HyperDbg — The Cyber Toolchain

HyperDbg v0.25

Sun, 01 Nov 2026 23:42:53 GMT

HyperDbg adds Linux host support, letting practitioners debug a Windows guest over serial from a Linux machine⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • HyperDbg now accepts device and socket paths in the `.debug` command on Linux, enabling serial connections over termios devices and UNIX sockets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • HyperDbg now supports running as a Linux host to debug a Windows guest machine over a serial kernel debugger connection. • HyperDbg's `hyperevade` module now handles XSETBV instructions to improve anti-detection coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.24

Tue, 22 Sep 2026 16:45:30 GMT

HyperDbg v0.24 adds new memory-read commands, user-mode I/O port access, script engine arrays, and Linux kernel module support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `dw` and `!dw` commands to read word (2-byte) values from virtual and physical memory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `da` and `!da` commands to read printable ASCII (null-terminated) strings from virtual and physical memory. • Adds `dds`, `dqs`, and `dps` commands (plus physical memory counterparts) to read double-word, quad-word, and pointer-sized values resolved to symbol names in `module!symbol+offset` format. • Adds `uin` and `uout` commands to read from and write to I/O ports (port-mapped I/O) from the user debugger. • Adds `test script-semantic` CLI command for running script engine semantic test cases. • Adds arrays as function parameters in the script engine. • Adds `char` and wide-char (wchar_t) array types in the script engine. • Ports all HyperDbg kernel modules to compile on Linux, including the hyperhv and hyperlog projects and core platform components (spinlocks, IRQL, process, time, and I/O). • Adds GNU assembler (GAS) stub files to replace MASM assembly files for the Linux kernel module build. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.23

Sun, 02 Aug 2026 22:10:34 GMT

HyperDbg v0.23 adds the `ucpuid` command, floating-point support in the script engine, and advances Linux porting. • New `ucpuid` command lets users execute CPUID in user-mode context directly from the debugger. • Adds an SDK function for the `ucpuid` command, enabling programmatic invocation via the HyperDbg API. • Introduces floating-point (float) data types and operators in the script engine, enabling FP-aware scripting. • Advances Linux port: script engine Linux build completed, Linux kernel module build file (Kbuild) added, and `PlatformCPU` Linux implementation included. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.22

Mon, 20 Jul 2026 06:13:08 GMT

HyperDbg v0.22 adds linked-list traversal commands, struct support in the script engine, and a pname filter for !pt. • New `dl` command traverses linked lists in virtual address space directly from the debugger. • New `!dl` command traverses linked lists using physical addresses. • New SDK API exports for linked-list traversal over both virtual and physical memory. • Adds `pname` option to the `!pt` command to filter process trace by process name. • Script engine now supports structures, enabling struct-aware scripting and automation. • `!pt` initialization moved to a separate thread, reducing blocking during startup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.21

Sun, 05 Jul 2026 13:48:33 GMT

HyperDbg v0.21 adds Intel PT parameter parsing, TID/PID helpers, hyperperf infrastructure, and an SDK load-state API. • Adds user-mode and kernel-mode Intel PT parameter parser for fine-grained control of processor trace configuration. • Adds thread (TID) and process (PID) helper functions for Intel PT, enabling per-thread and per-process tracing workflows. • Introduces the hyperperf (Hardware Performance Counter) project structure as a new HyperDbg SDK module. • Adds hypertrace, hyperevade, and hyperperf DLL files to the SDK, expanding the available module surface. • Exports a new SDK API for checking whether any HyperDbg module is currently loaded. • The `unload` command now reports whether any module is loaded before attempting to unload, improving operator feedback. • Separates SDK libraries into distinct user-mode and kernel-mode modules for cleaner integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.18.1

Thu, 09 Apr 2026 15:40:45 GMT

HyperDbg v0.18.1 adds Hypertrace VMM support and begins LBR implementation • Enables `Hypertrace` to operate with HyperDbg VMM Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.18

Sun, 15 Feb 2026 21:36:41 GMT

HyperDbg v0.18 adds `#include` library support in the script engine and initial hypertrace profiling via Intel LBR/BTS • Script engine now supports writing libraries using the '#include' keyword • Initial codes for the hypertrace project by using Intel Last Branch Record (LBR) and Branch Trace Store (BTS) • The hypertrace project is now linked to the hyperkd Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.17

