settings (configures different options and preferences)
Description of the 'settings' command in HyperDbg.
Command
settings
Syntax
settings [OptionName (string)]
settings [OptionName (string)] [Value (hex)]
settings [OptionName (string)] [Value (string)]
settings [OptionName (string)] [on|off]
Description
This command queries or changes the value of options and preferences.
Parameters
[OptionName (string)]
Name of the option.
[Value (hex)]
Target value (hex) to modify the option.
[Value (string)]
Target value (string) to modify the option.
[on|off]
On or off value to modify the option.
Each option has its own value; for example, some options might be on or off, and others might be custom numbers or names.
Options
autoflush
on | off
off
autounpause
on | off
on
syntax
intel | att | masm
intel
addressconversion
on | off
on
autoflush : if you turn autoflush on, after each disabling or clearing an event using the 'events' command, all the possible pending buffers and messages from all the commands (not just the command that you disabled or removed) that are stored to be received by the user-mode from the kernel-mode and when you press 'g', you no longer see any results from previous commands; however, some commands might continue generating new messages, and those new messages won't be removed.
You can also perform the autoflush manually by running the 'flush' command.
autounpause : if you turn autounpause on, then if you press CTRL+C or run the 'pause' command to break to the debugger, every new event will automatically turn off your break, and you'll start receiving events and messages from the kernel-mode buffers. However, if you turn it off, then you won't receive kernel buffers and messages when you invoke a new event as the debugger will remain in the paused state (for example, paused because of 'pause' command or CTRL+C), in this case, you can resume receiving messages from the kernel-mode buffer by running 'g' command.
syntax : specifies the syntax of disassembler for '!u and !u2' commands.
addressconverison : if you turn addressconversion on, then in the case of disassembling memory, it converts addresses to object names (if the symbol is available for that address). Otherwise, it shows the address in hex format. This option also affects showing function names in stepping through the instructions.
Examples
The following command shows the state of autounpause option.
The following command turns autounpause on.
The following command turns autounpause off.
The following command shows the different syntax used in the disassembler. You can choose your favorite syntax to show in '!u and !u2' commands.
IOCTL
None
Remarks
autounpause and autoflush do not change anything in debugger mode. It is because the buffers are not accumulated and passed instantly in this mode; thus, there is nothing to flush.
Requirements
None
Related
None
Last updated