prealloc (reserve pre-allocated pools)
Description of the 'prealloc' command in HyperDbg.

Command

prealloc

Syntax

prealloc [Type (string)] [Count (hex)]

Description

Reserves a specified number of pre-allocated pools.
In some cases, you need to reserve multiple pools to be used in vmx-root mode. This command will allocate these pools in PASSIVE_LEVEL.
HyperDbg tries to minimize the request for this command by allocating pools whenever your system is in PASSIVE_LEVEL.

Parameters

[Type (string)]
The type of pools to be reserved.
Type
Text
monitor
for !monitor commands extra pages
thread-interception
for processes with thousands of threads
[Count (hex)]
Number of pools to be allocated and reserved.

Examples

Imagine we want to pre-allocate and reserve 0x10 number of pools for the '!monitor' command.
1
0: kHyperDbg> prealloc monitor 10
2
the requested pools are allocated and reserved
Copied!

IOCTL

This function works by calling DeviceIoControl with IOCTL = IOCTL_RESERVE_PRE_ALLOCATED_POOLS, you have to send it in the following structure.
1
typedef struct _DEBUGGER_PREALLOC_COMMAND
2
{
3
DEBUGGER_PREALLOC_COMMAND_TYPE Type;
4
UINT64 Count;
5
UINT32 KernelStatus;
6
7
} DEBUGGER_PREALLOC_COMMAND, *PDEBUGGER_PREALLOC_COMMAND;
Copied!
You should only fill the Type and Count of the above structure when the IOCTL returns from the kernel, other parts of this structure are filled with appropriate KernelStatus.
The Type can be from the following enum:
1
typedef enum _DEBUGGER_PREALLOC_COMMAND_TYPE
2
{
3
DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR,
4
DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION,
5
} DEBUGGER_PREALLOC_COMMAND_TYPE;
Copied!

Remarks

This command will continue the debuggee for some time (in Debugger Mode). This means that you lose the current context (registers & memory) after executing this command.

Requirements

None
None