Triggering Special Instructions
A description about hooking RDTSC, RDTSCP, I/O IN & OUT, RDPMC, etc.
There are special instructions in x86 and AMD64 processors that might be configured to cause vm-exits when executed; thus, we can intercept them.
Do not try to monitor all I/O ports or the I/O port for the serial device connected to the debugger if you are operating on Debugger Mode.
Using these commands, we can monitor I/O ports. For examples, let say we want to monitor the I/O port
0x3f8
for IN
instruction.HyperDbg> !ioin 0x3f8
If we want to monitor port
0x3f8
for OUT
instruction, we use the following command.HyperDbg> !ioout 0x3f8
Let's intercept another instruction.
We know that CPUID is an important instruction that tries to get processor features to see if a processor supports a special feature or not.
For example, we want to intercept all the CPUIDs that a process with process ID 0x490 tries to execute.
HyperDbg> !cpuid pid 490
You can also break on the execution of other instructions like:
Last modified 1yr ago