script { }
or code { }
then HyperDbg interprets events as a break. It means that every time this event is triggered, then the system or the target process is completely halted, and now you can control the system. It is exactly like other debuggers like Windbg.script { }
in your events, then you are using the script-engine.ScriptEngineExecute
function.ScriptEngineParseWrapper
which is a wrapper for ScriptEngineParse
. This function gives a stack (memory) that can be executed in both user-mode and kernel-mode.ScriptBufferSize
and ScriptBufferPointer
we pass the script buffer to the kernel.code { }
in your events, then you are using custom codes.RCX
. You can safely use this buffer in your assembly code, and if you want, HyperDbg will safely transfer this buffer to user mode for you.nops
that a custom buffer provides to the debugger. You can change it to whatever assembly bytes that you want without any limitation in size.CustomCodeBuffer
as the custom assembly code, and also, we set the size of the buffer. OptionalRequestedBufferSize
is used to request a non-paged pool buffer. If this field is zero, then it means that you don't need a non-paged buffer, but if it's not zero, then HyperDbg will allocate a non-paged pool for you and pass the address of the buffer each time as the RCX
to you assembly code.DebuggerAddActionToEvent
.TRUE
, the buffer will be delivered to the user -ode immediately, and if you set it to FALSE
, then the buffers will be accumulated and delivered when the queue has multiple messages.FALSE
in most cases, but if you need immediate results the choose TRUE
and it makes your computer substantially slower in high rates of data delivery but at low rates TRUE
makes more scene.DebuggerAddActionToEvent
.RCX
.RCX
is null (in the case, you didn't need a safe buffer).RDX
is the structure of the guest's general-purpose registers, you can modify them directly, and these registers will apply to the guest when it wants to continue its normal execution.R8
(Context) is an optional parameter that describes the state, and it's different for each event. You have to check each event's documentation to see what it is in that event.Regs
parameter. You can modify or read the general-purpose registers based on this structure as a pointer to this structure is available in RDX
.