-
+
+
+
+
- + 03 December 2024 (2 messages) + + +
-
+ + ++ +
+
+ + +++ + HyperDbg v0.11 is released! ✨ ++ + + + +
+
This version comes with bug fixes, improvements, and two new commands for viewing Local APIC (XAPIC/X2APIC) and IO APIC. +
+
Big shoutout to Björn Ruytenberg for joining the team for bringing PCIe support to HyperDbg! +
+
https://github.com/HyperDbg/HyperDbg/releases/tag/v0.11.0 +
+
Check it out: +
https://docs.hyperdbg.org/commands/extension-commands/apic +
+
https://docs.hyperdbg.org/commands/extension-commands/ioapic + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + + ++ + + + +
+
+
+
+
- + 06 December 2024 (3 messages) + + +
-
+ + ++ +
+
+ + +++ + + Joined. + + ++ + +
+
+
+
+
+
+
+
+
+
+
+
+ - + 07 December 2024 (1 messages) + + +
-
+ + ++ +
+
+ + +++ + + Joined. + + ++ + +
+
+
+
+ - + 08 December 2024 (1 messages) + + +
-
+ + ++ +
+
+ + +++ + + ++ + ++ + sticker.webm + ++ +
+
+
+
+ - + 11 December 2024 (5 messages) + + +
-
+ + ++ +
+
+ + +++ + Starting from the next version (v0.12), HyperDbg will support the '!pcitree' command. You can use it from the 'dev' branch now. ++ + + + +
+
https://docs.hyperdbg.org/commands/extension-commands/pcitree + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + + ++ + + + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> @HyperDbgBridge ++ + +
Is Rayanfam in the group? Things aren't working properly here. The registry entries for DbgView aren't working properly either. It took me about an hour to figure out the correct way to do it. Here's what you should do: +
Save the following content as dgbview.reg. +
Double-click on dgbview.reg. +
+
``` +
Windows Registry Editor Version 5.00 +
+
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter] +
"DEFAULT"=dword:0000000f +
``` +
https://cdn.discordapp.com/attachments/962350355839066130/1316449218633928724/image.png?ex=675b1660&is=6759c4e0&hm=828c61954ef4c4123a50b78220337f9999819a81292ad551763e8655a98fcedb& + ++ + None + ++ +
+
+
+
+ -
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> it works for me. my win version is 10.0.16299 ++ + +
https://cdn.discordapp.com/attachments/962350355839066130/1316450184007385099/image.png?ex=675b1746&is=6759c5c6&hm=519cbc2fcbf829fa164e17084e0366b7e0c0e5074fb3be8a911d086e4e590392& + ++ + None + ++ +
+
+
+
+ -
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> you could consider patching the article. 😄 ++ + +
https://rayanfam.com/topics/hypervisor-from-scratch-part-2/#viewing-debugging-messages-in-dbgview + ++ + Hypervisor From Scratch – Part 2: Entering VMX Operation + ++ +We write about Windows Internals, Hypervisors, Linux, and Networks.
+ + +
+
+
+
+ - + 12 December 2024 (2 messages) + + +
-
+ + ++ +
+
+ + +++ + + Joined. + + ++ + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + Nice catch. You can send your patch to the blog using this repo: ++ + +
https://github.com/rayanfam/rayanfam.github.io/tree/main/_posts + ++ + rayanfam.github.io/_posts at main · rayanfam/rayanfam.github.io + ++ +You can visit the website at: https://rayanfam.com - rayanfam/rayanfam.github.io
+ + +
+
+
+
+ - + 13 December 2024 (4 messages) + + +
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> @HyperDbgBridge https://github.com/rayanfam/rayanfam.github.io/pull/2 Do you have time to review it? + ++ + ++ + fix: set Debug Print Filter to dword:0000000f by Jamlee · Pull Request #2 · rayanfam/rayanfam.github.io + ++ +
my windows is 10.0.16299, the registry entries for DbgView aren't working. It took me about an hour to figure out the correct way to do it. +Save the following content as dgbview.reg. +Doub...
+ + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> Checked in successfully for 'hypervisor-from-scratch-part-2' ++ + +
https://cdn.discordapp.com/attachments/962350355839066130/1317182006190280714/image.png?ex=675dc0d6&is=675c6f56&hm=91e6ccffd96bea431c7a7874768e590b9379d3dcdb86319ac7097608203ae61b& + ++ + None + ++ +
+
+
+
+ -
+ + ++ +
+
+ + +++ + Merged! 👍 + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + Great. Thanks for fixing it. + ++ + +
+
+
+
+
- + 14 December 2024 (1 messages) + + + + + + +
- + 15 December 2024 (8 messages) + + + + + + +
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> In Linux, each process has its own page table. However, according to the concept of shadow page tables, it seems that there is only one page table for the guest. This seems very strange. ++ + +
https://cdn.discordapp.com/attachments/962350355839066130/1317912800395399219/shadow-page-tables-1.png?ex=67606971&is=675f17f1&hm=1a24bfdbcdcae67675e731575ebe01ef151b97f61fd90ba7a7f6eb7c27301627& + ++ + None + ++ +
+
+
+
+ -
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> Many diagrams are drawn in this way, but I don't understand why only one page table is drawn for the guest. Clearly, there should be multiple page tables (one for each process). ++ + +
https://cdn.discordapp.com/attachments/962350355839066130/1317913591650713721/703cb802dfdf67ea4295e3fdd8d6d9fe.png?ex=67606a2d&is=675f18ad&hm=eca03a1625753c826ceccd0c301c338ab31ceb44e9db6e09fac291f1a87e4e46& + ++ + None + ++ +
+
+
+
+ -
+ + ++ +
+
+ + +++ + I don't know which material you're researching, but it looks like a description of a hypervisor for a pre-EPT era. Hypervisor would trap page faults and mask CR3 register, so that it would replace needed pages for the guest OS on the fly. Indeed, you would have to mask all related page tables (for every related process). However, it's more like an implementation detail, that's why it's probably out of scope for your material. + ++ + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> I'm currently reading "hypervisor-from-scratch-part-4". The architecture diagram of the shadow page table in it doesn't quite match the Linux memory management logic that I knew before, so I'm a bit confused. ++ + +
+
My understanding is the same as that shown in this diagram. +
https://www.ryanstan.com/mmu-virtualization-shadow-page-tables.html +
https://cdn.discordapp.com/attachments/962350355839066130/1317916799718785165/shadow-page-tables-diagram.png?ex=67606d2a&is=675f1baa&hm=2465f1cf56627b2a46e465caf83e28c81d27045ecfaa3609840c7d26023dabf0& + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + Oh, that's a question for the author then, hehe + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + But my take is hypervisor doesn't know anything about the guest, whether it is linux, dos or etc. Hypervisor's purpose is to virtualize the execution environment. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + There are indeed separate page tables on Linux and Windows, and that's the reason you trap CR3 writes in the hypervisor as well + ++ + +
+
+
2024
-
+
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2021-01.html b/2021-01.html index 209dec5..c2d936e 100644 --- a/2021-01.html +++ b/2021-01.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2021-02.html b/2021-02.html index a7c53b2..9d34e60 100644 --- a/2021-02.html +++ b/2021-02.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2021-06.html b/2021-06.html index 0d7c029..156f792 100644 --- a/2021-06.html +++ b/2021-06.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2021-10.html b/2021-10.html index 618e4e0..c981a26 100644 --- a/2021-10.html +++ b/2021-10.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2021-12.html b/2021-12.html index 132868b..76c87e3 100644 --- a/2021-12.html +++ b/2021-12.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2022-05.html b/2022-05.html index 51a3227..9a8529e 100644 --- a/2022-05.html +++ b/2022-05.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2022-06.html b/2022-06.html index 99b06c4..23becd1 100644 --- a/2022-06.html +++ b/2022-06.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2022-07.html b/2022-07.html index 84a6a30..e8d9107 100644 --- a/2022-07.html +++ b/2022-07.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2022-08.html b/2022-08.html index 6a1ffe3..affe1af 100644 --- a/2022-08.html +++ b/2022-08.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2022-09.html b/2022-09.html index 0918c13..7311d79 100644 --- a/2022-09.html +++ b/2022-09.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2022-10.html b/2022-10.html index d558feb..58236be 100644 --- a/2022-10.html +++ b/2022-10.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2022-11.html b/2022-11.html index a6822c7..11f5ab5 100644 --- a/2022-11.html +++ b/2022-11.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-01.html b/2023-01.html index 4dbf5e7..2df7708 100644 --- a/2023-01.html +++ b/2023-01.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-02.html b/2023-02.html index 2db9cb0..d4115b9 100644 --- a/2023-02.html +++ b/2023-02.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-04.html b/2023-04.html index 3adc0bb..38d8cab 100644 --- a/2023-04.html +++ b/2023-04.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-05.html b/2023-05.html index 58f6c93..aa80513 100644 --- a/2023-05.html +++ b/2023-05.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-06.html b/2023-06.html index 35fe4a1..9cbef10 100644 --- a/2023-06.html +++ b/2023-06.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-06_2.html b/2023-06_2.html index 5e02f4e..af8c361 100644 --- a/2023-06_2.html +++ b/2023-06_2.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-07.html b/2023-07.html index fbe0286..4f5c8dd 100644 --- a/2023-07.html +++ b/2023-07.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-07_2.html b/2023-07_2.html index 86ed1a6..2519478 100644 --- a/2023-07_2.html +++ b/2023-07_2.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-07_3.html b/2023-07_3.html index 5ce850d..0e53cad 100644 --- a/2023-07_3.html +++ b/2023-07_3.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-07_4.html b/2023-07_4.html index 8b4bd8e..37f0925 100644 --- a/2023-07_4.html +++ b/2023-07_4.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-07_5.html b/2023-07_5.html index 1ab99ac..2161254 100644 --- a/2023-07_5.html +++ b/2023-07_5.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-08.html b/2023-08.html index f8e2989..9de2489 100644 --- a/2023-08.html +++ b/2023-08.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-08_2.html b/2023-08_2.html index 7499dff..50484dd 100644 --- a/2023-08_2.html +++ b/2023-08_2.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-09.html b/2023-09.html index bc68f7c..f039b1e 100644 --- a/2023-09.html +++ b/2023-09.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-10.html b/2023-10.html index 62feadc..439189f 100644 --- a/2023-10.html +++ b/2023-10.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-11.html b/2023-11.html index 7f35c94..1cce965 100644 --- a/2023-11.html +++ b/2023-11.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2023-12.html b/2023-12.html index d1d99b2..edcc365 100644 --- a/2023-12.html +++ b/2023-12.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-01.html b/2024-01.html index c828685..2ecfdc3 100644 --- a/2024-01.html +++ b/2024-01.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-02.html b/2024-02.html index 4037f33..9beed0f 100644 --- a/2024-02.html +++ b/2024-02.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-03.html b/2024-03.html index 2eef042..538235a 100644 --- a/2024-03.html +++ b/2024-03.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-04.html b/2024-04.html index 0b22868..eb0dcc3 100644 --- a/2024-04.html +++ b/2024-04.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-05.html b/2024-05.html index 13607e1..89dfb07 100644 --- a/2024-05.html +++ b/2024-05.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-06.html b/2024-06.html index 1a6315e..052c16c 100644 --- a/2024-06.html +++ b/2024-06.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-06_2.html b/2024-06_2.html index 9dba907..5d443a8 100644 --- a/2024-06_2.html +++ b/2024-06_2.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-07.html b/2024-07.html index 9dbebaf..eb65ab6 100644 --- a/2024-07.html +++ b/2024-07.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-08.html b/2024-08.html index 52ddd1a..6f70120 100644 --- a/2024-08.html +++ b/2024-08.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-09.html b/2024-09.html index 2fe68b5..b2d52c1 100644 --- a/2024-09.html +++ b/2024-09.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-10.html b/2024-10.html index 8ad2298..c8c581f 100644 --- a/2024-10.html +++ b/2024-10.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) diff --git a/2024-11.html b/2024-11.html index 10c29aa..767475e 100644 --- a/2024-11.html +++ b/2024-11.html @@ -51,10 +51,17 @@
- + + Dec 2024 + (27) + + +
- Nov 2024 - (200) + (235) @@ -7720,7 +7727,7 @@
- - 20 November 2024 (5 messages) + 20 November 2024 (6 messages) -
