u, u64, u2, u32 (disassemble virtual address)
Description of 'u, u64, u2, u32' commands in HyperDbg.
Command
u
u64
u2
u32
Syntax
u [Address (hex)] [l Length (hex)] [pid ProcessId (hex)]
u64 [Address (hex)] [l Length (hex)] [pid ProcessId (hex)]
u2 [Address (hex)] [l Length (hex)] [pid ProcessId (hex)]
u32 [Address (hex)] [l Length (hex)] [pid ProcessId (hex)]
Description
Shows the assembly regarding memory content at the virtual address hex form.
Parameters
[Address (hex)]
The virtual address of where we want to start to disassemble its memory.
[l Length (hex)] (optional)
The length (byte) in hex format.
[pid ProcessId (hex)] (optional)
The Process ID that's in the hex format is what we want to see the memory from its context (cr3).
Examples
The following command is used when we want to disassemble the content of memory (x64) at fffff800`3ad6f010 with length of 0x50 bytes from the memory layout view of process (4 a.k.a. system process).
The following example shows the assembly content (x64) of memory at nt!ExAllocatePoolWithTag from current process memory layout.
The following example shows the assembly content (x64) of memory at nt!ExAllocatePoolWithTag+5 from current process memory layout.
The following example shows the assembly content (x64) of memory at fffff800`3ad6f010 from current process memory layout.
IOCTL
This function works by calling DeviceIoControl with IOCTL = IOCTL_DEBUGGER_READ_MEMORY , you have to send it in the following structure.
Where Pid is the process id, Address is the target location address and size is the length of the byte that you need to read.
MemoryTypeis either virtual or physical.
ReadingType is either from the kernel or from the vmx root. Currently, only the reading from the kernel is implemented.
If you don't want to read from the kernel directly, use the following HyperDbg Routine.
The above function fills the IOCTL structure and shows the memory content. It is also able to disassemble the memory. You can specify one of the following styles to show the memory.
For disassembling, use the DEBUGGER_SHOW_COMMAND_DISASSEMBLE64 as the Style for x64 disassembling, and for disassembling x86, use the DEBUGGER_SHOW_COMMAND_DISASSEMBLE32.
In the debugger mode, HyperDbg uses the exact same structure, you should send the above structure over serial to the debuggee which is paused in vmx-root mode.
You should send the above structure with DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_MEMORY as RequestedAction and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT as PacketType.
In return, the debuggee sends the above structure with the following type.
The following function is responsible for sending reading memory in the debugger.
Remarks
If you don't specify the length, the default length for HyperDbg is 0x40 Bytes.
By default, HyperDbg converts addresses to the object names (if the symbol for that address is available). If you want to see the address in hex format, you can turn
addressconversionto off using the 'settings' command.If you've ever seen any object name with two additions like
ExAllocatePoolWithTag+0x8f+0x2, it means that the address is outside the function size that we've parsed from the symbol PDB files. Compilers often put some junk codes at the end of functions to create an alignment, and HyperDbg will notify you about these situations with two additions. Also, if the function is from a stripped symbol (or, in other words, the function size is not available), we set the function size to a maximum length of0xffff.
Please note that you should specify a space between 'l' and the length for HyperDbg. For example, 'l10' is invalid, but 'l 10' is valid. (It's opposed to windbg).
HyperDbg uses Zydis as its core disassembler.
This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.
Requirements
None
Related
Last updated