Signatures
Different signatures in HyperDbg
There are a few signatures in HyperDbg that demonstrate basic debugging details from the debuggee. In this document, we'll talk about these signatures and their meanings.
Local Debugging (VMI Mode)
Kernel Debugging (Debugger Mode)
User Debugging (VMI Mode)
User-mode debugging has two different signatures, the first signature is for 32-bit module debugging, and the second signature is for 64-bit module debugging.
Debugging a 32-bit Module
The signature for 32-bit debugging is u86HyperDbg
while the first number shows the active Process Id and the second number is the Thread Id. For example, the following signature is a 32-bit debugging for a process with Process Id equal to 0x228c
and Thread Id equal to 0x13fc
. The Process Id and the Thread Id are in hex format.
Debugging a 64-bit Module
The signature for 64-bit debugging is u64HyperDbg
. The numbers are exactly like 32-bit debugging. The first number shows the active Process Id and the second number is the Thread Id. For example, the following signature is a 64-bit debugging for Process Id equal to 0x2300
and Thread Id equal to 0x1620
. The Process Id and the Thread ID are in hex format.
Remote Debugging (VMI Mode)
Last updated