Mon, 10 Nov 2025 13:58:59 GMT

HyperDbg v0.17 adds multidimensional arrays, compound and multiple assignments to the script engine • Adds compound assignment operators (e.g., +=, -=) in the script engine • Adds multiple variable assignment in a single statement in the script engine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.16

Sun, 07 Sep 2025 22:16:30 GMT

HyperDbg v0.16 adds !xsetbv event command, user debugger step-in/over, and SDK APIs for script execution and expression evaluation. • `!xsetbv` event command handles the execution of the XSETBV instruction • Added support for step-over (the `p` command) in the user debugger • Added support for step-in (the `t` command) in the user debugger • Added support to modify registers or a specific register in the user debugger (`r` command) • SDK API for running scripts in either the kernel debugger or the user debugger • SDK API for evaluating expressions based on the context of the kernel debugger or the user debugger • Added support to evaluate (run) scripts on the target thread in the user debugger (`eval` command) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.15

Sun, 17 Aug 2025 22:39:25 GMT

HyperDbg v0.15 adds SMI support via !smi command and Intel CET emulation. • Adds `!smi` subcommand to perform System Management Interrupt operations • Adds `Check for Intel CET IBT` detection capability • Adds `Check for Intel CET shadow stack` detection capability • Enables Intel CET SYSCALL/SYSRET emulation in debugger • Enhances `.pe` command to parse PE Rich Headers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.14

Wed, 23 Jul 2025 16:39:54 GMT

HyperDbg v0.14 adds .start/.attach/.detach in VMI mode, new timing functions, and EPT support for MMIO >512 GB • Adds the `.start` command to HyperDbg's VMI mode for user debugger sessions • Adds the `.attach` and `.detach` commands to the debugger mode for managing target processes • Adds microsleep(microseconds) function to the script engine for precise timing control • Adds rdtsc() and rdtscp() functions to the script engine for hardware cycle counting • Adds a new mechanism and functions to retrieve the system-call number from the running system Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.13.2

Sun, 25 May 2025 22:14:48 GMT

HyperDbg v0.13.2 adds transparent-mode system-call return interception with TRAP flag and context parameters. • Adds optional parameters and context for transparent-mode system-call return interceptions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.13.1

Sun, 13 Apr 2025 23:18:29 GMT

HyperDbg v0.13.1 adds transparency methods for hiding nested virtualization • Adds new transparency methods for hiding nested virtualization environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.13

Tue, 25 Feb 2025 08:29:56 GMT

New `pcicam` command and PA-based memory functions for HyperDbg v0.13 • Adds the `pcicam` command to interpret PCI CAM fields • Adds support for dumping PCI CAM memory via `pcicam` in HyperDbg • Exports SDK functions for enabling and disabling transparent mode • Adds memcpy_pa() function to the script engine • Introduces `poi_pa`, `hi_pa`, `low_pa`, `db_pa`, `dd_pa`, `dw_pa`, and `dq_pa` keywords in the script engine • Adds `eb_pa`, `ed_pa`, and `eq_pa` functions to the script engine Breaking changes: • The parameters of the `!hide` command have changed • The parameters of the `!unhide` command have changed • TSC mitigation for transparent mode is deprecated Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.12

Thu, 02 Jan 2025 17:35:10 GMT

Adds `pci_tree` and `idt` commands for hardware/firmware inspection plus IDT export SDK API • Added the `pci_tree` command to inspect PCI device topology • Added the `idt` command to interpret the Interrupt Descriptor Table (IDT) • Exported SDK APIs for getting Interrupt Descriptor Table (IDT) entries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.11.0

Tue, 03 Dec 2024 14:59:42 GMT

Adds `xAPIC`/`x2APIC`, `ioapic` commands and SDK exports to HyperDbg v0.11 • Adds the local APIC command (`xAPIC` and `x2APIC` modes) • Adds the I/O APIC command • Exports SDK APIs for Local APIC and X2APIC Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.10.2

Fri, 11 Oct 2024 11:23:02 GMT

HyperDbg v0.10.2 adds hwdbg test case parsing and JSON config representation capabilities • Adds automated test case parsing and compilation for the hwdbg debugger. • Enables export of hwdbg testing functions for external tooling. • Adds automated test case interpretation and emulation of hwdbg hardware scripts. • Creates a JSON representation of hwdbg configurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.10.1

