~ (display and change the current operating core)
Description of the '~' command in HyperDbg.
Command
~
Syntax
~~ [CoreNumber (hex)]
Description
Shows or changes the current operating core. This command can only be used in Debugger Mode.
Parameters
[CoreNumber (hex)] (optional)
Target core number (starts from zero).
If you don't specify any parameters to the '~' command, it shows the current operating core.
Examples
The following command shows the current operating core.
1
0: kHyperDbg> ~
2
current processor : 0x2
Copied!
The following commands display and then change the current operating core to
0x1.1
0: kHyperDbg> ~
2
current processor : 0x2
3
​
4
0: kHyperDbg> ~ 1
5
current operating core changed to 0x1
6
fffff801`633f157f C3 ret
7
​
8
0: kHyperDbg> ~
9
current processor : 0x1
Copied!
IOCTL
This commands works over serial by sending the serial packets to the remote computer.
First of all, you should fill the following structure, set the
NewCore to your target core, and leave the Result.1
typedef struct _DEBUGGEE_CHANGE_CORE_PACKET {
2
​
3
UINT32 NewCore;
4
UINT32 Result;
5
​
6
} DEBUGGEE_CHANGE_CORE_PACKET, *PDEBUGGEE_CHANGE_CORE_PACKET;
Copied!
After that, send the above structure to the debuggee when debuggee is paused and waiting for new command on vmx-root mode.
You should send the above structure with
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_MODE_CHANGE_CORE as RequestedAction and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT as PacketType.In return, the debuggee sends the above structure with the following type.
1
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_CHANGING_CORE
Copied!
In the returned structure, the
Result is filled by the kernel.If the
Result is DEBUGEER_OPERATION_WAS_SUCCESSFULL, then the operation was successful, and you should wait for a new pause packet from debuggee. Otherwise, the returned result is an error (e.g., the core number is invalid), and the current operating core is not changed.The following function is responsible for changing the core in the debugger.
1
BOOLEAN KdSendSwitchCorePacketToDebuggee(UINT32 NewCore);
Copied!
Remarks
If the current core is equal to the target core, then it will not be changed.
Another alias for the '~' command is 'core'.
This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.
Requirements
None
Related
None
Copy link
Edit on GitHub