lbr_print

Description of the 'lbr_print' function in HyperDbg Scripts

Function

lbr_print

Syntax

lbr_print();

Parameters

None

Description

Prints all the Last Branch Record (LBR) entries that were captured since the Last Branch Record was enabled using the '!lbr' command.

Return value

None

Examples

First, enable the LBR using the '!lbr' command, then use lbr_print() in a script (e.g., inside an EPT hook), and finally disable the LBR.

!lbr enable

!epthook 7ff7393a2fd7 pid 3274 script {
		lbr_print();
}

!lbr disable

The above example enables LBR, hooks the target address in process with PID 0x3274, and each time execution reaches that address, all captured branch entries are printed to the output.

Remarks

The support for this function is added from v0.19.

Before calling this function, you need to enable the Last Branch Record using the '!lbr' command.

Related

lbr_save

!lbr (enable, disable, and configure Last Branch Record)

!lbrdump (dump Last Branch Record entries)