Sun, 08 Sep 2024 13:35:29 GMT

HyperDbg v0.10.1 adds `.debug` pause-on-connection, SDK APIs for tracing/steps, and `//` comment syntax. • `The '.debug' command now supports pausing the debuggee at startup` • `Export SDK API for assembling instructions` • `The 'struct' command now supports a path as output` • `Export SDK API closing connection to the remote debuggee` • `Export SDK APIs for stepping and tracing instructions` • `Export SDK APIs for tracking execution` • HyperDbg command-line comment sign is changed from '#' to C-like comments ('//' and '/**/') • Integrating a new command parser for the regular HyperDbg commands Breaking changes: • The comment character '#' is no longer supported; use '//' or '/**/' instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.10

Mon, 22 Jul 2024 03:48:57 GMT

HyperDbg v0.10 adds assembly conditions in events, DLL event forwarding, `a`/`!a` assembler commands, and SDK APIs for VMI/Debugger modes • Support using assembly conditions and codes in all events to control event execution logic • Added support for forwarding events to binary (DLL) modules via output mechanisms • Added the `a` assembler command for virtual memory operations • Added the `!a` assembler command for physical memory operations • Provided a unified SDK API for reading memory in VMI Mode and Debugger Mode • Exported SDK APIs for reading and writing registers in Debugger Mode • Exported SDK API for writing memory in VMI Mode and Debugger Mode • Exported SDK API for connecting to the debugger and from the debuggee in Debugger Mode • Exported SDK API for starting a new process • Added and exported SDK API for unsetting message callbacks • Added message callback support using shared memory • Added maximum execution limitation to script IRs to prevent infinite loops Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.9.1

Sun, 30 Jun 2024 12:53:04 GMT

HyperDbg v0.9.1 adds hwdbg scripting enhancements and renames core libraries • Adds `@hw_pinX` and `@hw_portX` register support for accessing hardware ports in hwdbg scripts. • Adds automatic script buffer packet generator to simplify network traffic simulation in hwdbg. • Adds `$date` and `$time` pseudo-registers for timestamping within hwdbg scripting logic. • Enables regular port/pin value read and modification directly within hwdbg commands. • Supports conditional statement evaluation inside hwdbg script contexts. • Replaces `hprdbgctrl.dll`, `hprdbgkd.sys`, and `hprdbghv.dll` with `libhyperdbg.dll`, `hyperkd.sys`, and `hyperhv.dll` respectively. • Provides new exported functions to support loading drivers with different names and connecting/loading HyperDbg drivers programmatically. Breaking changes: • `hprdbgctrl.dll` is now named `libhyperdbg.dll` • `hprdbgkd.sys` is now named `hyperkd.sys` • `hprdbghv.dll` is now named `hyperhv.dll` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.9.0

Sun, 09 Jun 2024 10:55:46 GMT

HyperDbg v0.9.0 adds !monitor physical address hooking, merges hwdbg, and introduces strncmp/wcsncmp in the script engine • `!monitor` command now supports physical address hooking • `hwdbg` engine merged into HyperDbg codebase • Script engine gains strncmp(Str1, Str2, Num) function • Script engine gains wcsncmp(WStr1, WStr2, Num) function Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.8.3

Fri, 03 May 2024 06:18:43 GMT

HyperDbg v0.8.3 adds hwdbg headers and multi-socket NUMA configuration support • `Added hwdbg headers` provides external headers for HyperDbg's hardware debugging interface. • `Added support NUMA configuration with multiple count CPU sockets` enables configuring HyperDbg across systems with multiple CPU sockets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.8.1

Thu, 01 Feb 2024 08:54:02 GMT

HyperDbg v0.8.1 adds length parameters to the `!monitor` command • `!monitor` command now accepts a length parameter in its arguments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.8.0

Sun, 28 Jan 2024 13:01:40 GMT

HyperDbg v0.8.0 adds `!mode` event command and `preactivate` debugger mode command. • Adds `!mode` event command to detect kernel-to-user and user-to-kernel transitions • Adds `preactivate` command to support initializing special functionalities in the Debugger Mode Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.7.1

Tue, 19 Dec 2023 23:41:54 GMT

HyperDbg v0.7.1 adds hex escape support to string functions and '.pagein' expression evaluation. • Adds hexadecimal escape sequence as a string parameter for string functions • Adds hexadecimal escape sequence as wstring parameter for wstring functions • Allows '.pagein' ranges to be evaluated as expressions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.7.0