- - - 09 Nov 2024 (15) - + + +
- + 21 November 2024 (1 messages) + + + -
- - - 10 Nov 2024 (3) - + + +
- + 22 November 2024 (2 messages) + + +
-
+ + ++ +
+
+ + ++ + [discord] <adam235513> Hi, Im trying to debug a process with anti debug. So I thought I use HyperDbg to avoid being detecting. So when I start the process in the VM HyperDbg will directly break in the process. When I press `g` it will break on the next instruction ... Is there a way to disable the behavior or at least some kind of logging to see why HyperDbg is breaking ? Is it page guard?! + ++ + +
-
- - - 11 Nov 2024 (1) - + + +
-
+ + ++ +
+
+ + ++ + Once you press 'g' it stops at the PE entrypoint, unless there is an anti debugging method (maybe TLS?) that breaks the debugging? + ++ + +
-
- - - 12 Nov 2024 (9) - + + +
- + 23 November 2024 (11 messages) + + +
-
+ + ++ +
+
+ + ++ + [discord] <adam235513> Yeah, it has TLS. Can I disable the behavior? It doesn't have to break at the EP. I can set a breakpoint on one of the Windows APIs + ++ + +
-
- - - 13 Nov 2024 (151) - + + +
-
+ + ++ +
+
+ + ++ + It's actually possible but if you could modify the source code (and recompile HyperDbg), but could you run the PE and then attach to it? It would be easier. + ++ + +
-
- - - 14 Nov 2024 (1) - + + +
-
+ + ++ +
+
+ + +++ + Or another option that you have is putting some hooks in some APIs or system-calls and intercept it this way. It's probably a better approach. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <adam235513> No, because it directly breaks in HyperDbg even when I don't launch it through hyperdbg. Can modify the code, already compiled it myself + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + What do you mean by "breaks HyperDbg"? Is it something like triggering infinite number of breakpoints? + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <adam235513> Yes, exactly. After each instruction is executed it breaks. So hyperdbg becomes useless + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <adam235513> Like a page guard is set on the memory page and hyprdbg is catching the exception + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + You can disable triggering (intercepting breakpoints by HyperDbg) using this command: ++ + +
+
test breakpoint off + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + If you need to disable intercepting traps (single stepping) like #DB, you could use this command: ++ + +
+
test trap off + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + [discord] <adam235513> Ok, I will give it a try tomorrow. Thanks + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + Sure thing. Let me know about the results. If it didn't work, probably there are other options like ignoring exceptions (using the !exception command). + ++ + +
+
+
+
+
- + 24 November 2024 (5 messages) + + +
-
+ + ++ +
+
+ + +++ + [discord] <adam235513> Test trap works. Now I can attach to the process and break on a Windows API. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <adam235513> Thanks a lot + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <adam235513> Did you ever thought to put a gdb server into it ? So one can easily attach with IDA? + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + Great. 👍 + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + Nope, unfortunately HyperDbg only uses its custom protocol, not gdb stub. + ++ + +
+
+
+
+
- + 26 November 2024 (1 messages) + + + + + + +
- + 28 November 2024 (4 messages) + + + + + + +
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> Hi. What's the working principle of the EPT classic hook? I really can't figure out why a Windows running on a physical machine can also trigger an EPT violation. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> How does an EPT violation trigger a VM Exit event? Windows isn't running in a virtual machine. Can't it be handled directly in a driver? + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> https://tenor.com/view/hot-summer-scary-scared-creepy-gif-17494278817868935582 + ++ + ++ + None + ++ +
+
+
+
+
- + 29 November 2024 (9 messages) + + +
-
+ + ++ +
+
+ + +++ + HyperDbg is a bluepill style hypervisor, which means it virtualizes and already running system. Think of it as a system that is running and then you virtualize all system resources (starting from kernel). + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + EPT Violation is a form of VM-exit. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + Generally, VT-x is consist of some instructions, which gives you (VMM) the ability to control critical CPU components (like memory, interrupts, IO ports, PCIe bars) by triggering VM-exits. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + If you're curious about these topics, you might be interested in checking Hypervisor From Scratch series which describes how HyperDbg works internally: ++ + +
+
https://rayanfam.com/tutorials/ + ++ + Tutorials + ++ +We write about Windows Internals, Hypervisors, Linux, and Networks.
+ + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> Yes, I've briefly read through the "Hypervisor From Scratch" series, but I didn't quite understand it. I can't imagine what a bluepill style hypervisor program is like. Here's what I know: ++ + +
1. When the Virtual Machine Monitor (VMM) enters the VMX (Virtual Machine eXtensions) mode, it has already set up the conversions for the Virtual Machine Control Structure (VMCS) and Extended Page Table (EPT). +
2. The state of the CPU that enters the operation will be stored in the VMCS. At this time, the virtualized CPU is being used. +
3. Then it exits the VMX mode. The code runs on the physical CPU again. +
+
The CPU running in VT (Virtualization Technology) and the physical CPU are like two completely different worlds. Why is it related to the MSR (Model Specific Register) hook? I must have missed some crucial information. + +
+
+
+
+ -
+ + ++ +
+
+ + +++ + It’s the same cpu all the time, it just has different modes of operation. Depending on the mode of execution the CPU has either additional features or otherwise a reduced set of them. VMX root mode pretty much just allows the execution of VMX instructions. VMX guest mode allows auxiliary control structures (like vmcs) to back up its execution. The whole idea of trapping various events in the guest mode is to allow the hypervisor to properly emulate the platform. MSRs for example are shared between all modes, but you don’t want the guest to mess with MsRs that could affect VMX root mode, right? That’s why you have the ability to intercept them and manually handle in the root mode. If that’s your question. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> Yes, this is exactly the answer I was looking for. Actually, I asked ChatGPT to write example code like this before, but I can't be 100% sure that the MSR registers are shareable. I didn't have a deep enough understanding of virtualization before. Thank you. You've been a great help. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> Next, I'll go on to read "Hypervisor From Scratch" in more depth. + ++ + +
+
+
+
+
-
+ + ++ +
+
+ + +++ + [discord] <jamlee7879> https://tenor.com/view/high-five-patrick-star-spongebob-squarepants-the-patrick-star-show-yes-gif-2201400520488940521 + ++ + ++ + High Five Patrick Star GIF - High Five Patrick Star Spongebob Squarepants - Discover & Share GIFs + ++ +
The perfect High Five Patrick Star Spongebob Squarepants Animated GIF for your conversation. Discover and Share the best GIFs on Tenor.
+ + +
+
+
+
+ - + 30 November 2024 (1 messages) + + + + +
- + + 04 Nov 2024 (1) + + + +
- + + 05 Nov 2024 (5) + + + +
- + + 06 Nov 2024 (1) + + + +
- + + 07 Nov 2024 (1) + + + +
- + + 08 Nov 2024 (3) + + + +
- + + 09 Nov 2024 (15) + + + +
- + + 10 Nov 2024 (3) + + + +
- + + 11 Nov 2024 (1) + + + +
- + + 12 Nov 2024 (9) + + + +
- + + 13 Nov 2024 (151) + + + +
- + + 14 Nov 2024 (1) +
-
@@ -8022,7 +9475,55 @@
2020
- - 20 Nov 2024 (5) + 20 Nov 2024 (6) + + + +
- + + 21 Nov 2024 (1) + + + +
- + + 22 Nov 2024 (2) + + + +
- + + 23 Nov 2024 (11) + + + +
- + + 24 Nov 2024 (5) + + + +
- + + 26 Nov 2024 (1) + + + +
- + + 28 Nov 2024 (4) + + + +
- + + 29 Nov 2024 (9) + + + +
- + + 30 Nov 2024 (1) diff --git a/2024-12.html b/2024-12.html new file mode 100644 index 0000000..5c2b3ef --- /dev/null +++ b/2024-12.html @@ -0,0 +1,1631 @@ + + + + + +
-
+
2024
+-
+
+
- + + Dec 2024 + (27) + + + +
- + + Nov 2024 + (235) + + + +
- + + Oct 2024 + (83) + + + +
- + + Sep 2024 + (263) + + + +
- + + Aug 2024 + (332) + + + +
- + + Jul 2024 + (403) + + + +
- + + Jun 2024 + (570) + + + +
- + + May 2024 + (245) + + + +
- + + Apr 2024 + (156) + + + +
- + + Mar 2024 + (90) + + + +
- + + Feb 2024 + (134) + + + +
- + + Jan 2024 + (309) + + + +
+
+ -
+
2023
+-
+
+
- + + Dec 2023 + (62) + + + +
- + + Nov 2023 + (326) + + + +
- + + Oct 2023 + (76) + + + +
- + + Sep 2023 + (315) + + + +
- + + Aug 2023 + (757) + + + +
- + + Jul 2023 + (2215) + + + +
- + + Jun 2023 + (778) + + + +
- + + May 2023 + (300) + + + +
- + + Apr 2023 + (1) + + + +
- + + Feb 2023 + (5) + + + +
- + + Jan 2023 + (1) + + + +
+
+ -
+
2022
+-
+
+
- + + Nov 2022 + (1) + + + +
- + + Oct 2022 + (2) + + + +
- + + Sep 2022 + (1) + + + +
- + + Aug 2022 + (1) + + + +
- + + Jul 2022 + (39) + + + +
- + + Jun 2022 + (23) + + + +
- + + May 2022 + (256) + + + +
+
+ -
+
2021
+-
+
+
- + + Dec 2021 + (1) + + + +
- + + Oct 2021 + (82) + + + +
- + + Jun 2021 + (1) + + + +
- + + Feb 2021 + (1) + + + +
- + + Jan 2021 + (2) + + + +
+
+ -
+
2020
+-
+
+
- + + Dec 2020 + (1) + + + +
- + + Nov 2020 + (2) + + + +
+
+ - + + 03 Dec 2024 (2) + + + +
- + + 06 Dec 2024 (3) + + + +
- + + 07 Dec 2024 (1) + + + +
- + + 08 Dec 2024 (1) + + + +
- + + 11 Dec 2024 (5) + + + +
- + + 12 Dec 2024 (2) + + + +
- + + 13 Dec 2024 (4) + + + +
- + + 14 Dec 2024 (1) + + + +
- + + 15 Dec 2024 (8) + + + +
- + + Dec 2024 + (27) + + + +
- Nov 2024 - (200) + (235) @@ -351,102 +358,135 @@
- - 04 November 2024 (1 messages) +
- + 03 December 2024 (2 messages) -
-
+
+
- - Joined. - + HyperDbg v0.11 is released! ✨ ++ +
+
This version comes with bug fixes, improvements, and two new commands for viewing Local APIC (XAPIC/X2APIC) and IO APIC. +
+
Big shoutout to Björn Ruytenberg for joining the team for bringing PCIe support to HyperDbg! +
+
https://github.com/HyperDbg/HyperDbg/releases/tag/v0.11.0 +
+
Check it out: +
https://docs.hyperdbg.org/commands/extension-commands/apic +
+
https://docs.hyperdbg.org/commands/extension-commands/ioapic
- - - 05 November 2024 (5 messages) - - -
-
+
+
- Will similar ept hooks created by smap and smep perform better? ++ +
-
- + 06 December 2024 (3 messages) + + +
-
+
+
@@ -462,34 +502,32 @@
2020
--
-
- Not sure if I understand the question. What do you mean by smap and smep? If you're talking about CPU features to prevent access/exec user code from supervisor, then how could it be related to EPT hooks? 🤔 + + Joined. +@@ -499,78 +537,73 @@2020
- -- + 07 December 2024 (1 messages) +
+ +-
+
- From what I see in the source code (might be wrong), I could assume that they are some smap preventions for a granularity of one page. If that's the case, why not just using the page table attributes instead of smap or smep? 🤔 + + Joined. +@@ -580,258 +613,342 @@2020
-- - 06 November 2024 (1 messages) +
- + 08 December 2024 (1 messages)
-- - 07 November 2024 (1 messages) +
- + 11 December 2024 (5 messages)
-
+
https://docs.hyperdbg.org/commands/extension-commands/pcitree- - 08 November 2024 (3 messages) -
- -
+
- Joined. -+ +
+
- How VMX_EXIT_REASON_EXECUTE_INVLPG is handled？ + [discord] <jamlee7879> @HyperDbgBridge ++
Is Rayanfam in the group? Things aren't working properly here. The registry entries for DbgView aren't working properly either. It took me about an hour to figure out the correct way to do it. Here's what you should do: +
Save the following content as dgbview.reg. +
Double-click on dgbview.reg. +
+
``` +
Windows Registry Editor Version 5.00 +
+
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter] +
"DEFAULT"=dword:0000000f +
``` +
https://cdn.discordapp.com/attachments/962350355839066130/1316449218633928724/image.png?ex=675b1660&is=6759c4e0&hm=828c61954ef4c4123a50b78220337f9999819a81292ad551763e8655a98fcedb&+ + None + ++
https://cdn.discordapp.com/attachments/962350355839066130/1316450184007385099/image.png?ex=675b1746&is=6759c5c6&hm=519cbc2fcbf829fa164e17084e0366b7e0c0e5074fb3be8a911d086e4e590392&+ + None + ++- - 09 November 2024 (15 messages) -
- -
https://rayanfam.com/topics/hypervisor-from-scratch-part-2/#viewing-debugging-messages-in-dbgview+ + Hypervisor From Scratch – Part 2: Entering VMX Operation + ++We write about Windows Internals, Hypervisors, Linux, and Networks.
