Comment on page
Enable and disable events in Debugger Mode
Methods to disable or enable events when the debuggee is halted
This means that your commands will go through the routines from user-mode to kernel-mode and then vmx-root mode; thus, the debuggee is continued for some time, and then the debuggee is halted again.
It is clear that you'll lose the current context (registers and memory), and also your current process, which is under debugging, might find some time to continue its normal execution.
One important note about HyperDbg is that whenever you want to create an event (run an "event" command), HyperDbg continues the debuggee; however, all the other events (active events) are ignored till the current event successfully applied; thus, HyperDbg might ignore some of the events during this process.
Let's assume we triggered a breakpoint in our target process, and from now on, we want to monitor any syscall (syscall = 0x55) execution by that process. Clearly, if we use the !syscall command, as it's an event, the debuggee will be continued, and we might lose some of the system-calls as we didn't apply the event (syscall-hook) immediately.
What's the solution to solve these problems?
Whenever the system is halted, you can run scripts in debuggee, and HyperDbg executes the script while it guarantees that the debuggee (both user-mode processes and kernel-mode) kept halted.
The solution to this problem is to create the event before trying to debug the debuggee target process. For example, we execute the following command to get the syscalls
0x55from the process with
HyperDbg> !syscall 55 pid 490
Note that the event number is
0in this case.
0 (enabled) !syscall 55 pid 490
Now, we disable the event using the following command.
HyperDbg> events d 0
0 (disabled) !syscall 55 pid 490
HyperDbg> events e 0
HyperDbg> ? event_enable(0);
After that, we receive the events relating to the event with event number
0; thus, we won't lose any events as the guest remained paused while the above expression command is executed.
At last, if we want to disable the event, we can use the following commands.
HyperDbg> events d 0
HyperDbg> ? event_disable(0);
If you are operating in Debugger Mode, you can enable or disable events while the debuggee is in a halt state. However, if you want to clear an event or all events then you lose the context as the debuggee is continued for some time to process the clear operation.
Using this way, we can solve the problem of losing some events in HyperDbg.