!a (assemble physical address)
Description of the '!a' command in HyperDbg.
Command
!a
Syntax
!a [Address (hex)] [asm {AsmCmd1; AsmCmd2}]
Description
Assembles (shows HEX byte codes) or puts the resulting instruction codes into the (physical) memory.
Parameters
[Address (hex)] (optional)
The physical address of where we want to start putting resulting codes into its memory.
[asm {AsmCmd1; AsmCmd2}]
The target assembly codes.
Process ID doesn't make sense in physical memory. If you specify pid for physical memory, it is ignored.
Examples
If you just want to view the result of assembly (byte codes in HEX) without modifying the memory, the following command can be used.
HyperDbg> !a { nop; xor rax, rax; nop }
warning, no start address provided to calculate relative asm commands
generated assembly: 5 bytes, 3 statements ==>> nop; xor rax, rax; nop = 90 48 31 c0 90
The following command is used when we want to assemble assembly codes and put the resulting bytes into the target memory at abc1c0
.
HyperDbg> !a abc1c0 { nop; nop; nop }
generated assembly: 3 bytes, 3 statements ==>> nop; nop; nop = 90 90 90
successfully assembled at 0xabc1c0 address
IOCTL
None
Remarks
By default, HyperDbg converts addresses to the object names (if the symbol for that address is available). If you want to see the address in hex format, you can turn
addressconversion
to off using the 'settings' command.To view the byte code of an assembly snippet, you can use the following command (
StartAddress
is useful when dealing with relative instructions like JMP).
!a {jmp <nt!ExAllocatePoolWithTag+10>} [StartAddress]
HyperDbg uses keystone as its core assembler.
This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.
Requirements
None
Related
Last updated