+ + +- + 12 December 2024 (2 messages) +
+ +
0: kHyperDbg> !monitor r fffff80664a00000 fffff806628c0000 -
please choose the 'from' value first, then choose the 'to' value + + Joined. +2020
-
@@ -857,100 +974,146 @@ 2020
- ↶ Reply to #8153 + ↶ Reply to #8398 - #8154 + #8400 - 07:50 AM, 09 Nov 2024 + 04:57 PM, 12 Dec 2024- The second address could not be greater than the first address. + Nice catch. You can send your patch to the blog using this repo: ++
https://github.com/rayanfam/rayanfam.github.io/tree/main/_posts+ + rayanfam.github.io/_posts at main · rayanfam/rayanfam.github.io + ++You can visit the website at: https://rayanfam.com - rayanfam/rayanfam.github.io
+ + +- + 13 December 2024 (4 messages) +
+ +my windows is 10.0.16299, the registry entries for DbgView aren't working. It took me about an hour to figure out the correct way to do it. +Save the following content as dgbview.reg. +Doub...
+ + +
https://cdn.discordapp.com/attachments/962350355839066130/1317182006190280714/image.png?ex=675dc0d6&is=675c6f56&hm=91e6ccffd96bea431c7a7874768e590b9379d3dcdb86319ac7097608203ae61b&+ + None + ++
@@ -966,18 +1129,18 @@ 2020
- ↶ Reply to #8157 + ↶ Reply to #8401 - #8158 + #8403 - 01:26 PM, 09 Nov 2024 + 10:13 PM, 13 Dec 2024- Theoretically, there is no limitation for it, but of course if you put a monitor on ~100MB of RAM, HyperDbg will have a hard time interpreting VM-exits in your computer. 😅 + Merged! 👍@@ -987,7 +1150,7 @@2020
-
@@ -1003,18 +1166,18 @@ 2020
- ↶ Reply to #8157 + ↶ Reply to #8402 - #8159 + #8404 - 01:29 PM, 09 Nov 2024 + 10:13 PM, 13 Dec 2024- Just keep in mind that the '!monitor' command in the Debugger mode (not in VMI mode) needs to have all of the page entries to be valid and available in the RAM. If it's not available (i.e., it's paged out or never paged in), then HyperDbg will show you an error and instruct you to use the '.pagein' command to force Windows to bring your address range into the memory. + Great. Thanks for fixing it.@@ -1024,69 +1187,79 @@2020
-- + 14 December 2024 (1 messages) +
+ +- + 15 December 2024 (8 messages) +
+ +- everything is a little simpler, I would like to track calls inside the text ntoskrnl section))) + + Joined. +@@ -1096,6587 +1269,134 @@2020
-
https://cdn.discordapp.com/attachments/962350355839066130/1317912800395399219/shadow-page-tables-1.png?ex=67606971&is=675f17f1&hm=1a24bfdbcdcae67675e731575ebe01ef151b97f61fd90ba7a7f6eb7c27301627&+ + None + ++- -
- - - -- -- -
-
- - --- - Yes, as I mentioned earlier, pages should be available in the memory for the !monitor command since this command works on physical addresses. Follow the instructions (the documentation link) to fix it. - -- - -- -
- - - -- -- -
-
- - --- - [matrix] <pr0xy101 (@pr0xy101:matrix.org)> hello, can i debug easy anti-cheat using hyperdbg? - -- - -- - 10 November 2024 (3 messages) -
- - - - - -- -
- - - -- -- -
-
- - --- - Are you sure you're computing it correctly? It seems that you're trying to hook somewhere in the kernel, but the results of the expressions are in the user-mode? - -- - - - -- -
- - - -- -- -
-
- - --- - - -- - - - -- - 11 November 2024 (1 messages) -
- - - - - -- - 12 November 2024 (9 messages) -
- -- -
- - - -- -- -
-
- - --- - This is expected. The '.pagein' command injects a #PF (page-fault) into the system to force Windows to bring the page into the RAM. - -- - -- -
- - - -- -- -
-
- - --- - If the page is already in the RAM or it's available, Windows doesn't expect to receive a page-fault and what happens here? Windows assumes that something went wrong as the #PF is generated by CPU by error. Which might lead to double/triple-fault and break the system (restart). - -- - -- -
- - - -- -- -
-
- - --- - You should be cautious when using the '.pagein' command. If you use it on a wide-range of RAM, usually such errors will happen because somewhere in the middle of the range might be already available into RAM and it will cause system crash as #PF is not expected. - -- - -- -
- - - -- -- -
-
- - --- - Guys, just because HyperDbg’s '!monitor' command can technically monitor unlimited address ranges doesn’t mean you can monitor any memory range you want. So let’s not go wild, alright? 😅 -- - - - -
-
https://docs.hyperdbg.org/commands/extension-commands/monitor - -- -
- - - - - - - -- -- -
-
- - --- - It refers to you @instw0 😅 - -- - -- -
- - - - - - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - There is a limit to the number of '!epthook's you can place on a single 4 KB page. If you reach this limit, HyperDbg will display an error message tells you to adjust the constant and recompile HyperDbg. However, there’s no restriction on the number of !epthook`s across different pages. Essentially, there’s no practical limit, but be cautious not to overload the system with too many breakpoints! - -- - -- - 13 November 2024 (151 messages) -
- -- -
- - - -- -- -
-
- - --- - guys, I want to test r3 epthook. The code is shown in the following image, This test runs on non-root mode - -- - - - -- -
- - - -- -- -
-
- - --- - Now I have encountered a problem, the function inside the function does not return (BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores) - -- - - - -- -
- - - -- -- -
-
- - --- - After debugging, I found that it is caused by the following function - -- - - - -- -
- - - -- -- -
-
- - --- - When I tried to skip the BroadcastEnabled BreakpointExitingOnExceptionBitmapAllCores function and observe the program's response, the second error occurred. -- - - - -
The PoolManageRequestPool function returns 0. - -- -
- - - -- -- -
-
- - --- - What should I do now? 😢 - -- - -- -
- - - -- -- -
-
- - --- - Can you explain about the environment? Like are you setting an EPT hook from a kernel driver and you're using the 'Hyperhv' project as an imported module? Or is it coming from the hyperdbg-cli.exe (libhyperdbg.dll)? - -- - -- -
- - - -- -- -
-
- - --- - I am using hyperdbg-cli.exe, but I have made some minor modifications to hyperhv - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - Something is wrong here. The following combination of code will crash HyperDbg, you're modifying the wrong place. - -- - -- -
- - - -- -- -
-
- - --- - Are you running HyperDbg in VMI-mode? or the Debugger-mode? - -- - -- -
- - - -- -- -
-
- - --- - .connect local - -- - -- -
- - - -- -- -
-
- - --- - load vmm - -- - -- -
- - - -- -- -
-
- - --- - It's VMI-mode. Now, are you trying to put an EPT hook the user-mode of another process? - -- - -- -
- - - -- -- -
-
- - --- - Yes, that's what I want to do now - -- - -- -
- - - -- -- -
-
- - --- - What is the handler of the breakpoint? Is WinDbg handling the breakpoint? Like are you running it in a virtual machine (VMware) or in the baremetal? - -- - -- -
- - - -- -- -
-
- - --- - I didn't do any additional processing, I just wanted to observe the phenomenon of EPT working - -- - -- -
- - - -- -- -
-
- - --- - Then, why don't you use the command line (scripts) for that? -- - -
-
https://docs.hyperdbg.org/commands/extension-commands/epthook - -- - !epthook (hidden hook with EPT - stealth breakpoints) | HyperDbg Documentation - -- -Description of the '!epthook' command in HyperDbg.
- - -- -
- - - -- -- -
-
- - --- - Take a look at this video: -- - -
https://www.youtube.com/watch?v=tjsFRBFGis4&ab_channel=OpenSecurityTraining2 - -- - Dbg3301: HyperDbg 05 01 Intro and Classic Hidden Hooks - -- -View the full free MOOC at https://ost2.fyi/Dbg3301. This course is an introductory guide to HyperDbg debugger, guiding you through the initial steps of using HyperDbg, covering essential concepts, principles, debugging functionalities, along with practical examples and numerous reverse engineering methods that are unique to HyperDbg. Whether you have an interest in reverse engineering or seek to elevate your reverse engineering skills with hypervisor-assisted approaches, this course provides a solid foundation for starting your journey.
