# Commands

- [Debugging Commands](/commands/debugging-commands.md)
- [? (evaluate and execute expressions and scripts in debuggee)](/commands/debugging-commands/eval.md): Description of the '?' command in HyperDbg.
- [~ (display and change the current operating core)](/commands/debugging-commands/core.md): Description of the '~' command in HyperDbg.
- [a (assemble virtual address)](/commands/debugging-commands/a.md): Description of the 'a' command in HyperDbg.
- [load (load the kernel modules)](/commands/debugging-commands/load.md): Description of the 'load' command in HyperDbg.
- [unload (unload the kernel modules)](/commands/debugging-commands/unload.md): Description of the 'unload' command in HyperDbg.
- [status (show the debuggee status)](/commands/debugging-commands/status.md): Description of the 'status' command in HyperDbg.
- [events (show and modify active/disabled events)](/commands/debugging-commands/events.md): Description of the 'event' command in HyperDbg.
- [p (step-over)](/commands/debugging-commands/p.md): Description of the 'p' command in HyperDbg.
- [t (step-in)](/commands/debugging-commands/t.md): Description of the 't' command in HyperDbg.
- [i (instrumentation step-in)](/commands/debugging-commands/i.md): Description of the 'i' command in HyperDbg.
- [gu (step-out or go up)](/commands/debugging-commands/gu.md): Description of the 'gu' command in HyperDbg.
- [r (read or modify registers)](/commands/debugging-commands/r.md): Description of the 'r' command in HyperDbg.
- [bp (set breakpoint)](/commands/debugging-commands/bp.md): Description of the 'bp' command in HyperDbg.
- [bl (list breakpoints)](/commands/debugging-commands/bl.md): Description of the 'bl' command in HyperDbg.
- [be (enable breakpoints)](/commands/debugging-commands/be.md): Description of the 'be' command in HyperDbg.
- [bd (disable breakpoints)](/commands/debugging-commands/bd.md): Description of the 'bd' command in HyperDbg.
- [bc (clear and remove breakpoints)](/commands/debugging-commands/bc.md): Description of the 'bc' command in HyperDbg.
- [g (continue debuggee or processing kernel packets)](/commands/debugging-commands/g.md): Description of the 'g' command in HyperDbg.
- [x (examine symbols and find functions and variables address)](/commands/debugging-commands/x.md): Description of the 'x' command in HyperDbg.
- [db, dc, dd, dq (read virtual memory)](/commands/debugging-commands/d.md): Description of 'db, dc, dd, dq' commands in HyperDbg.
- [eb, ed, eq (edit virtual memory)](/commands/debugging-commands/e.md): Description of 'eb, ed, eq' commands in HyperDbg.
- [sb, sd, sq (search virtual memory)](/commands/debugging-commands/s.md): Description of 'sb, sd, sq' commands in HyperDbg.
- [u, u64, u2, u32 (disassemble virtual address)](/commands/debugging-commands/u.md): Description of 'u, u64, u2, u32' commands in HyperDbg.
- [k, kd, kq (display stack backtrace)](/commands/debugging-commands/k.md): Description of 'k, kd, kq' commands in HyperDbg.
- [dt (display and map virtual memory to structures)](/commands/debugging-commands/dt.md): Description of the 'dt' command in HyperDbg.
- [struct (make structures, enums, data types from symbols)](/commands/debugging-commands/struct.md): Description of the 'struct' command in HyperDbg.
- [sleep (wait for specific time in the .script command)](/commands/debugging-commands/sleep.md): Description of the 'sleep' command in HyperDbg.
- [pause (break to the debugger and pause processing kernel packets)](/commands/debugging-commands/pause.md): Description of the 'pause' command in HyperDbg.
- [print (evaluate and print expression in debuggee)](/commands/debugging-commands/print.md): Description of the 'print' command in HyperDbg.
- [lm (view loaded modules)](/commands/debugging-commands/lm.md): Description of the 'lm' command in HyperDbg.
- [cpu (check cpu supported technologies)](/commands/debugging-commands/cpu.md): Description of the 'cpu' command in HyperDbg.
- [rdmsr (read model-specific register)](/commands/debugging-commands/rdmsr.md): Description of the 'rdmsr' command in HyperDbg.
- [wrmsr (write model-specific register)](/commands/debugging-commands/wrmsr.md): Description of the 'wrmsr' command in HyperDbg.
- [flush (remove pending kernel buffers and messages)](/commands/debugging-commands/flush.md): Description of the 'flush' command in HyperDbg.
