HyperDbg

No entries match these filters. Clear filters

1. v0.25 Nov 1, 2026 · issue 128

   HyperDbg adds Linux host support, letting practitioners debug a Windows guest over serial from a Linux machine⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.25 https://github.com/HyperDbg/HyperDbg.git
   # already have the repo? check out this version:
   $ git checkout v0.25

   • HyperDbg now accepts device and socket paths in the .debug command on Linux, enabling serial connections over termios devices and UNIX sockets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • HyperDbg now supports running as a Linux host to debug a Windows guest machine over a serial kernel debugger connection.
   • HyperDbg's hyperevade module now handles XSETBV instructions to improve anti-detection coverage.
   • HyperDbg now accepts device and socket paths in the .debug command on Linux, enabling serial connections over termios devices and UNIX sockets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • HyperDbg now supports running as a Linux host to debug a Windows guest machine over a serial kernel debugger connection.

   1 more in Everything

2. v0.24 Sep 22, 2026 · issue 083

   HyperDbg v0.24 adds new memory-read commands, user-mode I/O port access, script engine arrays, and Linux kernel module support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.24 https://github.com/HyperDbg/HyperDbg.git
   # already have the repo? check out this version:
   $ git checkout v0.24

   └──▷ TRY IT
   Read an ASCII string from a virtual address to inspect null-terminated text in a target process without triggering OS debug APIs.
   copy

   $ da 0xffff8000`deadbeef

   Read pointer-sized values at a virtual address resolved to symbol names — useful for walking function pointer tables or vtables.
   copy

   $ dps 0xfffff803`12340000

   Read a byte from an I/O port in user-debugger context to inspect hardware state (e.g. port 0x64, the keyboard controller status port).
   copy

   $ uin 0x64 1

   • Adds dw and !dw commands to read word (2-byte) values from virtual and physical memory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds da and !da commands to read printable ASCII (null-terminated) strings from virtual and physical memory.
   • Adds dds, dqs, and dps commands (plus physical memory counterparts) to read double-word, quad-word, and pointer-sized values resolved to symbol names in module!symbol+offset format.
   • Adds uin and uout commands to read from and write to I/O ports (port-mapped I/O) from the user debugger.
   • Adds test script-semantic CLI command for running script engine semantic test cases.

   +4 more show less

   • Adds arrays as function parameters in the script engine.
   • Adds char and wide-char (wchar_t) array types in the script engine.
   • Ports all HyperDbg kernel modules to compile on Linux, including the hyperhv and hyperlog projects and core platform components (spinlocks, IRQL, process, time, and I/O).
   • Adds GNU assembler (GAS) stub files to replace MASM assembly files for the Linux kernel module build.
   • Adds dw and !dw commands to read word (2-byte) values from virtual and physical memory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds da and !da commands to read printable ASCII (null-terminated) strings from virtual and physical memory.
   • Adds dds, dqs, and dps commands (plus physical memory counterparts) to read double-word, quad-word, and pointer-sized values resolved to symbol names in module!symbol+offset format.
   • Adds uin and uout commands to read from and write to I/O ports (port-mapped I/O) from the user debugger.
   • Adds test script-semantic CLI command for running script engine semantic test cases.

   +3 more show less

   • Adds char and wide-char (wchar_t) array types in the script engine.
   • Ports all HyperDbg kernel modules to compile on Linux, including the hyperhv and hyperlog projects and core platform components (spinlocks, IRQL, process, time, and I/O).
   • Adds GNU assembler (GAS) stub files to replace MASM assembly files for the Linux kernel module build.

   1 more in Everything

3. docs update Sep 22, 2026 · issue 082

   HyperDbg adds I/O port execution commands and full virtual/physical memory read command families⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Inspect raw virtual memory at a given address as bytes during a live debug session.
   copy

   $ db <address>

   Read a hardware I/O port value from the debuggee to inspect device register state without leaving the debugger.
   copy

   $ uin <port>

   Read physical memory as quad-words to inspect raw hardware-mapped regions not visible through virtual addressing.
   copy

   $ !dq <physical_address>

   • Adds uin command to execute an I/O IN instruction directly in the debuggee.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds uout command to execute an I/O OUT instruction directly in the debuggee.
   • Adds db, dc, dd, dq, dw, da, dds, dps, dqs commands for reading virtual memory in the debuggee.
   • Adds !db, !dc, !dd, !dq, !dw, !da, !dds, !dps, !dqs commands for reading physical memory in the debuggee.