- - -- -
- - - -- -- -
-
- - --- - This command has no effect.😢 - -- - -- -
- - - -- -- -
-
- - --- - What was the command? Maybe you wrote an incorrect script. - -- - -- -
- - - -- -- -
-
- - --- - !epthook 7ff7a0bc13f0 pid 1ec4 asm code {ret} this is my code. - -- - -- -
- - - -- -- -
-
- - --- - This code, won't do anything! - -- - -- -
- - - -- -- -
-
- - --- - The 'ret' is executed in the VMX-root mode as additional assembly code, it's not running in the target executable file! - -- - -- -
- - - -- -- -
-
- - --- - Are you trying to bypass a 'CALL' instruction? - -- - -- -
- - - -- -- -
-
- - --- - Yes, I tried to make a function return directly - -- - -- -
- - - -- -- -
-
- - --- - okay, let me find the correct example. I'll send it here in a bit. - -- - -- -
- - - -- -- -
-
- - --- - i love you , bro 😂 - -- - -- -
- - - -- -- -
-
- - --- - You need a script like this: -- - -
-
!epthook 7ff7a0bc13f0 pid 1ec4 script { -
-
@rip = poi(@rsp); // pop the return address from stack -
@rsp = @rsp + 8; // adjust the stack -
-
printf("Function call ignored!\n"); -
-
} - -- -
- - - -- -- -
-
- - --- - Put it on the target function that is called (not the 'CALL' instruction that tries to call the target function). - -- - -- -
- - - -- -- -
-
- - --- - thank you so much - -- - -- -
- - - -- -- -
-
- - --- - This error has occurred now😢 - -- - - - -- -
- - - -- -- -
-
- - --- - vmware 17.5.1 - -- - -- -
- - - -- -- -
-
- - --- - Is the process id still valid? - -- - -- -
- - - -- -- -
-
- - --- - I used 1 CPU core - -- - -- -
- - - -- -- -
-
- - --- - pid 1ec4 - -- - -- -
- - - -- -- -
-
- - --- - I mean this one. - -- - -- -
- - - -- -- -
-
- - --- - yes, pid still valid - -- - -- -
- - - -- -- -
-
- - --- - Could you check it with: -- - -
eb 7ff7a0bc13f0 pid 1ec4 - -- -
- - - -- -- -
-
- - --- - Does it show anything? - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - Oh sorry - -- - -- -
- - - -- -- -
-
- - --- - db instead of eb - -- - -- -
- - - -- -- -
-
- - --- - db 7ff7a0bc13f0 pid 1ec4 - -- - -- -
- - - -- -- -
-
- - --- - My mistake. - -- - -- -
- - - -- -- -
-
- - --- - This one is the correct command. - -- - -- -
- - - -- -- -
-
- - --- - It seems that the process's memory cannot be read - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - The target is not valid? - -- - -- -
- - - -- -- -
-
- - --- - yes, but ... emm...... let me see - -- - -- -
- - - -- -- -
-
- - --- - I don't know what happened, it used to work😂 - -- - - - -- -
- - - -- -- -
-
- - --- - The address is invalid (probably because of KASLR?). - -- - -- -
- - - -- -- -
-
- - --- - I don't know. -- - -
I will try restarting VMware first, and then I will try to solve the problem with invalid address - -- -
- - - -- -- -
-
- - --- - thanks - -- - -- -
- - - -- -- -
-
- - --- - Let me know, what happened if you find a way around it. - -- - -- -
- - - -- -- -
-
- - --- - ok - -- - -- -
- - - -- -- -
-
- - --- - This code can only work on the first attempt -- - - - -
The second time it stopped working - -- -
- - - -- -- -
-
- - --- - Let me check it on my system. - -- - -- -
- - - -- -- -
-
- - --- - maybe i should pull HyperDbg from GhuHub again? - -- - -- -
- - - -- -- -
-
- - --- - Which version of HyperDbg do you use? - -- - -- -
- - - -- -- -
-
- - --- - 0.10.2 - -- - -- -
- - - -- -- -
-
- - --- - Nope, no need to pull. Give me a bit to test it. - -- - -- -
- - - -- -- -
-
- - --- - 👍 - -- - -- -
- - - -- -- -
-
- - --- - I test it with a custom application: - -- - - - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - Is there any anti-debugging method in your target application that leads to this behavior? - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - this is my demo - -- - -- -
- - - -- -- -
-
- - --- - what is &test? - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - Could you please copy-paste these two functions here? - -- - -- -
- - - -- -- -
-
- - --- - I'm gonna test it. - -- - -- -
- - - -- -- -
-
- - --- - functions? - -- - -- -
- - - -- -- -
-
- - --- - test() and main() - -- - -- -
- - - -- -- -
-
- - --- - int test() -- - -
{ -
cout << "\tinput text, and messagebox" << endl; -
string str; -
cin >> str; -
return MessageBoxA(0, str.c_str(), 0, 0); -
} - -- -
- - - -- -- -
-
- - --- - int main() -- - -
{ -
{ -
BYTE* pCode = (BYTE*)&test; -
cout << "pid:0x" << std::hex << GetCurrentProcessId() << ", proc:0x" << (PVOID)pCode << endl; -
help(); -
} - -- -
- - - -- -- -
-
- - --- - Thanks, lemme check it - -- - -- -
- - - -- -- -
-
- - --- - I don't think it has anything to do with functions - -- - -- -
- - - -- -- -
-
- - --- - Can you reproduce this phenomenon? - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - I think the problem is not because of HyperDbg as it works for me. - -- - -- -
- - - -- -- -
-
- - --- - Yes, I think so too - -- - -- -
- - - -- -- -
-
- - --- - It's probably because at some points the pCode is no longer valid. - -- - -- -
- - - -- -- -
-
- - --- - Perhaps I accidentally modified the hyperhv code - -- - -- -
- - - -- -- -
-
- - --- - You can remove your modifications and recompile HyperDbg. - -- - -- -
- - - -- -- -
-
- - --- - ok, i do it now - -- - -- -
- - - -- -- -
-
- - --- - Other than that, shouldn't it be like this? - -- - - - -- -
- - - -- -- -
-
- - --- - I mean I removed the the '&'. - -- - -- -
- - - -- -- -
-
- - --- - Because you're creating a reference to the address of the 'test'. It's not the address of the 'test'. Am I right? - -- - -- -
- - - -- -- -
-
- - --- - Could you check it as well? - -- - -- -
- - - -- -- -
-
- - --- - ok - -- - -- -
- - - -- -- -
-
- - --- - i test remove &, but I don't think this has anything to do with it - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - - -- - -- - image_2024-11-13_21-51-19.png - -- -- -
- - - -- -- -
-
- - --- - 🤣 - -- - -- -
- - - -- -- -
-
- - --- - Fixed? - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - Why these two variables are the same? Is there any optimization? 😳 - -- - -- -
- - - -- -- -
-
- - --- - I don't know how to say this - -- - -- -
- - - -- -- -
-
- - --- - There is no problem with using&for functions - -- - -- -
- - - -- -- -
-
- - --- - Maybe we'll have to test it later, con't connect to github. - -- - - - -- -
- - - -- -- -
-
- - --- - 😂 - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - The only difference between your code and my code is that I commented the 'help' function. Could you add a '_getch()' before the help function and try it again? - -- - -- -
- - - -- -- -
-
- - --- - of course - -- - -- -
- - - -- -- -
-
- - --- - Alternatively, I can rewrite a clean demo - -- - -- -
- - - -- -- -
-
- - --- - emmm..... - -- - - - -- -
- - - -- -- -
-
- - --- - let me try again - -- - -- -
- - - -- -- -
-
- - --- - I don't know what happened - -- - - - -- -
- - - -- -- -
-
- - --- - I just restarted the system in VMware - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - i do nothing - -- - -- -
- - - -- -- -
-
- - --- - Did you add _getch() to your code? - -- - -- -
- - - -- -- -
-
- - --- - - -- - - - -- -
- - - -- -- -
-
- - --- - 🤔🤔 - -- - -- -
- - - -- -- -
-
- - --- - I switched to Win11 and tried again - -- - -- -
- - - -- -- -
-
- - --- - I test this code one hundred time, it's still valid on my system. It's really weird. - -- - -- -
- - - -- -- -
-
- - --- - Maybe you should try my exe - -- - -- -
- - - -- -- -
-
- - --- - Wait a moment, I'll try Win11 - -- - -- -
- - - -- -- -
-
- - --- - Currently, it can work on Win11 - -- - - - -- -
- - - -- -- -
-
- - --- - Okay, but on the Windows 10 where it didn't work. Is it a very old (before meltdown) processor? - -- - -- -
- - - -- -- -
-
- - --- - no, it is 14900k - -- - -- -
- - - -- -- -
-
- - --- - Intel(R) Core(TM) i9-14900K 3.20 GHz - -- - -- -
- - - -- -- -
-
- - --- - So, it worked on your Windows 11 machine and didn't work on Windows 10 machine? Am I right? - -- - -- -
- - - -- -- -
-
- - --- - yes , you are right - -- - -- -
- - - -- -- -
-
- - --- - 10.0.19045.2486 - -- - -- -
- - - -- -- -
-
- - --- - This is the version number of Win10 - -- - -- -
- - - -- -- -
-
- - --- - That's super weird. I have a Win 10 here, I'm gonna test on it too. - -- - -- -
- - - -- -- -
-
- - --- - But, probably, it would take a while. So, meanwhile you could enjoy using HyperDbg on your Win11, meanwhile I try to understand what goes wrong with this command in the Windows 10. - -- - -- -
- - - -- -- -
-
- - --- - You have already helped me a lot, thank you for your software, it's great - -- - -- -
- - - -- -- -
-
- - --- - Wait, I think I find the error. - -- - - - -- -
- - - -- -- -
-
- - --- - great - -- - -- -
- - - -- -- -
-
- - --- - After some time (around 30 minutes), it started to show the invalid error to me. I checked it with x64dbg as well). I accessed it from x64dbg and the address becomes available in HyperDbg. - -- - -- -
- - - -- -- -
-
- - --- - So, it seems to be because of Windows paging. - -- - -- -
- - - -- -- -
-
- - --- - That means the page has been replaced? - -- - -- -
- - - -- -- -
-
- - --- - Once the RAM is full, Windows tries to page-out that page and that's why you get this error. (I assume that you didn't give your virtual machine enough RAM?). - -- - -- -
- - - -- -- -
-
- - --- - Yes - -- - -- -
- - - -- -- -
-
- - --- - o... you are right - -- - -- -
- - - -- -- -
-
- - --- - I only allocated 2g to Win10 - -- - -- -
- - - -- -- -
-
- - --- - Allocated 4G to Win11 - -- - -- -
- - - -- -- -
-
- - --- - Perhaps this is the reason for the problem - -- - -- -
- - - -- -- -
-
- - --- - That's the reason. - -- - -- -
- - - -- -- -
-
- - --- - Now I will try to allocate more memory - -- - -- -
- - - -- -- -
-
- - --- - Yes, that's right. After I allocated 4G of memory, the problem disappeared - -- - -- -
- - - -- -- -
-
- - --- - 👍 - -- - -- -
- - - -- -- -
-
- - --- - 👍 - -- - -- -
- - - -- -- -
-
- - --- - I have to put a note in the documentation to tell this behavior to the users. - -- - -- -
- - - -- -- -
-
- - --- - I can't help but say one more thing, brother. You're amazing - -- - -- -
- - - - - - - -- -- -
-
- - --- - -- - -- Hand shake 1_1.mp4 + -- -- - 14 November 2024 (1 messages) -
- - -- - 15 November 2024 (2 messages) -
- -
-
- - --- - - Joined. - - -- - -- -
- - - -+
--- - - Joined. - - -- - -- - 19 November 2024 (2 messages) -
- -- -
- -- --- - Joined. - + I don't know which material you're researching, but it looks like a description of a hypervisor for a pre-EPT era. Hypervisor would trap page faults and mask CR3 register, so that it would replace needed pages for the guest OS on the fly. Indeed, you would have to mask all related page tables (for every related process). However, it's more like an implementation detail, that's why it's probably out of scope for your material.@@ -7686,153 +1406,81 @@2020
- - - - -- - 20 November 2024 (5 messages) -
- -- -
- - - -+
--- - Joined. + - -- - -- -
-- -- -
-
- -- Two new commands are now documented (and merged to the 'dev' branch) for dumping I/O APIC and Local APIC (in both XAPIC and X2APIC mode). If you want to test it before the official v0.11 release, you can switch to the 'dev' branch. + [discord] <jamlee7879> I'm currently reading "hypervisor-from-scratch-part-4". The architecture diagram of the shadow page table in it doesn't quite match the Linux memory management logic that I knew before, so I'm a bit confused.-
-
https://docs.hyperdbg.org/commands/extension-commands/apic -
https://docs.hyperdbg.org/commands/extension-commands/ioapic +
My understanding is the same as that shown in this diagram. +
https://www.ryanstan.com/mmu-virtualization-shadow-page-tables.html +
https://cdn.discordapp.com/attachments/962350355839066130/1317916799718785165/shadow-page-tables-diagram.png?ex=67606d2a&is=675f1baa&hm=2465f1cf56627b2a46e465caf83e28c81d27045ecfaa3609840c7d26023dabf0&- - !apic (dump local APIC entries in XAPIC and X2APIC modes) | HyperDbg Documentation - --Description of '!apic' command in HyperDbg.
