<div class="ttc" id="a_request_structures_8h_html_adae2fe215e407510cfb3fc5037aaf99cab17712208c714d138fcd997164997140"><div class="ttname"><a href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99cab17712208c714d138fcd997164997140">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH</a></div><div class="ttdeci">@ DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH</div><div class="ttdef"><b>Definition</b> RequestStructures.h:616</div></div>
<div class="ttc" id="a_request_structures_8h_html_adae2fe215e407510cfb3fc5037aaf99cadac0916fcec7699dbf1a256bc7d68502"><div class="ttname"><a href="_request_structures_8h.html#adae2fe215e407510cfb3fc5037aaf99cadac0916fcec7699dbf1a256bc7d68502">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS</a></div><div class="ttdeci">@ DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS</div><div class="ttdef"><b>Definition</b> RequestStructures.h:618</div></div>
<div class="ttc" id="a_ud_8c_html_a86574ff4fedfd90b7552bf5d4f8d66a2"><div class="ttname"><a href="_ud_8c.html#a86574ff4fedfd90b7552bf5d4f8d66a2">UdInitializeUserDebugger</a></div><div class="ttdeci">BOOLEAN UdInitializeUserDebugger()</div><div class="ttdoc">initialize user debugger</div><div class="ttdef"><b>Definition</b> Ud.c:21</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_a26284438b6d878b8737ac98b145e88ab"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a26284438b6d878b8737ac98b145e88ab">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::Action</a></div><div class="ttdeci">DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE Action</div><div class="ttdef"><b>Definition</b> RequestStructures.h:638</div></div>
<div class="ttc" id="astruct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s_html_a2ac67b5f8f56470548ff82d1109782cf"><div class="ttname"><a href="struct___d_e_b_u_g_g_e_r___a_t_t_a_c_h___d_e_t_a_c_h___u_s_e_r___m_o_d_e___p_r_o_c_e_s_s.html#a2ac67b5f8f56470548ff82d1109782cf">_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS::IsStartingNewProcess</a></div><div class="ttdeci">BOOLEAN IsStartingNewProcess</div><div class="ttdef"><b>Definition</b> RequestStructures.h:632</div></div>
</div><!-- fragment -->
</div>
</div>
</div><!-- contents -->
</div><!-- doc-content -->
<!-- start footer part -->
<div id="nav-path" class="navpath"><!-- id is needed for treeview function! -->
  <ul>
    <li class="navelem"><a class="el" href="dir_53a6cdbae347618e9ee76d4be5c6ea96.html">hyperdbg</a></li><li class="navelem"><a class="el" href="dir_fd401680aa8c7ceffc479e97f6bdc4df.html">hyperkd</a></li><li class="navelem"><a class="el" href="dir_587853473f29459994cc5353647295ff.html">code</a></li><li class="navelem"><a class="el" href="dir_366222a910cb7e5dbd8918e7b8c2300f.html">debugger</a></li><li class="navelem"><a class="el" href="dir_5b295181e1984a926e957f167892ca57.html">user-level</a></li><li class="navelem"><a class="el" href="_attaching_8c.html">Attaching.c</a></li>
    <li class="footer">Generated by <a href="https://www.doxygen.org/index.html"><img class="footer" src="doxygen.svg" width="104" height="31" alt="doxygen"/></a> 1.11.0 </li>
  </ul>
</div>
</body>
</html>