   4 details in Everything

4. v0.23 Aug 2, 2026 · issue 034

   HyperDbg v0.23 adds the ucpuid command, floating-point support in the script engine, and advances Linux porting.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.23 https://github.com/HyperDbg/HyperDbg.git
   # already have the repo? check out this version:
   $ git checkout v0.23

   └──▷ TRY IT
   Inspect CPUID leaves from user-mode context without switching privilege levels manually.
   copy

   $ ucpuid

   • New ucpuid command lets users execute CPUID in user-mode context directly from the debugger.
   • Adds an SDK function for the ucpuid command, enabling programmatic invocation via the HyperDbg API.
   • Introduces floating-point (float) data types and operators in the script engine, enabling FP-aware scripting.
   • Advances Linux port: script engine Linux build completed, Linux kernel module build file (Kbuild) added, and PlatformCPU Linux implementation included.

   4 details in Everything

5. docs update Jul 27, 2026 · issue 027

   HyperDbg adds ucpuid command to execute CPUID in the debuggee and new scripting language data types & operators docs.

   └──▷ TRY IT
   Query CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. feature flags from the debuggee without leaving the debugger session.
   copy

   $ ucpuid

   • New ucpuid command executes a CPUID instruction directly in the debuggee context.
   • Scripting language gains documented data types and operators for use in HyperDbg scripts.

   2 details in Everything

6. docs update Jul 27, 2026 · docs issue 004

   HyperDbg adds ucpuid command to execute CPUID in the debuggee and new scripting language data types & operators docs.

   └──▷ TRY IT
   Query CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. feature flags from the debuggee without leaving the debugger session.
   copy

   $ ucpuid

   • New ucpuid command executes a CPUID instruction directly in the debuggee context.
   • Scripting language gains documented data types and operators for use in HyperDbg scripts.

   2 details in Everything

7. v0.22 Jul 20, 2026 · issue 020

   HyperDbg v0.22 adds linked-list traversal commands, struct support in the script engine, and a pname filter for !pt.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.22 https://github.com/HyperDbg/HyperDbg.git
   # already have the repo? check out this version:
   $ git checkout v0.22

   • New dl command traverses linked lists in virtual address space directly from the debugger.
   • New !dl command traverses linked lists using physical addresses.
   • New SDK API exports for linked-list traversal over both virtual and physical memory.
   • Adds pname option to the !pt command to filter process trace by process name.
   • Script engine now supports structures, enabling struct-aware scripting and automation.

   +1 more show less

   • !pt initialization moved to a separate thread, reducing blocking during startup.

   6 details in Everything

8. v0.21 Jul 5, 2026 · issue 020

   HyperDbg v0.21 adds Intel PT parameter parsing, TID/PID helpers, hyperperf infrastructure, and an SDK load-state API.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.21 https://github.com/HyperDbg/HyperDbg.git
   # already have the repo? check out this version:
   $ git checkout v0.21

   • Adds user-mode and kernel-mode Intel PT parameter parser for fine-grained control of processor trace configuration.
   • Adds thread (TID) and process (PID) helper functions for Intel PT, enabling per-thread and per-process tracing workflows.
   • Introduces the hyperperf (Hardware Performance Counter) project structure as a new HyperDbg SDK module.
   • Adds hypertrace, hyperevade, and hyperperf DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. files to the SDK, expanding the available module surface.
   • Exports a new SDK API for checking whether any HyperDbg module is currently loaded.

   +2 more show less

   • The unload command now reports whether any module is loaded before attempting to unload, improving operator feedback.
   • Separates SDK libraries into distinct user-mode and kernel-mode modules for cleaner integration.