Wed, 22 Nov 2023 06:08:24 GMT

HyperDbg v0.7 adds Event Forwarding, event_clear(), string functions, and test command DB interception • `test` command gains debug break interception (`\#DB`) manipulation option • event_clear(EventId) function added to the script engine • Event Forwarding mechanism supported in Debugger Mode with external module (DLL) support • HyperDbg applies events immediately via the 'instant events' mechanism • `strlen`, `strcmp`, `wcscmp` and `memcmp` functions now accept string inputs in the script engine Breaking changes: • The `$id` pseudo-register is renamed to `$event_id` • The `$tag` pseudo-register is renamed to `$event_tag` • The `$stage` pseudo-register is renamed to `$event_stage` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.4.0

Tue, 18 Jul 2023 12:10:25 GMT

Adds !monitor execution interception and .pagein command to HyperDbg v0.4 • `!monitor` command now supports 'execution' interception • Adds `.pagein` debugger command to bring pages in Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.3.0

Thu, 08 Jun 2023 14:23:56 GMT

HyperDbg v0.3 adds `!track`, pseudo-registers `$tag`/$`$id`, and Zydis-based disassembler functions. • `$tag` and `$id` pseudo-registers in the script engine for tracking context • event_sc(DisableOrEnable) function in the script engine to short-circuit events • `test` command gains breakpoint interception manipulation option • `!track` command to create tracking records of function CALLs and RETs with registers • Underlying disassembly engine swapped from legacy LDE to Zydis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.2.1

Wed, 24 May 2023 11:31:23 GMT

HyperDbg v0.2.1 adds EAX index parameter to !cpuid and fixes EPT hook removal issues • Adds `EAX` index parameter to the `!cpuid` extension command for finer-grained CPU feature inspection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.2.0

Wed, 03 May 2023 11:56:58 GMT

HyperDbg v0.2 introduces SDK, flush/memcpy script functions, and renames event control commands • Adds HyperDbg Software Development Kit (SDK) for external tool integration • Adds flush() function in the script engine • Adds memcpy() function in the script engine • Renames `enable_event` to `event_enable` in the script engine • Renames `disable_event` to `event_disable` in the script engine • Updates communication buffer size limit by 10x and separates it from hyperlogger buffer chunks Breaking changes: • The `enable_event` script engine function is removed and renamed to `event_enable` • The `disable_event` script engine function is removed and renamed to `event_disable` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg

HyperDbg v0.1.0

Tue, 31 May 2022 14:08:32 GMT

HyperDbg v0.1 release introduces hypervisor-based kernel debugging with EPT/SYSCALL hooks, MSRs, I/O monitoring, and a scripting engine. • Adds `epthook` extension command for Classic EPT Hook (Hidden Breakpoint) • Adds `epthook2` extension command for Inline EPT Hook • Adds `monitor` extension command to watch Memory Read/Write and MMIO access • Adds `syscall` extension command to intercept SYSCALL instructions • Adds `sysret` extension command to intercept SYSRET instructions • Adds `cpuid` extension command to hook and monitor CPUID instruction • Adds `msrread` extension command to hook and monitor RDMSR access • Adds `msrwrite` extension command to hook and monitor WRMSR access • Adds `tsc` extension command to hook and monitor RDTSC/RDTSCP instructions • Adds `pmc` extension command to hook and monitor RDPMC access • Adds `vmcall` extension command to hook and monitor VMCALL instructions • Adds `dr` extension command to hook and monitor Debug Registers • Adds `ioin` extension command to hook and monitor I/O Port In Instructions • Adds `ioout` extension command to hook and monitor I/O Port Out Instructions • Adds `exception` extension command to monitor Exceptions (IDT < 32) • Adds `interrupt` extension command to monitor External Interrupts (IDT > 32) • Adds `.process` meta-command for process-specific debugging • Adds `.thread` meta-command for thread-specific debugging • Adds `.sympath` and `.sym` meta-commands for PDB symbol parsing support • Introduces kernel-mode scripting engine for automated scripts and custom assembly execution • Adds `transparent-mode` capability for anti-debugging and anti-hypervisor resistance • Adds event forwarding (#DFIR) capability via output commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/hyperdbg