ErisDbg

August 28, 2024 · View on GitHub

介绍

ErisDbg是一个基于vt的重建Windows10调试体系的项目。

基于VT的EPT HOOK，重构了Windows10的十余个关键的调试函数，已在Windows10 22H2实机测试。

VT部分参考： HyperPlatform

重构的调试函数

  • NtCreateDebugObject

  • GetDbgkInitialize

  • NtWaitForDebugEvent

  • NtDebugActiveProcess

  • ProbeForReadSmallStructure

  • NtDebugContinue

  • DbgkpConvertKernelToUserStateChange

  • DbgkpOpenHandles

  • GePsGetProcessDebugPort

  • PsSetProcessDebugPort

  • IsThreadSkipCreationMsg

  • DbgkpSuspendProcess

  • DbgkpFreeDebugEvent

  • DbgkpWakeTarget

  • DbgkpQueueMessage

  • DbgkpSendApiMessage

  • DbgkpProcessToFileHandle

  • PsGetThreadToAPCProcess

  • DbgkSendSystemDllMessages

  • DbgkpPostFakeThreadMessages

  • DbgkpPostModuleMessages

  • DbgkpPostFakeProcessCreateMessages

  • DbgkpSetProcessDebugObject

  • PsCaptureExceptionPort

  • DbgkForwardException

alt text

alt text

alt text