   7 details in Everything

9. v0.18.1 Apr 9, 2026 · release notes

   HyperDbg v0.18.1 adds Hypertrace VMMVMMA Virtual Machine Monitor is software that creates and manages virtual machines, abstracting physical hardware so multiple OS instances run in isolation; cyber tools use it to sandbox execution or emulate target environments safely. support and begins LBR implementation

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.18.1 https://github.com/HyperDbg/HyperDbg.git
   # already have the repo? check out this version:
   $ git checkout v0.18.1

   • Enables Hypertrace to operate with HyperDbg VMM

   1 detail in Everything

10. v0.18 Feb 15, 2026 · release notes

    HyperDbg v0.18 adds #include library support in the script engine and initial hypertrace profiling via Intel LBR/BTS

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.18

    • Script engine now supports writing libraries using the #include keyword
    • Initial codes for the hypertrace project by using Intel Last Branch Record (LBR) and Branch Trace Store (BTS)
    • The hypertrace project is now linked to the hyperkd

    3 details in Everything

11. v0.17 Nov 10, 2025 · release notes

    HyperDbg v0.17 adds multidimensional arrays, compound and multiple assignments to the script engine

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.17

    • Adds compound assignment operators (e.g., +=, -=) in the script engine
    • Adds multiple variable assignment in a single statement in the script engine

    2 details in Everything

12. v0.16 Sep 7, 2025 · release notes

    HyperDbg v0.16 adds !xsetbv event command, user debugger step-in/over, and SDK APIs for script execution and expression evaluation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.16

    └──▷ TRY IT
    Use the new event command to handle XSETBV instruction execution.
    copy

    $ !xsetbv

    Step over instructions in the user debugger using the new p command.
    copy

    $ p

    Run a script on a specific target thread via the user debugger eval command.
    copy

    $ eval <script_name>

    • !xsetbv event command handles the execution of the XSETBV instruction
    • Added support for step-over (the p command) in the user debugger
    • Added support for step-in (the t command) in the user debugger
    • Added support to modify registers or a specific register in the user debugger (r command)
    • SDK API for running scripts in either the kernel debugger or the user debugger

    +2 more show less

    • SDK API for evaluating expressions based on the context of the kernel debugger or the user debugger
    • Added support to evaluate (run) scripts on the target thread in the user debugger (eval command)

    7 details in Everything

13. v0.15 Aug 17, 2025 · release notes

    HyperDbg v0.15 adds SMI support via !smi command and Intel CET emulation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.15

    • Adds !smi subcommand to perform System Management Interrupt operations
    • Adds Check for Intel CET IBT detection capability
    • Adds Check for Intel CET shadow stack detection capability
    • Enables Intel CET SYSCALL/SYSRET emulation in debugger
    • Enhances .pe command to parse PE Rich Headers

    5 details in Everything

14. v0.14 Jul 23, 2025 · release notes

    HyperDbg v0.14 adds .start/.attach/.detach in VMI mode, new timing functions, and EPTEPTExtended Page Tables: an Intel CPU feature that lets a hypervisor give each VM its own second-level address translation in hardware, removing the need for software shadow page tables and cutting VM-exit overhead. support for MMIO >512 GB

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.14

    • Adds the .start command to HyperDbg's VMI mode for user debugger sessions
    • Adds the .attach and .detach commands to the debugger mode for managing target processes
    • Adds microsleep(microseconds) function to the script engine for precise timing control
    • Adds rdtsc() and rdtscp() functions to the script engine for hardware cycle counting
    • Adds a new mechanism and functions to retrieve the system-call number from the running system

    5 details in Everything

15. v0.13.2 May 25, 2025 · release notes

    HyperDbg v0.13.2 adds transparent-mode system-call return interception with TRAP flag and context parameters.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.2 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.13.2

16. v0.13.1 Apr 13, 2025 · release notes

    HyperDbg v0.13.1 adds transparency methods for hiding nested virtualization

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.1 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.13.1