- [prealloc (reserve pre-allocated pools)](/commands/debugging-commands/prealloc.md): Description of the 'prealloc' command in HyperDbg.
- [preactivate (pre-activate special functionalities)](/commands/debugging-commands/preactivate.md): Description of the 'preactivate' command in HyperDbg.
- [output (create output source for event forwarding)](/commands/debugging-commands/output.md): Description of the 'output' command in HyperDbg.
- [test (test functionalities)](/commands/debugging-commands/test.md): Description of the 'test' command in HyperDbg.
- [settings (configures different options and preferences)](/commands/debugging-commands/settings.md): Description of the 'settings' command in HyperDbg.
- [exit (exit from the debugger)](/commands/debugging-commands/exit.md): Description of the 'exit' command in HyperDbg.
- [Meta Commands](/commands/meta-commands.md)
- [.help (show the help of commands)](/commands/meta-commands/.help.md): Description of the '.help' command in HyperDbg.
- [.debug (prepare and connect to debugger)](/commands/meta-commands/.debug.md): Description of the '.debug' command in HyperDbg.
- [.connect (connect to a session)](/commands/meta-commands/.connect.md): Description of the '.connect' command in HyperDbg.
- [.disconnect (disconnect from a session)](/commands/meta-commands/.disconnect.md): Description of the '.disconnect' command in HyperDbg.
- [.listen (listen on a port and wait for the debugger to connect)](/commands/meta-commands/.listen.md): Description of the '.listen' command in HyperDbg.
- [.status (show the debugger status)](/commands/meta-commands/.status.md): Description of the '.status' command in HyperDbg.
- [.start (start a new process)](/commands/meta-commands/.start.md): Description of the '.start' command in HyperDbg.
- [.restart (restart the process)](/commands/meta-commands/.restart.md): Description of the '.restart' command in HyperDbg.
- [.attach (attach to a process)](/commands/meta-commands/.attach.md): Description of the '.attach' command in HyperDbg.
- [.detach (detach from the process)](/commands/meta-commands/.detach.md): Description of the '.detach' command in HyperDbg.
- [.switch (show the list and switch between active debugging processes)](/commands/meta-commands/.switch.md): Description of the '.switch' command in HyperDbg.
- [.kill (terminate the process)](/commands/meta-commands/.kill.md): Description of the '.kill' command in HyperDbg.
- [.process, .process2 (show the current process and switch to another process)](/commands/meta-commands/.process.md): Description of '.process, .process2' commands in HyperDbg.
- [.thread, .thread2 (show the current thread and switch to another thread)](/commands/meta-commands/.thread.md): Description of '.thread, .thread2' commands in HyperDbg.
- [.pagein (bring the page into the RAM)](/commands/meta-commands/.pagein.md): Description of the '.pagein' command in HyperDbg.
- [.dump (save the virtual memory into a file)](/commands/meta-commands/.dump.md): Description of the '.dump' command in HyperDbg.
- [.formats (show number formats)](/commands/meta-commands/.formats.md): Description of the '.formats' command in HyperDbg.
- [.script (run batch script commands)](/commands/meta-commands/.script.md): Description of the '.script' command in HyperDbg.
- [.sympath (set the symbol server)](/commands/meta-commands/.sympath.md): Description of the '.sympath' command in HyperDbg.
- [.sym (load pdb symbols)](/commands/meta-commands/.sym.md): Description of the '.sym' command in HyperDbg.
- [.pe (parse PE file)](/commands/meta-commands/.pe.md): Description of the '.pe' command in HyperDbg.
- [.logopen (open log file)](/commands/meta-commands/.logopen.md): Description of the '.logopen' command in HyperDbg.
- [.logclose (close log file)](/commands/meta-commands/.logclose.md): Description of the '.logclose' command in HyperDbg.
- [.cls (clear the screen)](/commands/meta-commands/.cls.md): Description of the '.cls' command in HyperDbg.
- [Extension Commands](/commands/extension-commands.md)
- [!a (assemble physical address)](/commands/extension-commands/a.md): Description of the '!a' command in HyperDbg.
- [!pte (display page-level address and entries)](/commands/extension-commands/pte.md): Description of the '!pte' command in HyperDbg.
- [!db, !dc, !dd, !dq (read physical memory)](/commands/extension-commands/d.md): Description of '!db, !dc, !dd, !dq' commands in HyperDbg.
- [!eb, !ed, !eq (edit physical memory)](/commands/extension-commands/e.md): Description of '!eb, !ed, !eq' commands in HyperDbg.
