? (evaluate and execute expressions and scripts in debuggee)
Description of the '?' command in HyperDbg.
?
? [Expression (string)]
Evaluates and executes an expression in the remote debuggee.
You can write multiline scripts by putting the scripts between two curly brackets.
For example,
? { printf("first line");printf("second line");printf("third line");}[Expression (string)]
HyperDbg> ? print(@rax);
This commands works over serial by sending the serial packets to the remote computer.
First of all, you should fill the following structure, set the
ScriptBufferSize and ScriptBufferPointer to buffers you got from the script engine interpreter, and leave the Resultand set the IsFormat to false.After that, you should move the interpreted buffer to the end of the structure (this structure is a header for the interpreted buffer).
typedef struct _DEBUGGEE_SCRIPT_PACKET { UINT32 ScriptBufferSize; UINT32 ScriptBufferPointer; BOOLEAN IsFormat; UINT32 Result; // // The script buffer is here //} DEBUGGEE_SCRIPT_PACKET, *PDEBUGGEE_SCRIPT_PACKET;
The next step is sending the above structure to the debuggee when debuggee is paused and waiting for new command on vmx-root mode.
You should send the above structure with
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT as RequestedAction and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT as PacketType.In return, the debuggee sends the above structure with the following type.
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_RUNNING_SCRIPT
In the returned structure, the
Result is filled by the kernel.If the
Result is DEBUGEER_OPERATION_WAS_SUCCESSFULL, then the operation was successful. Otherwise, the returned result is an error.The following function is responsible for sending script buffers in the debugger.
BOOLEAN KdSendScriptPacketToDebuggee(UINT64 BufferAddress, UINT32 BufferLength, UINT32 Pointer, BOOLEAN IsFormat);
Other aliases for this command are 'eval' and 'evaluate'.
This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.
None
None