17. v0.13 Feb 25, 2025 · release notes

    New pcicam command and PA-based memory functions for HyperDbg v0.13

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.13

    • Adds the pcicam command to interpret PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. CAM fields
    • Adds support for dumping PCI CAM memory via pcicam in HyperDbg
    • Exports SDK functions for enabling and disabling transparent mode
    • Adds memcpy_pa() function to the script engine
    • Introduces poi_pa, hi_pa, low_pa, db_pa, dd_pa, dw_pa, and dq_pa keywords in the script engine

    +1 more show less

    • Adds eb_pa, ed_pa, and eq_pa functions to the script engine

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The parameters of the !hide command have changed
    • !The parameters of the !unhide command have changed
    • !TSC mitigation for transparent mode is deprecated
18. v0.12 Jan 2, 2025 · release notes

    Adds pci_tree and idt commands for hardware/firmware inspection plus IDT export SDK API

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.12

    • Added the pci_tree command to inspect PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. device topology
    • Added the idt command to interpret the Interrupt Descriptor Table (IDT)
    • Exported SDK APIs for getting Interrupt Descriptor Table (IDT) entries

    3 details in Everything

19. v0.11.0 Dec 3, 2024 · release notes

    Adds xAPIC/x2APIC, ioapic commands and SDK exports to HyperDbg v0.11

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • Adds the local APIC command (xAPIC and x2APIC modes)
    • Adds the I/O APIC command
    • Exports SDK APIs for Local APIC and X2APIC

    3 details in Everything

20. v0.10.2 Oct 11, 2024 · release notes

    HyperDbg v0.10.2 adds hwdbg test case parsing and JSON config representation capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.2 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.10.2

    • Adds automated test case parsing and compilation for the hwdbg debugger.
    • Enables export of hwdbg testing functions for external tooling.
    • Adds automated test case interpretation and emulation of hwdbg hardware scripts.
    • Creates a JSON representation of hwdbg configurations.

    4 details in Everything

21. v0.10.1 Sep 8, 2024 · release notes

    HyperDbg v0.10.1 adds .debug pause-on-connection, SDK APIs for tracing/steps, and // comment syntax.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.1 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.10.1

    • The '.debug' command now supports pausing the debuggee at startup
    • Export SDK API for assembling instructions
    • The 'struct' command now supports a path as output
    • Export SDK API closing connection to the remote debuggee
    • Export SDK APIs for stepping and tracing instructions

    +3 more show less

    • Export SDK APIs for tracking execution
    • HyperDbg command-line comment sign is changed from '#' to C-like comments ('//' and '/**/')
    • Integrating a new command parser for the regular HyperDbg commands

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The comment character '#' is no longer supported; use '//' or '/**/' instead.
22. v0.10 Jul 22, 2024 · release notes

    HyperDbg v0.10 adds assembly conditions in events, DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. event forwarding, a/!a assembler commands, and SDK APIs for VMI/Debugger modes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.10

    └──▷ USE IT
    Assemble raw opcodes into virtual memory at runtime for dynamic payload injection.
    shell copy

    !a <virtual_address> "nop; jmp 0x1234"

    Assemble raw opcodes into physical memory for hardware-level debugging.
    shell copy

    a <physical_address> "mov eax, 1; ret"

    • Support using assembly conditions and codes in all events to control event execution logic
    • Added support for forwarding events to binary (DLL) modules via output mechanisms
    • Added the a assembler command for virtual memory operations
    • Added the !a assembler command for physical memory operations
    • Provided a unified SDK API for reading memory in VMI Mode and Debugger Mode

    +7 more show less

    • Exported SDK APIs for reading and writing registers in Debugger Mode
    • Exported SDK API for writing memory in VMI Mode and Debugger Mode
    • Exported SDK API for connecting to the debugger and from the debuggee in Debugger Mode
    • Exported SDK API for starting a new process
    • Added and exported SDK API for unsetting message callbacks
    • Added message callback support using shared memory
    • Added maximum execution limitation to script IRs to prevent infinite loops

    12 details in Everything

23. v0.9.1 Jun 30, 2024 · release notes

    HyperDbg v0.9.1 adds hwdbg scripting enhancements and renames core libraries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.1 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.9.1

    • Adds @hw_pinX and @hw_portX register support for accessing hardware ports in hwdbg scripts.
    • Adds automatic script buffer packet generator to simplify network traffic simulation in hwdbg.
    • Adds $date and $time pseudo-registers for timestamping within hwdbg scripting logic.
    • Enables regular port/pin value read and modification directly within hwdbg commands.
    • Supports conditional statement evaluation inside hwdbg script contexts.

