.formats (show number formats)
Description of '.formats' command in HyperDbg.

Command

.formats

Syntax

.formats [hex value | register | expression]

Description

Evaluates an expression or register or a value in the current thread and process context and displays it in multiple numeric formats.

Parameters

[hex value | register | expression]
An expression, or a register, or a hex value to be evaluated.

Examples

Show 0x10 in different formats.
1
HyperDbg> .formats 10
2
Evaluate expression:
3
Hex : 00000000`00000010
4
Decimal : 16
5
Octal : 20
6
Binary : 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00010000
7
Char : ........
8
Time : 04/28/20 - 06:35AM
9
Float : 0.00 +8e-323 7.905050E-323
10
Double : 7.90505033345994471e-323
Copied!
Show different formats of rcx register.
1
HyperDbg> .formats @rcx
2
Evaluate expression:
3
Hex : 00000000`00000024
4
Decimal : 36
5
Octal : 44
6
Binary : 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100100
7
Char : $.......
8
Time : 02/07/21 - 02:29PM
9
Float : 0.00 +2e-322 1.778636E-322
10
Double : 1.77863632502848756e-322
Copied!
Show different formats of rcx register added to rbx register.
1
HyperDbg> .formats @[email protected]
2
Evaluate expression:
3
Hex : ffff2919`819251c0
4
Decimal : -2121117248
5
Octal : 20144450700
6
Binary : 11111111 11111111 00101001 00011001 10000001 10010010 01010001 11000000
7
Char : .Q...)..
8
Time : 02/07/21 - 02:29PM
9
Float : -nan -nan -NAN
10
Double : -nan
Copied!

IOCTL

This commands works over serial by sending the serial packets to the remote computer.
First of all, you should fill the following structure, set the ScriptBufferSize and ScriptBufferPointer to the values you got from the script engine interpreter, and leave the Result and set the IsFormat to true.
After that, you should move the interpreted buffer to the end of the structure (this structure is a header for the interpreted buffer).
1
typedef struct _DEBUGGEE_SCRIPT_PACKET {
2
3
UINT32 ScriptBufferSize;
4
UINT32 ScriptBufferPointer;
5
BOOLEAN IsFormat;
6
UINT32 Result;
7
8
//
9
// The script buffer is here
10
//
11
12
} DEBUGGEE_SCRIPT_PACKET, *PDEBUGGEE_SCRIPT_PACKET;
Copied!
The next step is sending the above structure to the debuggee when debuggee is paused and waiting for new command on vmx-root mode.
You should send the above structure with DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_RUN_SCRIPT as RequestedAction and DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT as PacketType.
In return, the debuggee sends two packets back to the debugger. The first packet type is:
1
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_FORMATS
Copied!
This packet should be interpreted based on the following structure:
1
typedef struct _DEBUGGEE_FORMATS_PACKET {
2
3
UINT64 Value;
4
UINT32 Result;
5
6
} DEBUGGEE_FORMATS_PACKET, *PDEBUGGEE_FORMATS_PACKET;
Copied!
The value should be passed to the following function to illustrate different formats.
1
VOID CommandFormatsShowResults(UINT64 U64Value);
Copied!
If the Result is DEBUGEER_OPERATION_WAS_SUCCESSFULL, then the operation was successful. Otherwise, the returned result is an error.
After that, the debuggee sends the above structure with the following type.
1
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_RUNNING_SCRIPT
Copied!
In the returned structure, the Result is filled by the kernel.
If the Result is DEBUGEER_OPERATION_WAS_SUCCESSFULL, then the operation was successful. Otherwise, the returned result is an error.
The following function is responsible for sending script buffers in the debugger.
1
BOOLEAN KdSendScriptPacketToDebuggee(UINT64 BufferAddress, UINT32 BufferLength, UINT32 Pointer, BOOLEAN IsFormat);
Copied!

Remarks

This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.

Requirements

None
None
Last modified 2d ago