condition { xx xx xx xx }
where xx
is the assembly (hex) of what you want to be executed in the case of that event.rcx
and a Context in rdx
.Context
is a special variable that shows an essential parameter of an event. This value is different for each event. You should check the documentation of that command for more information about the Context
. For example, Context
for !syscall command is the syscall-number or for the !epthook2 command is the physical address of where the hidden hook triggered._EPROCESS
._KTHREAD
from _KPCR
. From there, we can find the address of _KPROCESS
, and this structure is located at the start address of _EPROCESS
.+0x450
after the _EPROCESS
._EPROCESS
and other structures might change in the different versions of Windows.rax=0
or null
then it means false, and if you return anything other than zero (for example rax=1
) then it means true.0xc3
or ret
the opcode to the end of the condition assembly, and in the case if you forget to return the control of the processor back to the HyperDbg, then there is no problem. Make sure to not jump to another address without returning back to the HyperDbg. Otherwise, it causes a crash on your system.ExAllocatePoolWithTag
and if the size of the requested buffer is xx
then perform the actions.ExAllocatePoolWithTag
) is defined like this :PoolType
is on rcx
, NumberOfBytes
is on rdx
and Tag
is on r8
. We need to check for rdx
.rdx
is not the same as the rdx
that you receive in the function, instead we pass a structure containing all the general-purpose register, you can read them or even modify them, and if you modify them, then the operating system will continue with new values in these registers.rcx
.NumberOfBytes (rdx)
with 0x1000
and if the requested size is 0x1000, then the actions should be performed.rcx
, rdx
, r8
, r9
and stack), so if your target user-mode application is x64, then you can expect the exact arguments from user-mode to kernel-mode. Still, if your user-mode application is x86, then Windows might change some of the arguments that contain addresses to new addresses.