Ctrlk
DownloadResearchTutorialhwdbg
For the complete documentation index, see llms.txt. This page is also available as Markdown.

lbr_print

Description of the 'lbr_print' function in HyperDbg Scripts

Function

lbr_print

Syntax

lbr_print();

Parameters

None

Description

Prints all the Last Branch Record (LBR) entries that were captured since the Last Branch Record was enabled using the '!lbr' command.

Return value

Returns 1 if the LBR entries were printed successfully, or 0 if the operation failed (e.g., LBR was not initialized using the '!lbr enable' command or was already disabled using '!lbr disable').

Examples

First, enable the LBR using the '!lbr' command, then use lbr_print() in a script (e.g., inside an EPT hook), and finally disable the LBR.

!lbr enable

!epthook 7ff7393a2fd7 pid 3274 script {
		lbr_print();
}

!lbr disable

The above example enables LBR, hooks the target address in process with PID 0x3274, and each time execution reaches that address, all captured branch entries are printed to the output.

Once triggered, you will see some results similar to this (on a Legacy LBR machine):

Or this output if you are using an Architectural LBR machine:

Remarks

The support for this function is added from v0.19.

This function requires LBR to be active. It will return 0 and perform no operation if LBR was never started with '!lbr enable' or has already been stopped with '!lbr disable'.

lbr_dump is an alias for this function and behaves identically.

Related

lbr_save

lbr_check

lbr_restore

lbr_restore_by_filter

!lbr (enable, disable, and configure Last Branch Record)

!lbrdump (dump Last Branch Record entries)

Previouslbr_saveNextlbr_check

Last updated