HyperDbg Documentation
CommunityDownloadResearchTutorialhwdbg
  • HyperDbg
  • Getting Started
    • Quick Start
    • FAQ
    • Build & Install
    • Attach to HyperDbg
      • Attach to a remote machine
      • Attach to local machine
      • Start a new process
      • Attach to a running process
  • Using HyperDbg
    • Prerequisites
      • Operation Modes
      • How to create a condition?
      • How to create an action?
      • Signatures
    • User-mode Debugging
      • Principles
      • Examples
        • basics
        • events
          • Getting Results of a System-call
    • Kernel-mode Debugging
      • Principles
      • Examples
        • beginning
          • Connecting To HyperDbg
          • Configuring Symbol Server/Path
        • basics
          • Setting Breakpoints & Stepping Instructions
          • Displaying & Editing & Searching Memory
          • Showing & Modifying Registers and Flags
          • Switching to a Specific Process or Thread
          • Mapping Data & Create Structures, and Enums From Symbols
        • events
          • Managing Events
          • Hooking Any Function
          • Intercepting All SYSCALLs
          • Monitoring Accesses To Structures
          • Triggering Special Instructions
          • Identifying System Behavior
        • Scripting Language Examples
    • Software Development Kit (SDK)
      • Events
        • Conditions
        • Actions
      • IOCTL
        • Event Registration
  • Commands
    • Debugging Commands
      • ? (evaluate and execute expressions and scripts in debuggee)
      • ~ (display and change the current operating core)
      • a (assemble virtual address)
      • load (load the kernel modules)
      • unload (unload the kernel modules)
      • status (show the debuggee status)
      • events (show and modify active/disabled events)
      • p (step-over)
      • t (step-in)
      • i (instrumentation step-in)
      • gu (step-out or go up)
      • r (read or modify registers)
      • bp (set breakpoint)
      • bl (list breakpoints)
      • be (enable breakpoints)
      • bd (disable breakpoints)
      • bc (clear and remove breakpoints)
      • g (continue debuggee or processing kernel packets)
      • x (examine symbols and find functions and variables address)
      • db, dc, dd, dq (read virtual memory)
      • eb, ed, eq (edit virtual memory)
      • sb, sd, sq (search virtual memory)
      • u, u64, u2, u32 (disassemble virtual address)
      • k, kd, kq (display stack backtrace)
      • dt (display and map virtual memory to structures)
      • struct (make structures, enums, data types from symbols)
      • sleep (wait for specific time in the .script command)
      • pause (break to the debugger and pause processing kernel packets)
      • print (evaluate and print expression in debuggee)
      • lm (view loaded modules)
      • cpu (check cpu supported technologies)
      • rdmsr (read model-specific register)
      • wrmsr (write model-specific register)
      • flush (remove pending kernel buffers and messages)
      • prealloc (reserve pre-allocated pools)
      • preactivate (pre-activate special functionalities)
      • output (create output source for event forwarding)
      • test (test functionalities)
      • settings (configures different options and preferences)
      • exit (exit from the debugger)
    • Meta Commands
      • .help (show the help of commands)
      • .debug (prepare and connect to debugger)
      • .connect (connect to a session)
      • .disconnect (disconnect from a session)
      • .listen (listen on a port and wait for the debugger to connect)
      • .status (show the debugger status)
      • .start (start a new process)
      • .restart (restart the process)
      • .attach (attach to a process)
      • .detach (detach from the process)
      • .switch (show the list and switch between active debugging processes)
      • .kill (terminate the process)
      • .process, .process2 (show the current process and switch to another process)
      • .thread, .thread2 (show the current thread and switch to another thread)
      • .pagein (bring the page into the RAM)
      • .dump (save the virtual memory into a file)
      • .formats (show number formats)
      • .script (run batch script commands)
      • .sympath (set the symbol server)
      • .sym (load pdb symbols)
      • .pe (parse PE file)
      • .logopen (open log file)
      • .logclose (close log file)
      • .cls (clear the screen)
    • Extension Commands
      • !a (assemble physical address)
      • !pte (display page-level address and entries)
      • !db, !dc, !dd, !dq (read physical memory)
      • !eb, !ed, !eq (edit physical memory)
      • !sb, !sd, !sq (search physical memory)
      • !u, !u64, !u2, !u32 (disassemble physical address)
      • !dt (display and map physical memory to structures)
      • !track (track and map function calls and returns to the symbols)