- - --
+
- Also, two other new commands for enumerating PCI Express devices + Reading/writing into PCI/PCI-e Config Address Space (CAM) will soon be available. + Oh, that's a question for the author then, hehe@@ -7842,94 +1490,71 @@2020
-
-
You can also follow us there. 😊 -
-
- https://bsky.app/profile/hyperdbg.bsky.social -
- https://infosec.exchange/@hyperdbg + But my take is hypervisor doesn't know anything about the guest, whether it is linux, dos or etc. Hypervisor's purpose is to virtualize the execution environment.2020
-
-
- - - 04 Nov 2024 (1) - - - -
- - - 05 Nov 2024 (5) - - - -
- - - 06 Nov 2024 (1) - - - -
- - - 07 Nov 2024 (1) - - - -
- - - 08 Nov 2024 (3) - - - -
-
-
- 09 Nov 2024 (15)
+
- + + 03 Dec 2024 (2)
-- - - 10 Nov 2024 (3) +
- + + 06 Dec 2024 (3)
-- - - 11 Nov 2024 (1) +
- + + 07 Dec 2024 (1)
-- - - 12 Nov 2024 (9) +
- + + 08 Dec 2024 (1)
-- - - 13 Nov 2024 (151) +
- + + 11 Dec 2024 (5)
-- - - 14 Nov 2024 (1) +
- + + 12 Dec 2024 (2)
-- - - 15 Nov 2024 (2) +
- + + 13 Dec 2024 (4)
-- - - 19 Nov 2024 (2) +
- + + 14 Dec 2024 (1)
-- - - 20 Nov 2024 (5) +
- + + 15 Dec 2024 (8)
diff --git a/index.xml b/index.xml index 36ddcf2..6700109 100644 --- a/index.xml +++ b/index.xml @@ -6,7 +6,503 @@Public archive of HyperDbg Telegram messages. http://www.rssboard.org/rss-specification tg-archive 1.2.1 -Wed, 20 Nov 2024 16:02:36 +0000 +Mon, 16 Dec 2024 11:00:04 +0000 +- +
+@honorary_bot on 2024-12-15 18:18:19+00:00 (#8413) + https://tg-archive.hyperdbg.org/2024-12.html#8413 +There are indeed separate page tables on Linux and Windows, and that's the reason you trap CR3 writes in the hypervisor as well +https://tg-archive.hyperdbg.org/2024-12.html#8413 +Sun, 15 Dec 2024 18:18:19 +0000 +- +
+@honorary_bot on 2024-12-15 18:17:18+00:00 (#8412) + https://tg-archive.hyperdbg.org/2024-12.html#8412 +But my take is hypervisor doesn't know anything about the guest, whether it is linux, dos or etc. Hypervisor's purpose is to virtualize the execution environment. +https://tg-archive.hyperdbg.org/2024-12.html#8412 +Sun, 15 Dec 2024 18:17:18 +0000 +- +
+@honorary_bot on 2024-12-15 18:15:38+00:00 (#8411) + https://tg-archive.hyperdbg.org/2024-12.html#8411 +Oh, that's a question for the author then, hehe +https://tg-archive.hyperdbg.org/2024-12.html#8411 +Sun, 15 Dec 2024 18:15:38 +0000 +- +
+@HyperDbgBot on 2024-12-15 18:10:51+00:00 (#8410) + https://tg-archive.hyperdbg.org/2024-12.html#8410 +[discord] <jamlee7879> I'm currently reading "hypervisor-from-scratch-part-4". The architecture diagram of the shadow page table in it doesn't quite match the Linux memory management logic that I knew before, so I'm a bit confused. + +My understanding is the same as that shown in this diagram. +https://www.ryanstan.com/mmu-virtualization-shadow-page-tables.html +https://cdn.discordapp.com/attachments/962350355839066130/1317916799718785165/shadow-page-tables-diagram.png?ex=67606d2a&is=675f1baa&hm=2465f1cf56627b2a46e465caf83e28c81d27045ecfaa3609840c7d26023dabf0& +https://tg-archive.hyperdbg.org/2024-12.html#8410 +Sun, 15 Dec 2024 18:10:51 +0000 +- +
+@honorary_bot on 2024-12-15 18:03:18+00:00 (#8409) + https://tg-archive.hyperdbg.org/2024-12.html#8409 +I don't know which material you're researching, but it looks like a description of a hypervisor for a pre-EPT era. Hypervisor would trap page faults and mask CR3 register, so that it would replace needed pages for the guest OS on the fly. Indeed, you would have to mask all related page tables (for every related process). However, it's more like an implementation detail, that's why it's probably out of scope for your material. +https://tg-archive.hyperdbg.org/2024-12.html#8409 +Sun, 15 Dec 2024 18:03:18 +0000 +- +
+@HyperDbgBot on 2024-12-15 17:58:06+00:00 (#8408) + https://tg-archive.hyperdbg.org/2024-12.html#8408 +[discord] <jamlee7879> Many diagrams are drawn in this way, but I don't understand why only one page table is drawn for the guest. Clearly, there should be multiple page tables (one for each process). +https://cdn.discordapp.com/attachments/962350355839066130/1317913591650713721/703cb802dfdf67ea4295e3fdd8d6d9fe.png?ex=67606a2d&is=675f18ad&hm=eca03a1625753c826ceccd0c301c338ab31ceb44e9db6e09fac291f1a87e4e46& +https://tg-archive.hyperdbg.org/2024-12.html#8408 ++ Sun, 15 Dec 2024 17:58:06 +0000 +- +
+@HyperDbgBot on 2024-12-15 17:54:57+00:00 (#8407) + https://tg-archive.hyperdbg.org/2024-12.html#8407 +[discord] <jamlee7879> In Linux, each process has its own page table. However, according to the concept of shadow page tables, it seems that there is only one page table for the guest. This seems very strange. +https://cdn.discordapp.com/attachments/962350355839066130/1317912800395399219/shadow-page-tables-1.png?ex=67606971&is=675f17f1&hm=1a24bfdbcdcae67675e731575ebe01ef151b97f61fd90ba7a7f6eb7c27301627& +https://tg-archive.hyperdbg.org/2024-12.html#8407 ++ Sun, 15 Dec 2024 17:54:57 +0000 +- +
+@zzzzzzzzzzw111 on 2024-12-15 11:45:46+00:00 (#8406) + https://tg-archive.hyperdbg.org/2024-12.html#8406 ++ https://tg-archive.hyperdbg.org/2024-12.html#8406 +Sun, 15 Dec 2024 11:45:46 +0000 +- +
+@afkuvzrkar on 2024-12-14 03:23:56+00:00 (#8405) + https://tg-archive.hyperdbg.org/2024-12.html#8405 +document_2024-12-14_03-23-56.mp4 +https://tg-archive.hyperdbg.org/2024-12.html#8405 ++ Sat, 14 Dec 2024 03:23:56 +0000 +- +
+@HughEverett on 2024-12-13 22:13:55+00:00 (#8404) + https://tg-archive.hyperdbg.org/2024-12.html#8404 +Great. Thanks for fixing it. +https://tg-archive.hyperdbg.org/2024-12.html#8404 +Fri, 13 Dec 2024 22:13:55 +0000 +- +
+@HughEverett on 2024-12-13 22:13:42+00:00 (#8403) + https://tg-archive.hyperdbg.org/2024-12.html#8403 +Merged! 👍 +https://tg-archive.hyperdbg.org/2024-12.html#8403 +Fri, 13 Dec 2024 22:13:42 +0000 +- +
+@HyperDbgBot on 2024-12-13 17:31:02+00:00 (#8402) + https://tg-archive.hyperdbg.org/2024-12.html#8402 +[discord] <jamlee7879> Checked in successfully for 'hypervisor-from-scratch-part-2' +https://cdn.discordapp.com/attachments/962350355839066130/1317182006190280714/image.png?ex=675dc0d6&is=675c6f56&hm=91e6ccffd96bea431c7a7874768e590b9379d3dcdb86319ac7097608203ae61b& +https://tg-archive.hyperdbg.org/2024-12.html#8402 ++ Fri, 13 Dec 2024 17:31:02 +0000 +- +
+@HyperDbgBot on 2024-12-13 14:25:39+00:00 (#8401) + https://tg-archive.hyperdbg.org/2024-12.html#8401 +[discord] <jamlee7879> @HyperDbgBridge https://github.com/rayanfam/rayanfam.github.io/pull/2 Do you have time to review it? +https://tg-archive.hyperdbg.org/2024-12.html#8401 ++ Fri, 13 Dec 2024 14:25:39 +0000 +- +
+@HughEverett on 2024-12-12 16:57:23+00:00 (#8400) + https://tg-archive.hyperdbg.org/2024-12.html#8400 +Nice catch. You can send your patch to the blog using this repo: +https://github.com/rayanfam/rayanfam.github.io/tree/main/_posts +https://tg-archive.hyperdbg.org/2024-12.html#8400 ++ Thu, 12 Dec 2024 16:57:23 +0000 +- +
+@LG_Preset on 2024-12-12 16:27:03+00:00 (#8399) + https://tg-archive.hyperdbg.org/2024-12.html#8399 ++ https://tg-archive.hyperdbg.org/2024-12.html#8399 +Thu, 12 Dec 2024 16:27:03 +0000 +- +
+@HyperDbgBot on 2024-12-11 17:09:07+00:00 (#8398) + https://tg-archive.hyperdbg.org/2024-12.html#8398 +[discord] <jamlee7879> you could consider patching the article. 😄 +https://rayanfam.com/topics/hypervisor-from-scratch-part-2/#viewing-debugging-messages-in-dbgview +https://tg-archive.hyperdbg.org/2024-12.html#8398 ++ Wed, 11 Dec 2024 17:09:07 +0000 +- +
+@HyperDbgBot on 2024-12-11 17:03:02+00:00 (#8397) + https://tg-archive.hyperdbg.org/2024-12.html#8397 +[discord] <jamlee7879> it works for me. my win version is 10.0.16299 +https://cdn.discordapp.com/attachments/962350355839066130/1316450184007385099/image.png?ex=675b1746&is=6759c5c6&hm=519cbc2fcbf829fa164e17084e0366b7e0c0e5074fb3be8a911d086e4e590392& +https://tg-archive.hyperdbg.org/2024-12.html#8397 ++ Wed, 11 Dec 2024 17:03:02 +0000 +- +
+@HyperDbgBot on 2024-12-11 16:59:12+00:00 (#8395) + https://tg-archive.hyperdbg.org/2024-12.html#8395 +[discord] <jamlee7879> @HyperDbgBridge +Is Rayanfam in the group? Things aren't working properly here. The registry entries for DbgView aren't working properly either. It took me about an hour to figure out the correct way to do it. Here's what you should do: +Save the following content as dgbview.reg. +Double-click on dgbview.reg. + +``` +Windows Registry Editor Version 5.00 + +[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter] +"DEFAULT"=dword:0000000f +``` +https://cdn.discordapp.com/attachments/962350355839066130/1316449218633928724/image.png?ex=675b1660&is=6759c4e0&hm=828c61954ef4c4123a50b78220337f9999819a81292ad551763e8655a98fcedb& +https://tg-archive.hyperdbg.org/2024-12.html#8395 ++ Wed, 11 Dec 2024 16:59:12 +0000 +- +
+@HughEverett on 2024-12-11 15:10:04+00:00 (#8394) + https://tg-archive.hyperdbg.org/2024-12.html#8394 +photo_2024-12-11_15-10-04.jpg +https://tg-archive.hyperdbg.org/2024-12.html#8394 ++ Wed, 11 Dec 2024 15:10:04 +0000 +- +
+@HughEverett on 2024-12-11 15:10:04+00:00 (#8393) + https://tg-archive.hyperdbg.org/2024-12.html#8393 +Starting from the next version (v0.12), HyperDbg will support the '!pcitree' command. You can use it from the 'dev' branch now. + +https://docs.hyperdbg.org/commands/extension-commands/pcitree +https://tg-archive.hyperdbg.org/2024-12.html#8393 ++ Wed, 11 Dec 2024 15:10:04 +0000 +- +
+@xssaint on 2024-12-08 22:04:39+00:00 (#8390) + https://tg-archive.hyperdbg.org/2024-12.html#8390 +sticker.webm +https://tg-archive.hyperdbg.org/2024-12.html#8390 ++ Sun, 08 Dec 2024 22:04:39 +0000 +- +
+@Fly_Dragon_Fly on 2024-12-07 05:28:24+00:00 (#8388) + https://tg-archive.hyperdbg.org/2024-12.html#8388 ++ https://tg-archive.hyperdbg.org/2024-12.html#8388 +Sat, 07 Dec 2024 05:28:24 +0000 +- +
+@7806029674 on 2024-12-06 16:10:15+00:00 (#8387) + https://tg-archive.hyperdbg.org/2024-12.html#8387 ++ https://tg-archive.hyperdbg.org/2024-12.html#8387 +Fri, 06 Dec 2024 16:10:15 +0000 +- +
+@282877022 on 2024-12-06 06:40:20+00:00 (#8386) + https://tg-archive.hyperdbg.org/2024-12.html#8386 ++ https://tg-archive.hyperdbg.org/2024-12.html#8386 +Fri, 06 Dec 2024 06:40:20 +0000 +- +