- [!sb, !sd, !sq (search physical memory)](/commands/extension-commands/s.md): Description of '!sb, !sd, !sq' commands in HyperDbg.
- [!u, !u64, !u2, !u32 (disassemble physical address)](/commands/extension-commands/u.md): Description of '!u, !u64, !u2 !u32' commands in HyperDbg.
- [!dt (display and map physical memory to structures)](/commands/extension-commands/dt.md): Description of the '!dt' command in HyperDbg.
- [!track (track and map function calls and returns to the symbols)](/commands/extension-commands/track.md): Description of the '!track' command in HyperDbg.
- [!epthook (hidden hook with EPT - stealth breakpoints)](/commands/extension-commands/epthook.md): Description of the '!epthook' command in HyperDbg.
- [!epthook2 (hidden hook with EPT - detours)](/commands/extension-commands/epthook2.md): Description of the '!epthook2' command in HyperDbg.
- [!monitor (monitor read/write/execute to a range of memory)](/commands/extension-commands/monitor.md): Description of the '!monitor' command in HyperDbg.
- [!syscall, !syscall2 (hook system-calls)](/commands/extension-commands/syscall.md): Description of '!syscall, !syscall2' commands in HyperDbg.
- [!sysret, !sysret2 (hook SYSRET instruction execution)](/commands/extension-commands/sysret.md): Description of '!sysret, !sysret2' commands in HyperDbg.
- [!mode (detect kernel-to-user and user-to-kernel transitions)](/commands/extension-commands/mode.md): Description of the '!mode' command in HyperDbg.
- [!cpuid (hook CPUID instruction execution)](/commands/extension-commands/cpuid.md): Description of the '!cpuid' command in HyperDbg.
- [!msrread (hook RDMSR instruction execution)](/commands/extension-commands/msrread.md): Description of the '!msrread' command in HyperDbg.
- [!msrwrite (hook WRMSR instruction execution)](/commands/extension-commands/msrwrite.md): Description of the '!msrwrite' command in HyperDbg.
- [!tsc (hook RDTSC/RDTSCP instruction execution)](/commands/extension-commands/tsc.md): Description of the '!tsc' command in HyperDbg.
- [!pmc (hook RDPMC instruction execution)](/commands/extension-commands/pmc.md): Description of the '!pmc' command in HyperDbg.
- [!vmcall (hook hypercalls)](/commands/extension-commands/vmcall.md): Description of the '!vmcall' command in HyperDbg.
- [!exception (hook first 32 entries of IDT)](/commands/extension-commands/exception.md): Description of the '!exception' command in HyperDbg.
- [!interrupt (hook external device interrupts)](/commands/extension-commands/interrupt.md): Description of the '!interrupt' command in HyperDbg.
- [!dr (hook access to debug registers)](/commands/extension-commands/dr.md): Description of the '!dr' command in HyperDbg.
- [!ioin (hook IN instruction execution)](/commands/extension-commands/ioin.md): Description of the '!ioin' command in HyperDbg.
- [!ioout (hook OUT instruction execution)](/commands/extension-commands/ioout.md): Description of the '!ioout' command in HyperDbg.
- [!xsetbv (hook XSETBV instruction execution)](/commands/extension-commands/xsetbv.md): Description of the '!xsetbv' command in HyperDbg.
- [!hide (enable transparent-mode)](/commands/extension-commands/hide.md): Description of the '!hide' command in HyperDbg.
- [!unhide (disable transparent-mode)](/commands/extension-commands/unhide.md): Description of the '!unhide' command in HyperDbg.
- [!measure (measuring and providing details for transparent-mode)](/commands/extension-commands/measure.md): Description of the '!measure' command in HyperDbg.
- [!va2pa (convert a virtual address to physical address)](/commands/extension-commands/va2pa.md): Description of the '!va2pa' command in HyperDbg.
- [!pa2va (convert physical address to virtual address)](/commands/extension-commands/pa2va.md): Description of '!pa2va' command in HyperDbg.
- [!dump (save the physical memory into a file)](/commands/extension-commands/dump.md): Description of '!dump' command in HyperDbg.
- [!pcitree (show PCI/PCIe device tree)](/commands/extension-commands/pcitree.md): Description of '!pcitree' command in HyperDbg.
- [!pcicam (dump the PCI/PCIe configuration space)](/commands/extension-commands/pcicam.md): Description of '!pcicam' command in HyperDbg.
- [!idt (show Interrupt Descriptor Table entries)](/commands/extension-commands/idt.md): Description of '!idt' command in HyperDbg.
