print (evaluate and print expression in debuggee)
Description of the 'print' command in HyperDbg.
Command
Syntax
print [Expression (string)]
Description
Shows the result of an expression that will be executed in the remote debuggee.
Parameters
[Expression (string)]
Examples
The following command shows the @rax
register in the debuggee.
The following command shows the data as an 8-byte hex, pointed by the @rcx
register.
The following command shows the value pointed by $proc+@rdx
which $proc is equivalent to current _EPROCESS
added to the rdx register.
The following command shows the value of an address, which first, rax register is added with 0xa0 constant then a dereference occurs and the target is shown as a QWORD hex.
IOCTL
This commands works over serial by sending the serial packets to the remote computer.
First of all, you should fill the following structure, set the ScriptBufferSize
and ScriptBufferPointer
to the values you got from the script engine interpreter, and leave the Result
and set the IsFormat
to false.
After that, you should move the interpreted buffer to the end of the structure (this structure is a header for the interpreted buffer).
Next step is sending the above structure to the debuggee when debuggee is paused and waiting for new command on vmx-root mode.
You should send the above structure with DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT
as RequestedAction
and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT
as PacketType
.
In return, the debuggee sends the above structure with the following type.
In the returned structure, the Result
is filled by the kernel.
If the Result
is DEBUGEER_OPERATION_WAS_SUCCESSFULL
, then the operation was successful. Otherwise, the returned result is an error.
The following function is responsible for sending script buffers in the debugger.
Remarks
This command is exactly like print(expr);
in script engine, except that HyperDbg automatically adds print(
and );
.
This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.
Requirements
None
Related
None
Last updated