      • !epthook (hidden hook with EPT - stealth breakpoints)
      • !epthook2 (hidden hook with EPT - detours)
      • !monitor (monitor read/write/execute to a range of memory)
      • !syscall, !syscall2 (hook system-calls)
      • !sysret, !sysret2 (hook SYSRET instruction execution)
      • !mode (detect kernel-to-user and user-to-kernel transitions)
      • !cpuid (hook CPUID instruction execution)
      • !msrread (hook RDMSR instruction execution)
      • !msrwrite (hook WRMSR instruction execution)
      • !tsc (hook RDTSC/RDTSCP instruction execution)
      • !pmc (hook RDPMC instruction execution)
      • !vmcall (hook hypercalls)
      • !exception (hook first 32 entries of IDT)
      • !interrupt (hook external device interrupts)
      • !dr (hook access to debug registers)
      • !ioin (hook IN instruction execution)
      • !ioout (hook OUT instruction execution)
      • !hide (enable transparent-mode)
      • !unhide (disable transparent-mode)
      • !measure (measuring and providing details for transparent-mode)
      • !va2pa (convert a virtual address to physical address)
      • !pa2va (convert physical address to virtual address)
      • !dump (save the physical memory into a file)
      • !pcitree (show PCI/PCIe device tree)
      • !pcicam (dump the PCI/PCIe configuration space)
      • !idt (show Interrupt Descriptor Table entries)
      • !apic (dump local APIC entries in XAPIC and X2APIC modes)
      • !ioapic (dump I/O APIC)
    • Scripting Language
      • Assumptions & Evaluations
      • Variables & Assignments
      • Casting & Type-awareness
      • Conditionals & Loops
      • Constants & Functions
      • Debugger Script (DS)
      • Examples
        • view system state (registers, memory, variables)
        • change system state (registers, memory, variables)
        • trace function calls
        • pause the debugger conditionally
        • conditional breakpoints and events
        • patch the normal sequence of execution
        • access to a shared variable from different cores
        • count occurrences of events
      • Functions
        • debugger
          • pause
        • events
          • event_enable
          • event_disable
          • event_clear
          • event_sc
          • event_inject
          • event_inject_error_code
          • flush
        • exports
          • print
          • printf
        • interlocked
          • interlocked_compare_exchange
          • interlocked_decrement
          • interlocked_exchange
          • interlocked_exchange_add
          • interlocked_increment
        • memory
          • check_address
          • eb, ed, eq
          • eb_pa, ed_pa, eq_pa
          • memcpy
          • memcpy_pa
          • memcmp
          • virtual_to_physical
          • physical_to_virtual
        • diassembler
          • disassemble_len
          • disassemble_len32
        • spinlocks
          • spinlock_lock
          • spinlock_lock_custom_wait
          • spinlock_unlock
        • strings
          • strlen
          • wcslen
          • strcmp
          • strncmp
          • wcscmp
          • wcsncmp
    • Commands Map
  • Tips & Tricks
    • Considerations
      • Basic concepts in Intel VT-x
      • VMX root-mode vs VMX non-root mode
      • The "unsafe" behavior
      • Script engine in VMX non-root mode
      • Difference between process and thread switching commands
      • Accessing Invalid Address
      • Transparent Mode
    • Nested-Virtualization Environments
      • Supported Virtual Machines
      • Run HyperDbg on VMware
      • Run HyperDbg on Hyper-V
      • Supporting VMware/Hyper-V
      • VMware backdoor I/O ports
    • Misc
      • Event forwarding
      • Event short-circuiting
      • Event calling stage
      • Instant events
      • Message overflow
      • Customize build
        • Increase Communication Buffer Size
        • Number of EPT Hooks in One Page
        • Change Script Engine Limitations
      • Enable and disable events in Debugger Mode
      • Switch to New Process Layout
  • Contribution
    • Style Guide
      • Coding style
      • Command style
      • Doxygen style
    • Logo & Artworks
  • Design
    • Features
      • VMM (Module)
        • Control over NMIs
        • VMX root-mode compatible message tracing
        • Design of !epthook
        • Design of !epthook2
        • Design of !monitor
        • Design of !syscall & !sysret
        • Design of !exception & !interrupt
    • Debugger Internals
      • Events
      • Conditions
      • Actions
      • Kernel Debugger
        • Design Perspective
        • Connection
  • Links
    • Twitter
    • Telegram
    • Discord
    • Matrix
    • Mastodon
    • YouTube
    • hwdbg (Chip Debugger)
    • Doxygen
    • Contribution
Powered by GitBook
On this page
  • Syntax
  • Description
  • Parameters
  • Examples
  • SDK
  • Remarks
  • Requirements
  • Related
Edit on GitHub
  1. Commands
  2. Extension Commands