+@DoubleFetch on 2024-12-06 05:55:52+00:00 (#8385) + https://tg-archive.hyperdbg.org/2024-12.html#8385 ++ https://tg-archive.hyperdbg.org/2024-12.html#8385 +Fri, 06 Dec 2024 05:55:52 +0000 +- +
+@HyperDbgChannel on 2024-12-03 16:28:49+00:00 (#8384) + https://tg-archive.hyperdbg.org/2024-12.html#8384 +photo_2024-12-03_16-28-49.jpg +https://tg-archive.hyperdbg.org/2024-12.html#8384 ++ Tue, 03 Dec 2024 16:28:49 +0000 +- +
+@HyperDbgChannel on 2024-12-03 16:28:49+00:00 (#8383) + https://tg-archive.hyperdbg.org/2024-12.html#8383 +HyperDbg v0.11 is released! ✨ + +This version comes with bug fixes, improvements, and two new commands for viewing Local APIC (XAPIC/X2APIC) and IO APIC. + +Big shoutout to Björn Ruytenberg for joining the team for bringing PCIe support to HyperDbg! + +https://github.com/HyperDbg/HyperDbg/releases/tag/v0.11.0 + +Check it out: +https://docs.hyperdbg.org/commands/extension-commands/apic + +https://docs.hyperdbg.org/commands/extension-commands/ioapic +https://tg-archive.hyperdbg.org/2024-12.html#8383 ++ Tue, 03 Dec 2024 16:28:49 +0000 +- +
+@6817320794 on 2024-11-30 20:18:31+00:00 (#8382) + https://tg-archive.hyperdbg.org/2024-11.html#8382 ++ https://tg-archive.hyperdbg.org/2024-11.html#8382 +Sat, 30 Nov 2024 20:18:31 +0000 +- +
+@HyperDbgBot on 2024-11-29 10:07:46+00:00 (#8381) + https://tg-archive.hyperdbg.org/2024-11.html#8381 +[discord] <jamlee7879> https://tenor.com/view/high-five-patrick-star-spongebob-squarepants-the-patrick-star-show-yes-gif-2201400520488940521 +https://tg-archive.hyperdbg.org/2024-11.html#8381 ++ Fri, 29 Nov 2024 10:07:46 +0000 +- +
+@HyperDbgBot on 2024-11-29 10:07:34+00:00 (#8380) + https://tg-archive.hyperdbg.org/2024-11.html#8380 +[discord] <jamlee7879> Next, I'll go on to read "Hypervisor From Scratch" in more depth. +https://tg-archive.hyperdbg.org/2024-11.html#8380 +Fri, 29 Nov 2024 10:07:34 +0000 +- +
+@HyperDbgBot on 2024-11-29 10:05:23+00:00 (#8379) + https://tg-archive.hyperdbg.org/2024-11.html#8379 +[discord] <jamlee7879> Yes, this is exactly the answer I was looking for. Actually, I asked ChatGPT to write example code like this before, but I can't be 100% sure that the MSR registers are shareable. I didn't have a deep enough understanding of virtualization before. Thank you. You've been a great help. +https://tg-archive.hyperdbg.org/2024-11.html#8379 +Fri, 29 Nov 2024 10:05:23 +0000 +- +
+@honorary_bot on 2024-11-29 09:57:38+00:00 (#8378) + https://tg-archive.hyperdbg.org/2024-11.html#8378 +It’s the same cpu all the time, it just has different modes of operation. Depending on the mode of execution the CPU has either additional features or otherwise a reduced set of them. VMX root mode pretty much just allows the execution of VMX instructions. VMX guest mode allows auxiliary control structures (like vmcs) to back up its execution. The whole idea of trapping various events in the guest mode is to allow the hypervisor to properly emulate the platform. MSRs for example are shared between all modes, but you don’t want the guest to mess with MsRs that could affect VMX root mode, right? That’s why you have the ability to intercept them and manually handle in the root mode. If that’s your question. +https://tg-archive.hyperdbg.org/2024-11.html#8378 +Fri, 29 Nov 2024 09:57:38 +0000 +- +
+@HyperDbgBot on 2024-11-29 09:44:55+00:00 (#8377) + https://tg-archive.hyperdbg.org/2024-11.html#8377 +[discord] <jamlee7879> Yes, I've briefly read through the "Hypervisor From Scratch" series, but I didn't quite understand it. I can't imagine what a bluepill style hypervisor program is like. Here's what I know: +1. When the Virtual Machine Monitor (VMM) enters the VMX (Virtual Machine eXtensions) mode, it has already set up the conversions for the Virtual Machine Control Structure (VMCS) and Extended Page Table (EPT). +2. The state of the CPU that enters the operation will be stored in the VMCS. At this time, the virtualized CPU is being used. +3. Then it exits the VMX mode. The code runs on the physical CPU again. + +The CPU running in VT (Virtualization Technology) and the physical CPU are like two completely different worlds. Why is it related to the MSR (Model Specific Register) hook? I must have missed some crucial information. +https://tg-archive.hyperdbg.org/2024-11.html#8377 +Fri, 29 Nov 2024 09:44:55 +0000 +- +
+@HughEverett on 2024-11-29 08:49:14+00:00 (#8375) + https://tg-archive.hyperdbg.org/2024-11.html#8375 +If you're curious about these topics, you might be interested in checking Hypervisor From Scratch series which describes how HyperDbg works internally: + +https://rayanfam.com/tutorials/ +https://tg-archive.hyperdbg.org/2024-11.html#8375 ++ Fri, 29 Nov 2024 08:49:14 +0000 +- +
+@HughEverett on 2024-11-29 08:48:01+00:00 (#8374) + https://tg-archive.hyperdbg.org/2024-11.html#8374 +Generally, VT-x is consist of some instructions, which gives you (VMM) the ability to control critical CPU components (like memory, interrupts, IO ports, PCIe bars) by triggering VM-exits. +https://tg-archive.hyperdbg.org/2024-11.html#8374 +Fri, 29 Nov 2024 08:48:01 +0000 +- +
+@HughEverett on 2024-11-29 08:45:10+00:00 (#8373) + https://tg-archive.hyperdbg.org/2024-11.html#8373 +EPT Violation is a form of VM-exit. +https://tg-archive.hyperdbg.org/2024-11.html#8373 +Fri, 29 Nov 2024 08:45:10 +0000 +- +
+@HughEverett on 2024-11-29 08:44:16+00:00 (#8372) + https://tg-archive.hyperdbg.org/2024-11.html#8372 +HyperDbg is a bluepill style hypervisor, which means it virtualizes and already running system. Think of it as a system that is running and then you virtualize all system resources (starting from kernel). +https://tg-archive.hyperdbg.org/2024-11.html#8372 +Fri, 29 Nov 2024 08:44:16 +0000 +- +
+@HyperDbgBot on 2024-11-28 18:21:35+00:00 (#8371) + https://tg-archive.hyperdbg.org/2024-11.html#8371 +[discord] <jamlee7879> https://tenor.com/view/hot-summer-scary-scared-creepy-gif-17494278817868935582 +https://tg-archive.hyperdbg.org/2024-11.html#8371 ++ Thu, 28 Nov 2024 18:21:35 +0000 +- +
+@HyperDbgBot on 2024-11-28 18:20:47+00:00 (#8370) + https://tg-archive.hyperdbg.org/2024-11.html#8370 +[discord] <jamlee7879> How does an EPT violation trigger a VM Exit event? Windows isn't running in a virtual machine. Can't it be handled directly in a driver? +https://tg-archive.hyperdbg.org/2024-11.html#8370 +Thu, 28 Nov 2024 18:20:47 +0000 +- +
+@HyperDbgBot on 2024-11-28 18:19:16+00:00 (#8369) + https://tg-archive.hyperdbg.org/2024-11.html#8369 +[discord] <jamlee7879> Hi. What's the working principle of the EPT classic hook? I really can't figure out why a Windows running on a physical machine can also trigger an EPT violation. +https://tg-archive.hyperdbg.org/2024-11.html#8369 +Thu, 28 Nov 2024 18:19:16 +0000 +- +
+@roboltelegram on 2024-11-28 08:01:16+00:00 (#8368) + https://tg-archive.hyperdbg.org/2024-11.html#8368 ++ https://tg-archive.hyperdbg.org/2024-11.html#8368 +Thu, 28 Nov 2024 08:01:16 +0000 +- +
+@8014109179 on 2024-11-26 11:58:19+00:00 (#8367) + https://tg-archive.hyperdbg.org/2024-11.html#8367 ++ https://tg-archive.hyperdbg.org/2024-11.html#8367 +Tue, 26 Nov 2024 11:58:19 +0000 +- +
+@HughEverett on 2024-11-24 15:36:25+00:00 (#8366) + https://tg-archive.hyperdbg.org/2024-11.html#8366 +Nope, unfortunately HyperDbg only uses its custom protocol, not gdb stub. +https://tg-archive.hyperdbg.org/2024-11.html#8366 +Sun, 24 Nov 2024 15:36:25 +0000 +- +
+@HughEverett on 2024-11-24 15:35:26+00:00 (#8365) + https://tg-archive.hyperdbg.org/2024-11.html#8365 +Great. 👍 +https://tg-archive.hyperdbg.org/2024-11.html#8365 +Sun, 24 Nov 2024 15:35:26 +0000 +- +
+@HyperDbgBot on 2024-11-24 14:03:03+00:00 (#8364) + https://tg-archive.hyperdbg.org/2024-11.html#8364 +[discord] <adam235513> Did you ever thought to put a gdb server into it ? So one can easily attach with IDA? +https://tg-archive.hyperdbg.org/2024-11.html#8364 +Sun, 24 Nov 2024 14:03:03 +0000 +- +
+@HyperDbgBot on 2024-11-24 14:02:08+00:00 (#8363) + https://tg-archive.hyperdbg.org/2024-11.html#8363 +[discord] <adam235513> Thanks a lot +https://tg-archive.hyperdbg.org/2024-11.html#8363 +Sun, 24 Nov 2024 14:02:08 +0000 +- +
+@HyperDbgBot on 2024-11-24 14:02:05+00:00 (#8362) + https://tg-archive.hyperdbg.org/2024-11.html#8362 +[discord] <adam235513> Test trap works. Now I can attach to the process and break on a Windows API. +https://tg-archive.hyperdbg.org/2024-11.html#8362 +Sun, 24 Nov 2024 14:02:05 +0000 +- +
+@HughEverett on 2024-11-23 18:14:37+00:00 (#8361) + https://tg-archive.hyperdbg.org/2024-11.html#8361 +Sure thing. Let me know about the results. If it didn't work, probably there are other options like ignoring exceptions (using the !exception command). +https://tg-archive.hyperdbg.org/2024-11.html#8361 +Sat, 23 Nov 2024 18:14:37 +0000 +- +
+@HyperDbgBot on 2024-11-23 18:13:05+00:00 (#8360) + https://tg-archive.hyperdbg.org/2024-11.html#8360 +[discord] <adam235513> Ok, I will give it a try tomorrow. Thanks +https://tg-archive.hyperdbg.org/2024-11.html#8360 +Sat, 23 Nov 2024 18:13:05 +0000 +- +
+@HughEverett on 2024-11-23 18:11:43+00:00 (#8359) + https://tg-archive.hyperdbg.org/2024-11.html#8359 +If you need to disable intercepting traps (single stepping) like #DB, you could use this command: + +test trap off +https://tg-archive.hyperdbg.org/2024-11.html#8359 +Sat, 23 Nov 2024 18:11:43 +0000 +- +
+@HughEverett on 2024-11-23 18:10:41+00:00 (#8357) + https://tg-archive.hyperdbg.org/2024-11.html#8357 +You can disable triggering (intercepting breakpoints by HyperDbg) using this command: + +test breakpoint off +https://tg-archive.hyperdbg.org/2024-11.html#8357 +Sat, 23 Nov 2024 18:10:41 +0000 +- +
+@HyperDbgBot on 2024-11-23 18:10:10+00:00 (#8356) + https://tg-archive.hyperdbg.org/2024-11.html#8356 +[discord] <adam235513> Like a page guard is set on the memory page and hyprdbg is catching the exception +https://tg-archive.hyperdbg.org/2024-11.html#8356 +Sat, 23 Nov 2024 18:10:10 +0000 +- +
+@HyperDbgBot on 2024-11-23 18:09:45+00:00 (#8355) + https://tg-archive.hyperdbg.org/2024-11.html#8355 +[discord] <adam235513> Yes, exactly. After each instruction is executed it breaks. So hyperdbg becomes useless +https://tg-archive.hyperdbg.org/2024-11.html#8355 +Sat, 23 Nov 2024 18:09:45 +0000 +- +
