Skip to content

Commit a6f841c

Browse files
authored
v0.18
Merge pull request HyperDbg#566 from HyperDbg/dev
2 parents 5462d69 + 0638660 commit a6f841c

67 files changed

Lines changed: 3267 additions & 899 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.gitmodules

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
1-
[submodule "hyperdbg/dependencies/zydis"]
2-
path = hyperdbg/dependencies/zydis
3-
url = https://github.com/HyperDbg/zydis.git
41
[submodule "hyperdbg/dependencies/pdbex"]
52
path = hyperdbg/dependencies/pdbex
63
url = https://github.com/HyperDbg/pdbex.git
@@ -13,3 +10,6 @@
1310
[submodule "hyperdbg/dependencies/ia32-doc"]
1411
path = hyperdbg/dependencies/ia32-doc
1512
url = https://github.com/HyperDbg/ia32-doc.git
13+
[submodule "hyperdbg/dependencies/zydis"]
14+
path = hyperdbg/dependencies/zydis
15+
url = https://github.com/HyperDbg/zydis.git

CHANGELOG.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

7+
## [0.18.0.0] - 2026-02-16
8+
New release of the HyperDbg Debugger.
9+
10+
### Added
11+
- Script engine now supports writing libraries using the '#include' keyword thanks to [@xmaple555](https://github.com/xmaple555) ([link](https://docs.hyperdbg.org/commands/scripting-language/casting-and-inclusion))([link](https://github.com/HyperDbg/HyperDbg/issues/557))([link](https://github.com/HyperDbg/HyperDbg/pull/561))
12+
- Initial codes for the hypertrace project by using Intel Last Branch Record (LBR) and Branch Trace Store (BTS) thanks to [@harimishal1](https://github.com/harimishal1) ([link](https://github.com/HyperDbg/HyperDbg/tree/master/hyperdbg/hypertrace))
13+
- The hypertrace project is now linked to the hyperkd
14+
- Initial efforts to port HyperDbg to Linux have started thanks to [@Alish14](https://github.com/Alish14) ([link](https://github.com/HyperDbg/HyperDbg/pull/563))
15+
16+
### Changed
17+
- Fix bugs for interpreting 'db_pa, 'dd_pa', 'eb_pa', and 'ed_pa' keywords in the script engine ([link](https://docs.hyperdbg.org/commands/scripting-language/assumptions-and-evaluations#keywords))([link](https://github.com/HyperDbg/HyperDbg/pull/507))
18+
- Fix variable types in the script engine ([link](https://github.com/HyperDbg/HyperDbg/commit/43b0245fa11b5c73ce4cd21d8b8787b86a05f89d))
19+
- Fix and update array index for boolean expressions in the script engine ([link](https://github.com/HyperDbg/HyperDbg/commit/ba2cec3c12c3ff45ddc0004051884983ff62a0b3))
20+
- Fix and update array index for boolean expressions in the script engine ([link](https://github.com/HyperDbg/HyperDbg/commit/ba2cec3c12c3ff45ddc0004051884983ff62a0b3))
21+
- Fix compilation error in Zydis with the new Windows WDK ([link](https://github.com/HyperDbg/zydis/commit/e61f59332ce49f8853006573ca853e404fafdd08))
22+
723
## [0.17.0.0] - 2025-11-10
824
New release of the HyperDbg Debugger. All credit for this release goes to [@xmaple555](https://github.com/xmaple555).
925

