!monitor [mode] [from address] [to address] [pid (hex value)] [core (hex value)] [imm (yes|no)] [event options]
pid xxto your command; thus, the command will be executed if the process id is equal to
xx. If you don't specify this option, then by default, you receive events on all processes.
core xxto your command thus command will be executed if core id is equal to
xx. If you don't specify this option, then by default, you receive events on all cores.
yesmeans the results (printed texts in scripts) should be delivered immediately to the debugger.
nomeans that the results can be accumulated and delivered as a couple of messages when the buffer is full; thus, it's substantially faster, but it's not real-time. By default, this value is set to
$contextpseudo-register in the event's script,
r8in custom code, and
rdxin condition code register) to the event trigger, HyperDbg sends the virtual address of the memory that has accessed and triggered this event.
fffff800`4ed60100, this will break to the debugger and gives the control back to you.
file:instead of a script and append the file path to it. For example, the following examples show how you can run a script from
HIDDEN_HOOK_READin the case you want just reads, use
HIDDEN_HOOK_WRITEin the case you want just writes and use
HIDDEN_HOOK_READ_AND_WRITEin the case you want both reads and writes and send the start address (from address) of where you want to monitor in
OptionalParam1and end address (to address) of where you want to monitor in