!pcitree (show PCI/PCIe device tree)

Description of '!pcitree' command in HyperDbg.

!pcitree

Syntax

!pcitree

Description

Shows PCI/PCIe device tree.

Parameters

None

Examples

The following command shows the PCI and PCI Express device trees.

HyperDbg> !pcitree
DBDF         | VID:DID   | Vendor Name       | Device Name
----------------------------------------------------------------------
0000:00:00:0 | 8086:a71b | Intel Corporation | N/A
0000:00:02:0 | 8086:a7ad | Intel Corporation | Raptor Lake-U [Intel Graphics]
0000:00:04:0 | 8086:a71d | Intel Corporation | Raptor Lake Dynamic Platform and Thermal Framework Processor Participant
0000:00:06:0 | 8086:a74d | Intel Corporation | Raptor Lake PCIe 4.0 Graphics Port
0000:00:08:0 | 8086:a74f | Intel Corporation | GNA Scoring Accelerator module
0000:00:0d:0 | 8086:a71e | Intel Corporation | Raptor Lake-P Thunderbolt 4 USB Controller
0000:00:14:0 | 8086:51ed | Intel Corporation | Alder Lake PCH USB 3.2 xHCI Host Controller
0000:00:14:2 | 8086:51ef | Intel Corporation | Alder Lake PCH Shared SRAM
0000:00:15:0 | 8086:51e8 | Intel Corporation | Alder Lake PCH Serial IO I2C Controller #0
0000:00:15:1 | 8086:51e9 | Intel Corporation | Alder Lake PCH Serial IO I2C Controller #1
0000:00:16:0 | 8086:51e0 | Intel Corporation | Alder Lake PCH HECI Controller
0000:00:1c:0 | 8086:51bf | Intel Corporation | Alder Lake PCH-P PCI Express Root Port #9
0000:00:1f:0 | 8086:519d | Intel Corporation | Raptor Lake LPC/eSPI Controller
0000:00:1f:3 | 8086:51ca | Intel Corporation | Raptor Lake-P/U/H cAVS
0000:00:1f:4 | 8086:51a3 | Intel Corporation | Alder Lake PCH-P SMBus Host Controller
0000:00:1f:5 | 8086:51a4 | Intel Corporation | Alder Lake-P PCH SPI Controller
0000:01:00:0 | 1e0f:000c | KIOXIA Corporation | NVMe SSD Controller BG5 (DRAM-less)
0000:02:00:0 | 10ec:b852 | Realtek Semiconductor Co., Ltd. | RTL8852BE PCIe 802.11ax Wireless Network Controller

Another example of using this command in a VMware Workstation guest.

0: kHyperDbg> !pcitree
DBDF         | VID:DID   | Vendor Name       | Device Name
----------------------------------------------------------------------
0000:00:00:0 | 8086:7190 | Intel Corporation | 440BX/ZX/DX - 82443BX/ZX/DX Host bridge
0000:00:01:0 | 8086:7191 | Intel Corporation | 440BX/ZX/DX - 82443BX/ZX/DX AGP bridge
0000:00:07:0 | 8086:7110 | Intel Corporation | 82371AB/EB/MB PIIX4 ISA
0000:00:07:1 | 8086:7111 | Intel Corporation | 82371AB/EB/MB PIIX4 IDE
0000:00:07:3 | 8086:7113 | Intel Corporation | 82371AB/EB/MB PIIX4 ACPI
0000:00:07:7 | 15ad:0740 | VMware            | Virtual Machine Communication Interface
0000:00:0f:0 | 15ad:0405 | VMware            | SVGA II Adapter
0000:00:11:0 | 15ad:0790 | VMware            | PCI bridge
0000:00:15:0 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:15:1 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:15:2 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:15:3 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:15:4 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:15:5 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:15:6 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:15:7 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:0 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:1 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:2 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:3 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:4 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:5 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:6 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:16:7 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:0 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:1 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:2 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:3 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:4 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:5 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:6 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:17:7 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:0 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:1 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:2 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:3 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:4 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:5 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:6 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:00:18:7 | 15ad:07a0 | VMware            | PCI Express Root Port
0000:02:00:0 | 15ad:0774 | VMware            | USB1.1 UHCI Controller
0000:02:01:0 | 15ad:1977 | VMware            | HD Audio Controller
0000:02:02:0 | 15ad:0770 | VMware            | USB2 EHCI Controller
0000:02:03:0 | 15ad:07e0 | VMware            | SATA AHCI controller
0000:03:00:0 | 8086:10d3 | Intel Corporation | 82574L Gigabit Network Connection
0000:0b:00:0 | 15ad:077a | VMware            | N/A
0000:13:00:0 | 15ad:07f0 | VMware            | NVMe SSD Controller

SDK

None

Remarks

Starting from v0.12, this command was added to the HyperDbg debugger.

This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.

Requirements

None

Related

Previous!dump (save the physical memory into a file)Next!pcicam (dump the PCI/PCIe configuration space)

Last updated 3 months ago

!pcicam (dump the PCI/PCI-e configuration space)