CONTRIBUTING.md

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,15 @@ Please make sure to create a [discussion](https://github.com/orgs/HyperDbg/discu
1313
- Troubleshooting problems with running on Hyper-V's nested virtualization.
1414
- Troubleshooting problems with running on VirtualBox's nested virtualization.
1515
- Supporting KDNET (sending data over the network).
16-
- Enhancing HyperDbg's [Transparent Mode](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes#transparent-mode), especially for anti-hypervisor methods.
16+
- Enhancing HyperDbg's [Transparent Mode](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes#transparent-mode). These features should be added as an extension to the [HyperEvade](https://www.vusec.net/projects/hyperevade/) project (e.g., by bypassing [al-khaser](https://github.com/LordNoteworthy/al-khaser) and similar anti-debugging and anti-hypervisor projects).
1717
- Enhancing and adding more features to the ['.pe'](https://docs.hyperdbg.org/commands/meta-commands/.pe) command.
1818
- Adding HyperDbg to the system startup using UEFI.
19-
- Adding routines to activate and use Last Branch Record (LBR) and Branch Trace Store (BTS).
19+
- Adding routines to activate and use Last Branch Record (LBR) and Branch Trace Store (BTS) | (In progress).
2020
- Creating a QT-based GUI.
2121
- Creating a SoftICE-style GUI.
2222
- Supporting nested-virtualization on HyperDbg itself.
2323
- Protecting HyperDbg code and memory from modification using VT-x capabilities.
24-
- Adding support for the Intel Processor Trace (PT).
24+
- Adding support for the Intel Processor Trace (PT) and event command for detecting coverage.
2525
- Creating a wrapper that automatically interprets the [HyperDbg SDK](https://github.com/HyperDbg/HyperDbg/tree/master/hyperdbg/include/SDK) to GO, RUST, C#, Python, etc.
2626
- Creating syntax highlighting for dslang for different IDEs (VSCode, VIM, etc.).
2727
- Building HyperDbg using LLVM clang.
@@ -33,23 +33,21 @@ Please make sure to create a [discussion](https://github.com/orgs/HyperDbg/discu
3333
- Working on live memory migration and adding support for kernel-mode time travel debugging.
3434
- Integrating the [z3 project](https://github.com/Z3Prover/z3) into HyperDbg and adding commands based on the z3 solver.
3535
- Adding the [Bochs emulator](https://github.com/bochs-emu/Bochs) to HyperDbg.
36-
- ~~Creating commands to inspect and read details of PCIe devices.~~ Added: [<a href="https://docs.hyperdbg.org/commands/extension-commands/pcitree" target="_blank">link</a>][<a href="https://docs.hyperdbg.org/commands/extension-commands/pcicam" target="_blank">link</a>]
37-
- ~~Mitigating the anti-hypervisor method described [here](https://howtohypervise.blogspot.com/2019/01/a-common-missight-in-most-hypervisors.html).~~ [[Fixed](https://github.com/HyperDbg/HyperDbg/pull/497)]
3836
- Creating different examples of how to use the SDK (using different programming languages).
3937
- Debugging and fixing bugs related to HyperDbg's physical serial communication.
4038
- Reading symbol information from modules in memory (currently, HyperDbg opens a file which continues the debugger).
4139
- Adding APIC virtualization.
4240
- Reading the list of modules for the '[lm](https://docs.hyperdbg.org/commands/debugging-commands/lm)' command directly from kernel-mode.
4341
- Detecting and fixing anti-hypervisor methods described [here](https://github.com/Ahora57/MAJESTY-technologies).
4442
- Investigating why the symbols parser (DIA SDK) could not read symbols of the 'kernel32!*'.
45-
- ~~Fixing the problem with [XSETBV instruction freezing](https://github.com/HyperDbg/HyperDbg/issues/429).~~ [[Fixed](https://github.com/HyperDbg/HyperDbg/pull/491)]
46-
- Adding an event function that detects coverage.
47-
- Bypassing [al-khaser](https://github.com/LordNoteworthy/al-khaser).
4843
- Creating the 'alias' command that converts or registers scripts as a command, for example: "alias !list .script list.dbg" (discussion needed).
4944
- Adding support for [Hardware Performance Counters (HPC)](https://en.wikipedia.org/wiki/Hardware_performance_counter).
50-
5145
- Any other interesting tasks you might find!
5246

47+
- ~~Creating commands to inspect and read details of PCIe devices.~~ Added: [<a href="https://docs.hyperdbg.org/commands/extension-commands/pcitree" target="_blank">link</a>][<a href="https://docs.hyperdbg.org/commands/extension-commands/pcicam" target="_blank">link</a>]
48+
- ~~Mitigating the anti-hypervisor method described [here](https://howtohypervise.blogspot.com/2019/01/a-common-missight-in-most-hypervisors.html).~~ [[Fixed](https://github.com/HyperDbg/HyperDbg/pull/497)]
49+
- ~~Fixing the problem with [XSETBV instruction freezing](https://github.com/HyperDbg/HyperDbg/issues/429).~~ [[Fixed](https://github.com/HyperDbg/HyperDbg/pull/491)]
50+
5351
This list will be updated frequently.
5452

5553
## Fixing Bugs

README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
# HyperDbg Debugger
1010

1111
<a href="https://hyperdbg.org/"><img align="right" width="150" height="150" src="https://github.com/HyperDbg/graphics/raw/master/Art%20Board/HyperDbg-Cat.Circle.Compressed.png" alt="HyperDbg Debugger"></a></br>
12-
**HyperDbg Debugger** is a free (as in free beer and freedom), open-source, community-driven, hypervisor-assisted, user-mode, and kernel-mode Windows debugger with a focus on using modern hardware technologies. It is a debugger designed for analyzing, fuzzing, and reversing.
12+
**HyperDbg Debugger** is a free (as in free beer), open-source, community-driven, hypervisor-assisted, user-mode, and kernel-mode Windows debugger with a focus on using modern hardware technologies. It is a debugger designed for analyzing, fuzzing, and reversing.
1313

1414
You can follow **HyperDbg** on **[Twitter](https://twitter.com/HyperDbg)** or **[Mastodon](https://infosec.exchange/@hyperdbg)** to get notified about new releases, or join any of the HyperDbg groups, where you can ask developers and open-source reversing enthusiasts for help setting up and using HyperDbg.
1515

@@ -150,6 +150,7 @@ You can also read [this article](https://research.hyperdbg.org/debugger/kernel-d
150150
* Triggering and Counting System Management Mode (SMM) Interrupts (SMIs) [<a href="https://docs.hyperdbg.org/commands/extension-commands/smi" target="_blank">link</a>]
151151
* Attaching to the User-mode Process and Preventing Execution [<a href="https://docs.hyperdbg.org/commands/meta-commands/.attach" target="_blank">link</a>]
152152
* Intercepting Execution of XSETBV Instructions [<a href="https://docs.hyperdbg.org/commands/extension-commands/xsetbv" target="_blank">link</a>]
153+
* Writing Library Script Files [<a href="https://docs.hyperdbg.org/commands/scripting-language/casting-and-inclusion" target="_blank">link</a>]
153154