    +2 more show less

    • Replaces hprdbgctrl.dll, hprdbgkd.sys, and hprdbghv.dll with libhyperdbg.dll, hyperkd.sys, and hyperhv.dll respectively.
    • Provides new exported functions to support loading drivers with different names and connecting/loading HyperDbg drivers programmatically.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !hprdbgctrl.dll is now named libhyperdbg.dll
    • !hprdbgkd.sys is now named hyperkd.sys
    • !hprdbghv.dll is now named hyperhv.dll
24. v0.9.0 Jun 9, 2024 · release notes

    HyperDbg v0.9.0 adds !monitor physical address hooking, merges hwdbg, and introduces strncmp/wcsncmp in the script engine

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    • !monitor command now supports physical address hooking
    • hwdbg engine merged into HyperDbg codebase
    • Script engine gains strncmp(Str1, Str2, Num) function
    • Script engine gains wcsncmp(WStr1, WStr2, Num) function

    4 details in Everything

25. v0.8.3 May 3, 2024 · release notes

    HyperDbg v0.8.3 adds hwdbg headers and multi-socket NUMA configuration support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.3 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.8.3

    • Added hwdbg headers provides external headers for HyperDbg's hardware debugging interface.
    • Added support NUMA configuration with multiple count CPU sockets enables configuring HyperDbg across systems with multiple CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. sockets.

    2 details in Everything

26. v0.8.1 Feb 1, 2024 · release notes

    HyperDbg v0.8.1 adds length parameters to the !monitor command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.1 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.8.1

    └──▷ TRY IT
    Monitor a specific range of memory by defining the exact byte count to observe.
    copy

    $ !monitor <address> <length>

    • !monitor command now accepts a length parameter in its arguments

    1 detail in Everything

27. v0.8.0 Jan 28, 2024 · release notes

    HyperDbg v0.8.0 adds !mode event command and preactivate debugger mode command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    • Adds !mode event command to detect kernel-to-user and user-to-kernel transitions
    • Adds preactivate command to support initializing special functionalities in the Debugger Mode

    2 details in Everything

28. v0.7.1 Dec 19, 2023 · release notes

    HyperDbg v0.7.1 adds hex escape support to string functions and .pagein expression evaluation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.1 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.7.1

    • Adds hexadecimal escape sequence as a string parameter for string functions
    • Adds hexadecimal escape sequence as wstring parameter for wstring functions
    • Allows .pagein ranges to be evaluated as expressions

    3 details in Everything

29. v0.7.0 Nov 22, 2023 · release notes

    HyperDbg v0.7 adds Event Forwarding, event_clear(), string functions, and test command DB interception

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ TRY IT
    Clear a previously registered event by ID within a script
    copy

    $ event_clear(42)

    • test command gains debug break interception (\#DB) manipulation option
    • event_clear(EventId) function added to the script engine
    • Event Forwarding mechanism supported in Debugger Mode with external module (DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls.) support
    • HyperDbg applies events immediately via the instant events mechanism
    • strlen, strcmp, wcscmp and memcmp functions now accept string inputs in the script engine

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The $id pseudo-register is renamed to $event_id
    • !The $tag pseudo-register is renamed to $event_tag
    • !The $stage pseudo-register is renamed to $event_stage
30. v0.5.0 Aug 7, 2023 · release notes

    Adds event calling stage mechanism and $stage pseudo-register for script engine automation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • Introduces the event calling stage mechanism to allow scripted interception of debugger events.
    • Adds the $stage pseudo-register in the script engine to access the current event calling stage.