- [!smi (trigger and show System Management Interrupt functionalities)](/commands/extension-commands/smi.md): Description of '!smi' command in HyperDbg.
- [!apic (dump local APIC entries in XAPIC and X2APIC modes)](/commands/extension-commands/apic.md): Description of '!apic' command in HyperDbg.
- [!ioapic (dump I/O APIC)](/commands/extension-commands/ioapic.md): Description of '!ioapic' command in HyperDbg.
- [Scripting Language](/commands/scripting-language.md)
- [Assumptions & Evaluations](/commands/scripting-language/assumptions-and-evaluations.md): Description of keywords, operators, pseudo-registers, number prefixes, and pre-defined functions
- [Variables & Assignments](/commands/scripting-language/variables-and-assignments.md): Description of variables and assignments
- [Casting & Inclusion](/commands/scripting-language/casting-and-inclusion.md): Description of casting (type-awareness) and file (library) inclusion
- [Conditionals & Loops](/commands/scripting-language/conditionals-and-loops.md): Description of conditional statements and loops
- [Constants & Functions](/commands/scripting-language/constants-and-functions.md): Description of constants and functions
- [Debugger Script (DS)](/commands/scripting-language/debugger-script.md): Description of HyperDbg Debugger Scripts
- [Examples](/commands/scripting-language/examples.md)
- [view system state (registers, memory, variables)](/commands/scripting-language/examples/view-system-state.md): An example of valid expressions to read the state of the system
- [change system state (registers, memory, variables)](/commands/scripting-language/examples/change-system-state-registers-memory-variables.md): An example of changing system state
- [trace function calls](/commands/scripting-language/examples/trace-function-calls.md): An example of creating logs from NtOpenFile
- [pause the debugger conditionally](/commands/scripting-language/examples/pause-the-debugger-conditionally.md): An example of pausing system while a special path is passed to the NtCreateFile
- [conditional breakpoints and events](/commands/scripting-language/examples/conditional-breakpoints-and-events.md): An example of using conditional breakpoint (events)
- [patch the normal sequence of execution](/commands/scripting-language/examples/patch-the-normal-sequence-of-execution.md): An example of patching eflags of the target program
- [access to a shared variable from different cores](/commands/scripting-language/examples/access-to-a-shared-variable-from-different-cores.md): An example of sharing global variables between different cores
- [count occurrences of events](/commands/scripting-language/examples/count-occurrences-of-events.md): An example of counting the occurrence of page-faults
- [Functions](/commands/scripting-language/functions.md): List of HyperDbg functions
- [debugger](/commands/scripting-language/functions/debugger.md): Functions related to the debugger
- [pause](/commands/scripting-language/functions/debugger/pause.md): Description of the 'pause' function in HyperDbg Scripts
- [events](/commands/scripting-language/functions/events.md): Functions related to events
- [event\_enable](/commands/scripting-language/functions/events/event_enable.md): Description of the 'event\_enable' function in HyperDbg Scripts
- [event\_disable](/commands/scripting-language/functions/events/event_disable.md): Description of the 'event\_disable' function in HyperDbg Scripts
- [event\_clear](/commands/scripting-language/functions/events/event_clear.md): Description of the 'event\_clear' function in HyperDbg Scripts
- [event\_sc](/commands/scripting-language/functions/events/event_sc.md): Description of the 'event\_enable' function in HyperDbg Scripts
- [event\_inject](/commands/scripting-language/functions/events/event_inject.md): Description of the 'event\_inject' function in HyperDbg Scripts
- [event\_inject\_error\_code](/commands/scripting-language/functions/events/event_inject_error_code.md): Description of the 'event\_inject\_error\_code' function in HyperDbg Scripts
- [flush](/commands/scripting-language/functions/events/flush.md): Description of the 'flush' function in HyperDbg Scripts
- [exports](/commands/scripting-language/functions/exports.md): Functions for exporting and printing messages
- [print](/commands/scripting-language/functions/exports/print.md): Description of the 'print' function in HyperDbg Scripts
- [printf](/commands/scripting-language/functions/exports/printf.md): Description of the 'printf' function in HyperDbg Scripts
