!vmcall
!vmcall [pid ProcessId (hex)] [core CoreId (hex)] [imm IsImmediate (yesno)] [buffer PreAllocatedBuffer (hex)] [script { Script (string) }] [condition { Condition (hex) }] [code { Code (hex) }]
pid xx
to your command; thus, the command will be executed if the process id is equal to xx
. If you don't specify this option, then by default, you receive events on all processes.pid all
to intercept events from the entire system.core xx
to your command thus command will be executed if core id is equal to xx
. If you don't specify this option, then by default, you receive events on all cores.yes
means the results (printed texts in scripts) should be delivered immediately to the debugger. no
means that the results can be accumulated and delivered as a couple of messages when the buffer is full; thus, it's substantially faster, but it's not real-time. By default, this value is set to yes
.$context
pseudo-register in the event's script, r8
in custom code, and rdx
in condition code register) to the event trigger, HyperDbg sends NULL.HyperDbg Script Here
) with your script. You can find script examples here.file:
instead of a script and append the file path to it. For example, the following examples show how you can run a script from file:c:\users\sina\desktop\script.txt
.VMCALL_INSTRUCTION_EXECUTION
in DEBUGGER_GENERAL_EVENT_DETAIL
.