!msrread
!msrread [Msr (hex)] [pid ProcessId (hex)] [core CoreId (hex)] [imm IsImmediate (yesno)] [buffer PreAllocatedBuffer (hex)] [script { Script (string) }] [condition { Condition (hex) }] [code { Code (hex) }]
IA32_KERNEL_GSBASE (0xC0000102)
, IA32_MPERF (0x000000e7)
and IA32_APERF (0x000000e8)
. pid xx
to your command; thus, the command will be executed if the process id is equal to xx
. If you don't specify this option, then by default, you receive events on all processes.pid all
to intercept events from the entire system.core xx
to your command thus command will be executed if core id is equal to xx
. If you don't specify this option, then by default, you receive events on all cores.yes
means the results (printed texts in scripts) should be delivered immediately to the debugger. no
means that the results can be accumulated and delivered as a couple of messages when the buffer is full; thus, it's substantially faster, but it's not real-time. By default, this value is set to yes
.$context
pseudo-register in the event's script, r8
in custom code, and rdx
in condition code register) to the event trigger, HyperDbg sends the rcx
register of when RDMSR is executed.HyperDbg Script Here
) with your script. You can find script examples here.file:
instead of a script and append the file path to it. For example, the following examples show how you can run a script from file:c:\users\sina\desktop\script.txt
.RDMSR_INSTRUCTION_EXECUTION
and send the special MSR rcx
(if any) if you want to monitor just a special MSR in OptionalParam1
in DEBUGGER_GENERAL_EVENT_DETAIL
.