WinArk/DbgEngine/DebugCore.cpp

#include "pch.h"
#include "DebugCore.h"

PNtWaitForDebugEvent g_pNtWaitForDebugEvent = nullptr;
PNtCreateDebugObject g_pNtCreateDebugObject = nullptr;
PDbgUiWaitStateChange g_pDbgUiWaitStateChange = nullptr;
PDebugSetProcessKillOnExit g_pDebugSetProcessKillOnExit = nullptr;
PDetourDbgUiContinue g_pDbgUiContinue = nullptr;
PDbgUiIssueRemoteBreakin g_pDbgUiIssueRemoteBreakin = nullptr;
PNtRemoveProcessDebug g_pNtRemoveProcessDebug = nullptr;

NTSTATUS
NTAPI
DetourNtWaitForDebugEvent(
    _In_ HANDLE DebugObjectHandle,
    _In_ BOOLEAN Alertable,
    _In_opt_ PLARGE_INTEGER Timeout,
    _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange
) {
    OutputDebugString(L"NtWaitForDebugEvent hooked!");
    return g_pNtWaitForDebugEvent(DebugObjectHandle, Alertable, Timeout, WaitStateChange);
}

NTSTATUS
NTAPI
DetourNtCreateDebugObject(
    _In_ HANDLE DebugObjectHandle,
    _In_ BOOLEAN Alertable,
    _In_opt_ PLARGE_INTEGER Timeout,
    _Out_ PDBGUI_WAIT_STATE_CHANGE WaitStateChange
) {
    OutputDebugString(L"NtCreateDebugObject hooked!");
    return g_pNtCreateDebugObject(DebugObjectHandle, Alertable, Timeout, WaitStateChange);
}

NTSTATUS
NTAPI
DetourDbgUiWaitStateChange(
    _Out_ PDBGUI_WAIT_STATE_CHANGE StateChange,
    _In_opt_ PLARGE_INTEGER Timeout
) {
    OutputDebugString(L"DbgUiWaitStateChange hooked!");
    return g_pDbgUiWaitStateChange(StateChange, Timeout);
}

BOOL
WINAPI
DetourDebugSetProcessKillOnExit(
    _In_ BOOL KillOnExit
) {
    OutputDebugString(L"DebugSetProcessKillOnExit hooked!");
    return g_pDebugSetProcessKillOnExit(KillOnExit);
}

NTSTATUS
NTAPI
DetourDbgUiContinue(
    _In_ PCLIENT_ID AppClientId,
    _In_ NTSTATUS ContinueStatus
) {
    OutputDebugString(L"DbgUiContinue hooked!");
    return g_pDbgUiContinue(AppClientId,ContinueStatus);
}

NTSTATUS
NTAPI
DetourDbgUiIssueRemoteBreakin(
    _In_ HANDLE Process
) {
    OutputDebugString(L"DbgUiIssueRemoteBreakin hooked!");
    return g_pDbgUiIssueRemoteBreakin(Process);
}

NTSTATUS
NTAPI
DetourNtRemoveProcessDebug(
    _In_ HANDLE ProcessHandle,
    _In_ HANDLE DebugObjectHandle
) {
    OutputDebugString(L"NtRemoveProcessDebug hooked!");
    return g_pNtRemoveProcessDebug(ProcessHandle,DebugObjectHandle);
}