+@HughEverett on 2024-11-23 18:08:54+00:00 (#8354) + https://tg-archive.hyperdbg.org/2024-11.html#8354 +What do you mean by "breaks HyperDbg"? Is it something like triggering infinite number of breakpoints? +https://tg-archive.hyperdbg.org/2024-11.html#8354 +Sat, 23 Nov 2024 18:08:54 +0000 +- +
+@HyperDbgBot on 2024-11-23 18:06:52+00:00 (#8353) + https://tg-archive.hyperdbg.org/2024-11.html#8353 +[discord] <adam235513> No, because it directly breaks in HyperDbg even when I don't launch it through hyperdbg. Can modify the code, already compiled it myself +https://tg-archive.hyperdbg.org/2024-11.html#8353 +Sat, 23 Nov 2024 18:06:52 +0000 +- +
+@HughEverett on 2024-11-23 18:06:20+00:00 (#8352) + https://tg-archive.hyperdbg.org/2024-11.html#8352 +Or another option that you have is putting some hooks in some APIs or system-calls and intercept it this way. It's probably a better approach. +https://tg-archive.hyperdbg.org/2024-11.html#8352 +Sat, 23 Nov 2024 18:06:20 +0000 +- +
+@HughEverett on 2024-11-23 18:05:21+00:00 (#8351) + https://tg-archive.hyperdbg.org/2024-11.html#8351 +It's actually possible but if you could modify the source code (and recompile HyperDbg), but could you run the PE and then attach to it? It would be easier. +https://tg-archive.hyperdbg.org/2024-11.html#8351 +Sat, 23 Nov 2024 18:05:21 +0000 +- +
+@HyperDbgBot on 2024-11-23 01:52:10+00:00 (#8350) + https://tg-archive.hyperdbg.org/2024-11.html#8350 +[discord] <adam235513> Yeah, it has TLS. Can I disable the behavior? It doesn't have to break at the EP. I can set a breakpoint on one of the Windows APIs +https://tg-archive.hyperdbg.org/2024-11.html#8350 +Sat, 23 Nov 2024 01:52:10 +0000 +- +
+@HughEverett on 2024-11-22 22:29:20+00:00 (#8349) + https://tg-archive.hyperdbg.org/2024-11.html#8349 +Once you press 'g' it stops at the PE entrypoint, unless there is an anti debugging method (maybe TLS?) that breaks the debugging? +https://tg-archive.hyperdbg.org/2024-11.html#8349 +Fri, 22 Nov 2024 22:29:20 +0000 +- +
+@HyperDbgBot on 2024-11-22 04:48:49+00:00 (#8348) + https://tg-archive.hyperdbg.org/2024-11.html#8348 +[discord] <adam235513> Hi, Im trying to debug a process with anti debug. So I thought I use HyperDbg to avoid being detecting. So when I start the process in the VM HyperDbg will directly break in the process. When I press `g` it will break on the next instruction ... Is there a way to disable the behavior or at least some kind of logging to see why HyperDbg is breaking ? Is it page guard?! +https://tg-archive.hyperdbg.org/2024-11.html#8348 +Fri, 22 Nov 2024 04:48:49 +0000 +- +
+@7975887634 on 2024-11-21 15:57:14+00:00 (#8347) + https://tg-archive.hyperdbg.org/2024-11.html#8347 ++ https://tg-archive.hyperdbg.org/2024-11.html#8347 +Thu, 21 Nov 2024 15:57:14 +0000 +- +
@333224414 on 2024-11-20 18:19:45+00:00 (#8346) + https://tg-archive.hyperdbg.org/2024-11.html#8346 +Amazing project! Keep it up! +https://tg-archive.hyperdbg.org/2024-11.html#8346 +Wed, 20 Nov 2024 18:19:45 +0000 +@HyperDbgChannel on 2024-11-20 15:55:34+00:00 (#8345) https://tg-archive.hyperdbg.org/2024-11.html#8345 @@ -286,469 +782,5 @@ https://docs.hyperdbg.org/commands/extension-commands/ioapichttps://tg-archive.hyperdbg.org/2024-11.html#8308 Wed, 13 Nov 2024 14:34:25 +0000 - -
-@6695510551 on 2024-11-13 14:34:09+00:00 (#8307) - https://tg-archive.hyperdbg.org/2024-11.html#8307 -no, it is 14900k -https://tg-archive.hyperdbg.org/2024-11.html#8307 -Wed, 13 Nov 2024 14:34:09 +0000 -- -
-@HughEverett on 2024-11-13 14:33:40+00:00 (#8306) - https://tg-archive.hyperdbg.org/2024-11.html#8306 -Okay, but on the Windows 10 where it didn't work. Is it a very old (before meltdown) processor? -https://tg-archive.hyperdbg.org/2024-11.html#8306 -Wed, 13 Nov 2024 14:33:40 +0000 -- -
-@6695510551 on 2024-11-13 14:32:25+00:00 (#8305) - https://tg-archive.hyperdbg.org/2024-11.html#8305 -Currently, it can work on Win11 -https://tg-archive.hyperdbg.org/2024-11.html#8305 -- Wed, 13 Nov 2024 14:32:25 +0000 -- -
-@6695510551 on 2024-11-13 14:26:01+00:00 (#8304) - https://tg-archive.hyperdbg.org/2024-11.html#8304 -Wait a moment, I'll try Win11 -https://tg-archive.hyperdbg.org/2024-11.html#8304 -Wed, 13 Nov 2024 14:26:01 +0000 -- -
-@6695510551 on 2024-11-13 14:25:40+00:00 (#8303) - https://tg-archive.hyperdbg.org/2024-11.html#8303 -Maybe you should try my exe -https://tg-archive.hyperdbg.org/2024-11.html#8303 -Wed, 13 Nov 2024 14:25:40 +0000 -- -
-@HughEverett on 2024-11-13 14:24:05+00:00 (#8302) - https://tg-archive.hyperdbg.org/2024-11.html#8302 -I test this code one hundred time, it's still valid on my system. It's really weird. -https://tg-archive.hyperdbg.org/2024-11.html#8302 -Wed, 13 Nov 2024 14:24:05 +0000 -- -
-@6695510551 on 2024-11-13 14:24:05+00:00 (#8301) - https://tg-archive.hyperdbg.org/2024-11.html#8301 -I switched to Win11 and tried again -https://tg-archive.hyperdbg.org/2024-11.html#8301 -Wed, 13 Nov 2024 14:24:05 +0000 -- -
-@HughEverett on 2024-11-13 14:23:14+00:00 (#8300) - https://tg-archive.hyperdbg.org/2024-11.html#8300 -🤔🤔 -https://tg-archive.hyperdbg.org/2024-11.html#8300 -Wed, 13 Nov 2024 14:23:14 +0000 -- -
-@6695510551 on 2024-11-13 14:22:22+00:00 (#8299) - https://tg-archive.hyperdbg.org/2024-11.html#8299 -photo_2024-11-13_14-22-22.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8299 -- Wed, 13 Nov 2024 14:22:22 +0000 -- -
-@HughEverett on 2024-11-13 14:22:00+00:00 (#8298) - https://tg-archive.hyperdbg.org/2024-11.html#8298 -Did you add _getch() to your code? -https://tg-archive.hyperdbg.org/2024-11.html#8298 -Wed, 13 Nov 2024 14:22:00 +0000 -- -
-@6695510551 on 2024-11-13 14:21:26+00:00 (#8297) - https://tg-archive.hyperdbg.org/2024-11.html#8297 -i do nothing -https://tg-archive.hyperdbg.org/2024-11.html#8297 -Wed, 13 Nov 2024 14:21:26 +0000 -- -
-@6695510551 on 2024-11-13 14:21:21+00:00 (#8296) - https://tg-archive.hyperdbg.org/2024-11.html#8296 -photo_2024-11-13_14-21-21.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8296 -- Wed, 13 Nov 2024 14:21:21 +0000 -- -
-@6695510551 on 2024-11-13 14:20:52+00:00 (#8295) - https://tg-archive.hyperdbg.org/2024-11.html#8295 -I just restarted the system in VMware -https://tg-archive.hyperdbg.org/2024-11.html#8295 -Wed, 13 Nov 2024 14:20:52 +0000 -- -
-@6695510551 on 2024-11-13 14:20:28+00:00 (#8294) - https://tg-archive.hyperdbg.org/2024-11.html#8294 -I don't know what happened -https://tg-archive.hyperdbg.org/2024-11.html#8294 -- Wed, 13 Nov 2024 14:20:28 +0000 -- -
-@6695510551 on 2024-11-13 14:15:19+00:00 (#8293) - https://tg-archive.hyperdbg.org/2024-11.html#8293 -let me try again -https://tg-archive.hyperdbg.org/2024-11.html#8293 -Wed, 13 Nov 2024 14:15:19 +0000 -- -
-@6695510551 on 2024-11-13 14:15:02+00:00 (#8292) - https://tg-archive.hyperdbg.org/2024-11.html#8292 -emmm..... -https://tg-archive.hyperdbg.org/2024-11.html#8292 -- Wed, 13 Nov 2024 14:15:02 +0000 -- -
-@6695510551 on 2024-11-13 14:06:29+00:00 (#8291) - https://tg-archive.hyperdbg.org/2024-11.html#8291 -Alternatively, I can rewrite a clean demo -https://tg-archive.hyperdbg.org/2024-11.html#8291 -Wed, 13 Nov 2024 14:06:29 +0000 -- -
-@6695510551 on 2024-11-13 14:06:11+00:00 (#8290) - https://tg-archive.hyperdbg.org/2024-11.html#8290 -of course -https://tg-archive.hyperdbg.org/2024-11.html#8290 -Wed, 13 Nov 2024 14:06:11 +0000 -- -
-@HughEverett on 2024-11-13 14:05:28+00:00 (#8289) - https://tg-archive.hyperdbg.org/2024-11.html#8289 -The only difference between your code and my code is that I commented the 'help' function. Could you add a '_getch()' before the help function and try it again? -https://tg-archive.hyperdbg.org/2024-11.html#8289 -Wed, 13 Nov 2024 14:05:28 +0000 -- -
-@HughEverett on 2024-11-13 14:04:25+00:00 (#8288) - https://tg-archive.hyperdbg.org/2024-11.html#8288 -photo_2024-11-13_14-04-25.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8288 -- Wed, 13 Nov 2024 14:04:25 +0000 -- -
-@HughEverett on 2024-11-13 14:04:25+00:00 (#8287) - https://tg-archive.hyperdbg.org/2024-11.html#8287 -photo_2024-11-13_14-04-25.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8287 -- Wed, 13 Nov 2024 14:04:25 +0000 -- -
-@6695510551 on 2024-11-13 14:00:21+00:00 (#8286) - https://tg-archive.hyperdbg.org/2024-11.html#8286 -😂 -https://tg-archive.hyperdbg.org/2024-11.html#8286 -Wed, 13 Nov 2024 14:00:21 +0000 -- -
-@6695510551 on 2024-11-13 14:00:08+00:00 (#8285) - https://tg-archive.hyperdbg.org/2024-11.html#8285 -Maybe we'll have to test it later, con't connect to github. -https://tg-archive.hyperdbg.org/2024-11.html#8285 -- Wed, 13 Nov 2024 14:00:08 +0000 -- -
-@6695510551 on 2024-11-13 13:54:22+00:00 (#8284) - https://tg-archive.hyperdbg.org/2024-11.html#8284 -There is no problem with using&for functions -https://tg-archive.hyperdbg.org/2024-11.html#8284 -Wed, 13 Nov 2024 13:54:22 +0000 -- -
-@6695510551 on 2024-11-13 13:53:58+00:00 (#8283) - https://tg-archive.hyperdbg.org/2024-11.html#8283 -I don't know how to say this -https://tg-archive.hyperdbg.org/2024-11.html#8283 -Wed, 13 Nov 2024 13:53:58 +0000 -- -
-@HughEverett on 2024-11-13 13:52:53+00:00 (#8282) - https://tg-archive.hyperdbg.org/2024-11.html#8282 -Why these two variables are the same? Is there any optimization? 😳 -https://tg-archive.hyperdbg.org/2024-11.html#8282 -Wed, 13 Nov 2024 13:52:53 +0000 -- -
-@6695510551 on 2024-11-13 13:52:04+00:00 (#8281) - https://tg-archive.hyperdbg.org/2024-11.html#8281 -photo_2024-11-13_13-52-04.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8281 -- Wed, 13 Nov 2024 13:52:04 +0000 -- -
-@HughEverett on 2024-11-13 13:51:56+00:00 (#8280) - https://tg-archive.hyperdbg.org/2024-11.html#8280 -Fixed? -https://tg-archive.hyperdbg.org/2024-11.html#8280 -Wed, 13 Nov 2024 13:51:56 +0000 -- -
-@6695510551 on 2024-11-13 13:51:24+00:00 (#8279) - https://tg-archive.hyperdbg.org/2024-11.html#8279 -🤣 -https://tg-archive.hyperdbg.org/2024-11.html#8279 -Wed, 13 Nov 2024 13:51:24 +0000 -- -
-@6695510551 on 2024-11-13 13:51:20+00:00 (#8278) - https://tg-archive.hyperdbg.org/2024-11.html#8278 -image_2024-11-13_21-51-19.png -https://tg-archive.hyperdbg.org/2024-11.html#8278 -- Wed, 13 Nov 2024 13:51:20 +0000 -- -