- [interlocked](/commands/scripting-language/functions/interlocked.md): Interlocked and atomic functions
- [interlocked\_compare\_exchange](/commands/scripting-language/functions/interlocked/interlocked_compare_exchange.md): Description of the 'interlocked\_compare\_exchange' function in HyperDbg Scripts
- [interlocked\_decrement](/commands/scripting-language/functions/interlocked/interlocked_decrement.md): Description of the 'interlocked\_decrement' function in HyperDbg Scripts
- [interlocked\_exchange](/commands/scripting-language/functions/interlocked/interlocked_exchange.md): Description of the 'interlocked\_exchange' function in HyperDbg Scripts
- [interlocked\_exchange\_add](/commands/scripting-language/functions/interlocked/interlocked_exchange_add.md): Description of the 'interlocked\_exchange\_add' function in HyperDbg Scripts
- [interlocked\_increment](/commands/scripting-language/functions/interlocked/interlocked_increment.md): Description of the 'interlocked\_increment' function in HyperDbg Scripts
- [memory](/commands/scripting-language/functions/memory.md): Functions related to the memory
- [check\_address](/commands/scripting-language/functions/memory/check_address.md): Description of the 'check\_address' function in HyperDbg Scripts
- [eb, ed, eq](/commands/scripting-language/functions/memory/eb-ed-eq.md): Description of 'eb', 'ed', and 'eq' functions in HyperDbg Scripts
- [eb\_pa, ed\_pa, eq\_pa](/commands/scripting-language/functions/memory/eb_pa-ed_pa-eq_pa.md): Description of 'eb\_pa', 'ed\_pa', and 'eq\_pa' functions in HyperDbg Scripts
- [memcpy](/commands/scripting-language/functions/memory/memcpy.md): Description of the 'memcpy' function in HyperDbg Scripts
- [memcpy\_pa](/commands/scripting-language/functions/memory/memcpy_pa.md): Description of the 'memcpy\_pa' function in HyperDbg Scripts
- [memcmp](/commands/scripting-language/functions/memory/memcmp.md): Description of the 'memcmp' function in HyperDbg Scripts
- [virtual\_to\_physical](/commands/scripting-language/functions/memory/virtual_to_physical.md): Description of the 'virtual\_to\_physical' function in HyperDbg Scripts
- [physical\_to\_virtual](/commands/scripting-language/functions/memory/physical_to_virtual.md): Description of the 'physical\_to\_virtual' function in HyperDbg Scripts
- [diassembler](/commands/scripting-language/functions/diassembler.md)
- [disassemble\_len](/commands/scripting-language/functions/diassembler/disassemble_len.md): Description of the 'disassemble\_len' function in HyperDbg Scripts
- [disassemble\_len32](/commands/scripting-language/functions/diassembler/disassemble_len32.md): Description of the 'disassemble\_len32' function in HyperDbg Scripts
- [spinlocks](/commands/scripting-language/functions/spinlocks.md): Functions related to spinlocks
- [spinlock\_lock](/commands/scripting-language/functions/spinlocks/spinlock_lock.md): Description of the 'spinlock\_lock' function in HyperDbg Scripts
- [spinlock\_lock\_custom\_wait](/commands/scripting-language/functions/spinlocks/spinlock_lock_custom_wait.md): Description of the 'spinlock\_lock\_custom\_wait' function in HyperDbg Scripts
- [spinlock\_unlock](/commands/scripting-language/functions/spinlocks/spinlock_unlock.md): Description of the 'spinlock\_unlock' function in HyperDbg Scripts
- [timings](/commands/scripting-language/functions/timings.md)
- [rdtsc](/commands/scripting-language/functions/timings/rdtsc.md): Description of the 'rdtsc' function in HyperDbg Scripts
- [rdtscp](/commands/scripting-language/functions/timings/rdtscp.md): Description of the 'rdtscp' function in HyperDbg Scripts
- [microsleep](/commands/scripting-language/functions/timings/microsleep.md): Description of the 'microsleep' function in HyperDbg Scripts
- [strings](/commands/scripting-language/functions/strings.md): Functions related to strings
- [strlen](/commands/scripting-language/functions/strings/strlen.md): Description of the 'strlen' function in HyperDbg Scripts
- [wcslen](/commands/scripting-language/functions/strings/wcslen.md): Description of the 'wcslen' function in HyperDbg Scripts
- [strcmp](/commands/scripting-language/functions/strings/strcmp.md): Description of the 'strcmp' function in HyperDbg Scripts
- [strncmp](/commands/scripting-language/functions/strings/strncmp.md): Description of the 'strncmp' function in HyperDbg Scripts
- [wcscmp](/commands/scripting-language/functions/strings/wcscmp.md): Description of the 'wcscmp' function in HyperDbg Scripts
- [wcsncmp](/commands/scripting-language/functions/strings/wcsncmp.md): Description of the 'wcsncmp' function in HyperDbg Scripts