    2 details in Everything

31. v0.4.0 Jul 18, 2023 · release notes

    Adds !monitor execution interception and .pagein command to HyperDbg v0.4

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    • !monitor command now supports execution interception
    • Adds .pagein debugger command to bring pages in

    2 details in Everything

32. v0.3.0 Jun 8, 2023 · release notes

    HyperDbg v0.3 adds !track, pseudo-registers $tag/$$id, and Zydis-based disassembler functions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • $tag and $id pseudo-registers in the script engine for tracking context
    • event_sc(DisableOrEnable) function in the script engine to short-circuit events
    • test command gains breakpoint interception manipulation option
    • !track command to create tracking records of function CALLs and RETs with registers
    • Underlying disassembly engine swapped from legacy LDE to Zydis

    5 details in Everything

33. v0.2.1 May 24, 2023 · release notes

    HyperDbg v0.2.1 adds EAX index parameter to !cpuid and fixes EPTEPTExtended Page Tables: an Intel CPU feature that lets a hypervisor give each VM its own second-level address translation in hardware, removing the need for software shadow page tables and cutting VM-exit overhead. hook removal issues

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.1 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.2.1

    └──▷ USE IT
    Inspect specific CPUID leaves by providing the EAX index directly in the debugger console
    shell copy

    !cpuid <eax_index>

    • Adds EAX index parameter to the !cpuid extension command for finer-grained CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. feature inspection

    1 detail in Everything

34. v0.2.0 May 3, 2023 · release notes

    HyperDbg v0.2 introduces SDK, flush/memcpy script functions, and renames event control commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    • Adds HyperDbg Software Development Kit (SDK) for external tool integration
    • Adds flush() function in the script engine
    • Adds memcpy() function in the script engine
    • Renames enable_event to event_enable in the script engine
    • Renames disable_event to event_disable in the script engine

    +1 more show less

    • Updates communication buffer size limit by 10x and separates it from hyperlogger buffer chunks

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The enable_event script engine function is removed and renamed to event_enable
    • !The disable_event script engine function is removed and renamed to event_disable
35. v0.1.0 May 31, 2022 · release notes

    HyperDbg v0.1 release introduces hypervisor-based kernel debugging with EPTEPTExtended Page Tables: an Intel CPU feature that lets a hypervisor give each VM its own second-level address translation in hardware, removing the need for software shadow page tables and cutting VM-exit overhead./SYSCALL hooks, MSRs, I/O monitoring, and a scripting engine.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/HyperDbg/HyperDbg.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0

    • Adds epthook extension command for Classic EPT Hook (Hidden Breakpoint)
    • Adds epthook2 extension command for Inline EPT Hook
    • Adds monitor extension command to watch Memory Read/Write and MMIO access
    • Adds syscall extension command to intercept SYSCALL instructions
    • Adds sysret extension command to intercept SYSRET instructions

    +17 more show less

    • Adds cpuid extension command to hook and monitor CPUID instruction
    • Adds msrread extension command to hook and monitor RDMSR access
    • Adds msrwrite extension command to hook and monitor WRMSR access
    • Adds tsc extension command to hook and monitor RDTSC/RDTSCP instructions
    • Adds pmc extension command to hook and monitor RDPMC access
    • Adds vmcall extension command to hook and monitor VMCALL instructions
    • Adds dr extension command to hook and monitor Debug Registers
    • Adds ioin extension command to hook and monitor I/O Port In Instructions
    • Adds ioout extension command to hook and monitor I/O Port Out Instructions
    • Adds exception extension command to monitor Exceptions (IDT < 32)
    • Adds interrupt extension command to monitor External Interrupts (IDT > 32)
    • Adds .process meta-command for process-specific debugging
    • Adds .thread meta-command for thread-specific debugging
    • Adds .sympath and .sym meta-commands for PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis. symbol parsing support
    • Introduces kernel-mode scripting engine for automated scripts and custom assembly execution
    • Adds transparent-mode capability for anti-debugging and anti-hypervisor resistance
    • Adds event forwarding (#DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems.) capability via output commands

    22 details in Everything