print [Expression (string)]
@rax
register in the debuggee.@rcx
register.[email protected]
which $proc is equivalent to current _EPROCESS
added to the rdx register.ScriptBufferSize
and ScriptBufferPointer
to the values you got from the script engine interpreter, and leave the Result
and set the IsFormat
to false.DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT
as RequestedAction
and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT
as PacketType
.Result
is filled by the kernel.Result
is DEBUGEER_OPERATION_WAS_SUCCESSFULL
, then the operation was successful. Otherwise, the returned result is an error.print(expr);
in script engine, except that HyperDbg automatically adds print(
and );
.