!monitor
!monitor [Mode (string)] [FromAddress (hex)] [ToAddress (hex)] [pid ProcessId (hex)] [core CoreId (hex)] [imm IsImmediate (yesno)] [buffer PreAllocatedBuffer (hex)] [script { Script (string) }] [condition { Condition (hex) }] [code { Code (hex) }]
pid xx
to your command; thus, the command will be executed if the process id is equal to xx
. If you don't specify this option, then by default, you receive events on all processes.pid all
to intercept events from the entire system.core xx
to your command thus command will be executed if core id is equal to xx
. If you don't specify this option, then by default, you receive events on all cores.yes
means the results (printed texts in scripts) should be delivered immediately to the debugger. no
means that the results can be accumulated and delivered as a couple of messages when the buffer is full; thus, it's substantially faster, but it's not real-time. By default, this value is set to yes
.$context
pseudo-register in the event's script, r8
in custom code, and rdx
in condition code register) to the event trigger, HyperDbg sends the virtual address of the memory that has accessed and triggered this event.fffff800`4ed60000
to fffff800`4ed60100
, this will break to the debugger and gives the control back to you.nt!Kd_DEFAULT_Mask
too.HyperDbg Script Here
) with your script. You can find script examples here.file:
instead of a script and append the file path to it. For example, the following examples show how you can run a script from file:c:\users\sina\desktop\script.txt
.fffff800`4ed60000
to fffff800`4ed60100
and run 3 nops whenever the event is triggered. Take a look at Run Custom Code for more information.fffff800`4ed60000
to fffff800`4ed60100
and run 3 nops whenever the event condition is triggered and run 3 nops whenever the event is triggered. Take a look at Run Custom Code and how to create a condition for more information.HIDDEN_HOOK_READ
in the case you want just reads, use HIDDEN_HOOK_WRITE
in the case you want just writes and use HIDDEN_HOOK_READ_AND_WRITE
in the case you want both reads and writes and send the start address (from address) of where you want to monitor in OptionalParam1
and end address (to address) of where you want to monitor in OptionalParam2
address DEBUGGER_GENERAL_EVENT_DETAIL
.