-@6695510551 on 2024-11-13 13:50:28+00:00 (#8277) - https://tg-archive.hyperdbg.org/2024-11.html#8277 -photo_2024-11-13_13-50-28.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8277 -- Wed, 13 Nov 2024 13:50:28 +0000 -- -
-@6695510551 on 2024-11-13 13:49:46+00:00 (#8276) - https://tg-archive.hyperdbg.org/2024-11.html#8276 -i test remove &, but I don't think this has anything to do with it -https://tg-archive.hyperdbg.org/2024-11.html#8276 -Wed, 13 Nov 2024 13:49:46 +0000 -- -
-@6695510551 on 2024-11-13 13:49:18+00:00 (#8275) - https://tg-archive.hyperdbg.org/2024-11.html#8275 -ok -https://tg-archive.hyperdbg.org/2024-11.html#8275 -Wed, 13 Nov 2024 13:49:18 +0000 -- -
-@HughEverett on 2024-11-13 13:48:54+00:00 (#8274) - https://tg-archive.hyperdbg.org/2024-11.html#8274 -Could you check it as well? -https://tg-archive.hyperdbg.org/2024-11.html#8274 -Wed, 13 Nov 2024 13:48:54 +0000 -- -
-@HughEverett on 2024-11-13 13:48:40+00:00 (#8273) - https://tg-archive.hyperdbg.org/2024-11.html#8273 -Because you're creating a reference to the address of the 'test'. It's not the address of the 'test'. Am I right? -https://tg-archive.hyperdbg.org/2024-11.html#8273 -Wed, 13 Nov 2024 13:48:40 +0000 -- -
-@HughEverett on 2024-11-13 13:48:04+00:00 (#8272) - https://tg-archive.hyperdbg.org/2024-11.html#8272 -I mean I removed the the '&'. -https://tg-archive.hyperdbg.org/2024-11.html#8272 -Wed, 13 Nov 2024 13:48:04 +0000 -- -
-@HughEverett on 2024-11-13 13:47:53+00:00 (#8271) - https://tg-archive.hyperdbg.org/2024-11.html#8271 -Other than that, shouldn't it be like this? -https://tg-archive.hyperdbg.org/2024-11.html#8271 -- Wed, 13 Nov 2024 13:47:53 +0000 -- -
-@6695510551 on 2024-11-13 13:47:38+00:00 (#8270) - https://tg-archive.hyperdbg.org/2024-11.html#8270 -ok, i do it now -https://tg-archive.hyperdbg.org/2024-11.html#8270 -Wed, 13 Nov 2024 13:47:38 +0000 -- -
-@HughEverett on 2024-11-13 13:47:03+00:00 (#8269) - https://tg-archive.hyperdbg.org/2024-11.html#8269 -You can remove your modifications and recompile HyperDbg. -https://tg-archive.hyperdbg.org/2024-11.html#8269 -Wed, 13 Nov 2024 13:47:03 +0000 -- -
-@6695510551 on 2024-11-13 13:46:30+00:00 (#8268) - https://tg-archive.hyperdbg.org/2024-11.html#8268 -Perhaps I accidentally modified the hyperhv code -https://tg-archive.hyperdbg.org/2024-11.html#8268 -Wed, 13 Nov 2024 13:46:30 +0000 -- -
-@HughEverett on 2024-11-13 13:46:22+00:00 (#8267) - https://tg-archive.hyperdbg.org/2024-11.html#8267 -It's probably because at some points the pCode is no longer valid. -https://tg-archive.hyperdbg.org/2024-11.html#8267 -Wed, 13 Nov 2024 13:46:22 +0000 -- -
-@6695510551 on 2024-11-13 13:45:41+00:00 (#8266) - https://tg-archive.hyperdbg.org/2024-11.html#8266 -Yes, I think so too -https://tg-archive.hyperdbg.org/2024-11.html#8266 -Wed, 13 Nov 2024 13:45:41 +0000 -- -
-@HughEverett on 2024-11-13 13:45:17+00:00 (#8265) - https://tg-archive.hyperdbg.org/2024-11.html#8265 -I think the problem is not because of HyperDbg as it works for me. -https://tg-archive.hyperdbg.org/2024-11.html#8265 -Wed, 13 Nov 2024 13:45:17 +0000 -- -
-@HughEverett on 2024-11-13 13:44:59+00:00 (#8264) - https://tg-archive.hyperdbg.org/2024-11.html#8264 -photo_2024-11-13_13-44-59.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8264 -- Wed, 13 Nov 2024 13:44:59 +0000 -- -
-@HughEverett on 2024-11-13 13:44:59+00:00 (#8263) - https://tg-archive.hyperdbg.org/2024-11.html#8263 -photo_2024-11-13_13-44-59.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8263 -- Wed, 13 Nov 2024 13:44:59 +0000 -- -
-@6695510551 on 2024-11-13 13:44:15+00:00 (#8262) - https://tg-archive.hyperdbg.org/2024-11.html#8262 -Can you reproduce this phenomenon? -https://tg-archive.hyperdbg.org/2024-11.html#8262 -Wed, 13 Nov 2024 13:44:15 +0000 -- -
-@6695510551 on 2024-11-13 13:40:17+00:00 (#8261) - https://tg-archive.hyperdbg.org/2024-11.html#8261 -I don't think it has anything to do with functions -https://tg-archive.hyperdbg.org/2024-11.html#8261 -Wed, 13 Nov 2024 13:40:17 +0000 -- -
-@HughEverett on 2024-11-13 13:40:06+00:00 (#8260) - https://tg-archive.hyperdbg.org/2024-11.html#8260 -Thanks, lemme check it -https://tg-archive.hyperdbg.org/2024-11.html#8260 -Wed, 13 Nov 2024 13:40:06 +0000 -- -
-@6695510551 on 2024-11-13 13:39:51+00:00 (#8259) - https://tg-archive.hyperdbg.org/2024-11.html#8259 -int main() -{ - { - BYTE* pCode = (BYTE*)&test; - cout << "pid:0x" << std::hex << GetCurrentProcessId() << ", proc:0x" << (PVOID)pCode << endl; - help(); - } -https://tg-archive.hyperdbg.org/2024-11.html#8259 -Wed, 13 Nov 2024 13:39:51 +0000 -- -
-@6695510551 on 2024-11-13 13:39:39+00:00 (#8258) - https://tg-archive.hyperdbg.org/2024-11.html#8258 -int test() -{ - cout << "\tinput text, and messagebox" << endl; - string str; - cin >> str; - return MessageBoxA(0, str.c_str(), 0, 0); -} -https://tg-archive.hyperdbg.org/2024-11.html#8258 -Wed, 13 Nov 2024 13:39:39 +0000 -- -
-@HughEverett on 2024-11-13 13:39:28+00:00 (#8257) - https://tg-archive.hyperdbg.org/2024-11.html#8257 -test() and main() -https://tg-archive.hyperdbg.org/2024-11.html#8257 -Wed, 13 Nov 2024 13:39:28 +0000 -- -
-@6695510551 on 2024-11-13 13:39:15+00:00 (#8256) - https://tg-archive.hyperdbg.org/2024-11.html#8256 -functions? -https://tg-archive.hyperdbg.org/2024-11.html#8256 -Wed, 13 Nov 2024 13:39:15 +0000 -- -
-@HughEverett on 2024-11-13 13:38:40+00:00 (#8255) - https://tg-archive.hyperdbg.org/2024-11.html#8255 -I'm gonna test it. -https://tg-archive.hyperdbg.org/2024-11.html#8255 -Wed, 13 Nov 2024 13:38:40 +0000 -- -
-@HughEverett on 2024-11-13 13:38:34+00:00 (#8254) - https://tg-archive.hyperdbg.org/2024-11.html#8254 -Could you please copy-paste these two functions here? -https://tg-archive.hyperdbg.org/2024-11.html#8254 -Wed, 13 Nov 2024 13:38:34 +0000 -- -
-@6695510551 on 2024-11-13 13:37:59+00:00 (#8253) - https://tg-archive.hyperdbg.org/2024-11.html#8253 -photo_2024-11-13_13-37-59.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8253 -- Wed, 13 Nov 2024 13:37:59 +0000 -- -
-@HughEverett on 2024-11-13 13:37:12+00:00 (#8252) - https://tg-archive.hyperdbg.org/2024-11.html#8252 -what is &test? -https://tg-archive.hyperdbg.org/2024-11.html#8252 -Wed, 13 Nov 2024 13:37:12 +0000 -- -
-@6695510551 on 2024-11-13 13:35:57+00:00 (#8251) - https://tg-archive.hyperdbg.org/2024-11.html#8251 -this is my demo -https://tg-archive.hyperdbg.org/2024-11.html#8251 -Wed, 13 Nov 2024 13:35:57 +0000 -- -
-@6695510551 on 2024-11-13 13:35:44+00:00 (#8250) - https://tg-archive.hyperdbg.org/2024-11.html#8250 -photo_2024-11-13_13-35-44.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8250 -- Wed, 13 Nov 2024 13:35:44 +0000 -- -
-@HughEverett on 2024-11-13 13:34:38+00:00 (#8249) - https://tg-archive.hyperdbg.org/2024-11.html#8249 -Is there any anti-debugging method in your target application that leads to this behavior? -https://tg-archive.hyperdbg.org/2024-11.html#8249 -Wed, 13 Nov 2024 13:34:38 +0000 -- -
-@HughEverett on 2024-11-13 13:34:05+00:00 (#8248) - https://tg-archive.hyperdbg.org/2024-11.html#8248 -photo_2024-11-13_13-34-05.jpg -https://tg-archive.hyperdbg.org/2024-11.html#8248 -- Wed, 13 Nov 2024 13:34:05 +0000 -- -
-@HughEverett on 2024-11-13 13:33:49+00:00 (#8247) - https://tg-archive.hyperdbg.org/2024-11.html#8247 -I test it with a custom application: -https://tg-archive.hyperdbg.org/2024-11.html#8247 -- Wed, 13 Nov 2024 13:33:49 +0000 -- -
diff --git a/media/8383.jpg b/media/8383.jpg new file mode 100644 index 0000000..84bb2f4 Binary files /dev/null and b/media/8383.jpg differ diff --git a/media/8384.jpg b/media/8384.jpg new file mode 100644 index 0000000..364776a Binary files /dev/null and b/media/8384.jpg differ diff --git a/media/8390.webm b/media/8390.webm new file mode 100644 index 0000000..395f80c Binary files /dev/null and b/media/8390.webm differ diff --git a/media/8393.jpg b/media/8393.jpg new file mode 100644 index 0000000..6d9a0e0 Binary files /dev/null and b/media/8393.jpg differ diff --git a/media/8394.jpg b/media/8394.jpg new file mode 100644 index 0000000..e0b5aea Binary files /dev/null and b/media/8394.jpg differ diff --git a/media/8405.mp4 b/media/8405.mp4 new file mode 100644 index 0000000..31e7c76 Binary files /dev/null and b/media/8405.mp4 differ diff --git a/media/avatar_1733253460.jpg b/media/avatar_1733253460.jpg new file mode 100644 index 0000000..ed19353 Binary files /dev/null and b/media/avatar_1733253460.jpg differ diff --git a/media/avatar_5433182769.jpg b/media/avatar_5433182769.jpg new file mode 100644 index 0000000..81dcb22 Binary files /dev/null and b/media/avatar_5433182769.jpg differ diff --git a/media/avatar_7472564726.jpg b/media/avatar_7472564726.jpg new file mode 100644 index 0000000..bc88fd5 Binary files /dev/null and b/media/avatar_7472564726.jpg differ diff --git a/media/avatar_791790197.jpg b/media/avatar_791790197.jpg new file mode 100644 index 0000000..64f0908 Binary files /dev/null and b/media/avatar_791790197.jpg differ diff --git a/media/thumb_8383.jpg b/media/thumb_8383.jpg new file mode 100644 index 0000000..d2fb239 Binary files /dev/null and b/media/thumb_8383.jpg differ diff --git a/media/thumb_8384.jpg b/media/thumb_8384.jpg new file mode 100644 index 0000000..02d0b2a Binary files /dev/null and b/media/thumb_8384.jpg differ diff --git a/media/thumb_8393.jpg b/media/thumb_8393.jpg new file mode 100644 index 0000000..ca17f74 Binary files /dev/null and b/media/thumb_8393.jpg differ diff --git a/media/thumb_8394.jpg b/media/thumb_8394.jpg new file mode 100644 index 0000000..4cffff0 Binary files /dev/null and b/media/thumb_8394.jpg differ@6695510551 on 2024-11-13 13:31:20+00:00 (#8246) - https://tg-archive.hyperdbg.org/2024-11.html#8246 -👍 -https://tg-archive.hyperdbg.org/2024-11.html#8246 -Wed, 13 Nov 2024 13:31:20 +0000 -
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2024
-
+
2020
-
+
+
+
+
+
+
\ No newline at end of file
diff --git a/index.atom b/index.atom
index 83af826..d337509 100644
--- a/index.atom
+++ b/index.atom
@@ -2,14 +2,572 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+ + @hyperdbg / + Public archive of HyperDbg Telegram messages. +
+-
+
+
-
+
+
