!msrwrite [msr (hex value)] [pid (hex value)] [core (hex value)] [imm (yes|no)] [event options]
pid xxto your command; thus, the command will be executed if the process id is equal to
xx. If you don't specify this option, then by default, you receive events on all processes.
core xxto your command thus command will be executed if core id is equal to
xx. If you don't specify this option, then by default, you receive events on all cores.
yesmeans the results (printed texts in scripts) should be delivered immediately to the debugger.
nomeans that the results can be accumulated and delivered as a couple of messages when the buffer is full; thus, it's substantially faster, but it's not real-time. By default, this value is set to
$contextpseudo-register in the event's script,
r8in custom code, and
rdxin condition code register) to the event trigger, HyperDbg sends the
rcxregister of when WRMSR is executed.
file:instead of a script and append the file path to it. For example, the following examples show how you can run a script from
WRMSR_INSTRUCTION_EXECUTIONand send the special MSR
rcx(if any) if you want to monitor just a special MSR in