Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Script engine issues on Pseudo-registers and Conditional statements #311

Closed
SinaKarvandi opened this issue Nov 13, 2023 · 0 comments
Closed
Assignees
Labels
bug Something isn't working fixed This issue is fixed

Comments

@SinaKarvandi
Copy link
Member

Hey, @xmaple555!
If you find free time, can you check why we couldn't use underline ( _ ) in the pseudo-register. I don't have that much expertise in script engine code, you probably know it better than me.

Generally, if I change a pseudo-register (let's say, $tag to $event_tag and generate it by using the Python script), then after compiling HyperDbg, the following expression gives an invalid syntax error.

image

HyperDbg> ? printf("test core: %x", $event_tag);
this command should not be used while you're in VMI-Mode or not in debugger-mode, the results that you see is a simulated result for TESTING script-engine and is not based on the status of your system. You can use this command, ONLY in debugger-mode

test expression : printf("test core: %x", $event_tag);
Line 0:
printf("test core: %x", $event_tag);
                        ^
Syntax Error: Invalid Syntax

Other than that, a script like this gives error and I couldn't figure it out why.

? if ( @rcx == 0xffffc105a50f00a8 || @rdx == 0xffffc105a50f00a8 || @rsp == 1 ) {
	printf("Hit"); 
}

or the above script in other forms:

!epthook nt!ExAllocatePoolWithTag script {

if ( @rcx == 0xffffc105a50f00a8 || @rdx == 0xffffc105a50f00a8 || @r8 == 0xffffc105a50f00a8 || @r9 == 0xffffc105a50f00a8) {
	printf("Heaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaatttttttttt"); 
}
// printf("MiCopyFromUntrustedMemory  RIP: %llx Address: %llx string: %ws\n", @rip, @rcx, @rcx); 
}

If it's too hard to be fixed, or if you couldn't find the problem, don't worry, I'll try to find other ways to fix them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working fixed This issue is fixed
Projects
None yet
Development

No branches or pull requests

2 participants