load (load the kernel modules)

Command
load
Syntax
load [ModuleName (string)]
Description
Loads the HyperDbg's drivers and kernel modules into the target system.
Parameters
[ModuleName (string)]
The name of the module that you want to load.
Modules
Module Name
Description
vmm
Hypervisor-related capabilities
The debugger functions are implemented on top of 'vmm' module.
vmm : this module contains commands related to the debugger and all hypervisor-related capabilities. Currently, vmm is the only module of HyperDbg.
Examples
The following example loads vmm module.
1
HyperDbg> load vmm
Copied!
IOCTL
This command causes to run a CreateFile in the target system, in IRP_MJ_CREATE, the driver loads the modules like vt-x and debugger and all other kernel modules, so it doesn't have an IOCTL. You can call CreateFile to the driver's device and get a handle.
If you're using APIs, the following export in hprdbgctrl can be used.
1
HPRDBGCTRL_API int HyperdbgLoadVmm();
Copied!
Remarks
1.Only one application can get the device handle; after that, no other application is able to create a handle from the device or, in other words, is not able to call loadcommand until the first app releases the handle (by CloseHandle) or call unload command.
2.The application that requests to load the kernel modules should have SeDebugPrivilege to obtain a handle, otherwise an ACCESS_DENIED is thrown.
This command will continue the debuggee for some time (in Debugger Mode). This means that you lose the current context (registers & memory) after executing this command.
Requirements
Intel VT-x is required to be enabled to perform this action.
Intel Extended Page Table (a.k.a. SLAT) should be present in the processor. If you have a Nehalem (2008) processor or a newer processor, then it supports this feature.
Related
​unload (unload the kernel modules)​

~ (display and change the current operating core)

unload (unload the kernel modules)

Last modified 2mo ago

Copy link

Edit on GitHub

Contents