154155
## How does it work?
155156

hyperdbg/hyperdbg.sln

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "imports", "imports", "{B3D9
8787
EndProject
8888
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hyperkd", "hyperkd\hyperkd.vcxproj", "{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}"
8989
ProjectSection(ProjectDependencies) = postProject
90+
{9FA45E25-DAEB-4C2D-806C-7908A180195D} = {9FA45E25-DAEB-4C2D-806C-7908A180195D}
9091
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D} = {AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}
9192
{BB17323A-2460-4AE1-8AFE-B367400B934F} = {BB17323A-2460-4AE1-8AFE-B367400B934F}
9293
EndProjectSection
@@ -97,6 +98,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "modules", "modules", "{13E4
9798
ProjectSection(SolutionItems) = preProject
9899
include\SDK\modules\HyperEvade.h = include\SDK\modules\HyperEvade.h
99100
include\SDK\Modules\HyperLog.h = include\SDK\Modules\HyperLog.h
101+
include\SDK\modules\HyperTrace.h = include\SDK\modules\HyperTrace.h
100102
include\SDK\Modules\VMM.h = include\SDK\Modules\VMM.h
101103
EndProjectSection
102104
EndProject
@@ -145,13 +147,15 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "kernel", "kernel", "{D0E5A2
145147
EndProject
146148
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{6498728B-D9B0-4CAB-A9E3-ACE5BC371010}"
147149
ProjectSection(SolutionItems) = preProject
148-
include\platform\kernel\code\Mem.c = include\platform\kernel\code\Mem.c
150+
include\platform\kernel\code\PlatformMem.c = include\platform\kernel\code\PlatformMem.c
149151
EndProjectSection
150152
EndProject
151153
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{AA41FFF1-A730-433E-8D26-13DA5B653825}"
152154
ProjectSection(SolutionItems) = preProject
153155
include\platform\kernel\header\Environment.h = include\platform\kernel\header\Environment.h
154-
include\platform\kernel\header\Mem.h = include\platform\kernel\header\Mem.h
156+
include\platform\kernel\header\PlatformMem.h = include\platform\kernel\header\PlatformMem.h
157+
include\platform\kernel\header\PlatformModuleInfo.h = include\platform\kernel\header\PlatformModuleInfo.h
158+
include\platform\kernel\header\PlatformTypes.h = include\platform\kernel\header\PlatformTypes.h
155159
EndProjectSection
156160
EndProject
157161
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{4BF590C3-1032-4DD2-BF87-BB9E5781977C}"
@@ -173,6 +177,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "kernel", "kernel", "{947577
173177
include\SDK\imports\kernel\HyperDbgHyperEvade.h = include\SDK\imports\kernel\HyperDbgHyperEvade.h
174178
include\SDK\Imports\Kernel\HyperDbgHyperLogImports.h = include\SDK\Imports\Kernel\HyperDbgHyperLogImports.h
175179
include\SDK\Imports\Kernel\HyperDbgHyperLogIntrinsics.h = include\SDK\Imports\Kernel\HyperDbgHyperLogIntrinsics.h
180+
include\SDK\imports\kernel\HyperDbgHyperTrace.h = include\SDK\imports\kernel\HyperDbgHyperTrace.h
176181
include\SDK\Imports\Kernel\HyperDbgVmmImports.h = include\SDK\Imports\Kernel\HyperDbgVmmImports.h
177182
EndProjectSection
178183
EndProject
@@ -214,6 +219,9 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hyperdbg_app", "..\examples
214219
EndProjectSection
215220
EndProject
216221
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hyperevade", "hyperevade\hyperevade.vcxproj", "{B226530A-14B1-40AC-B82E-D9057400E7EE}"
222+
ProjectSection(ProjectDependencies) = postProject
223+
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D} = {AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}
224+
EndProjectSection
217225
EndProject
218226
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "hyper-v", "hyper-v", "{02EA681E-C7D8-13C7-8484-4AC65E1B71E8}"
219227
ProjectSection(SolutionItems) = preProject
@@ -226,6 +234,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "config", "config", "{035508
226234
include\config\Definition.h = include\config\Definition.h
227235
EndProjectSection
228236
EndProject
237+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hypertrace", "hypertrace\hypertrace.vcxproj", "{9FA45E25-DAEB-4C2D-806C-7908A180195D}"
238+
EndProject
229239
Global
230240
GlobalSection(SolutionConfigurationPlatforms) = preSolution
231241
debug|x64 = debug|x64
@@ -279,6 +289,10 @@ Global
279289
{B226530A-14B1-40AC-B82E-D9057400E7EE}.debug|x64.Build.0 = debug|x64
280290
{B226530A-14B1-40AC-B82E-D9057400E7EE}.release|x64.ActiveCfg = release|x64
281291
{B226530A-14B1-40AC-B82E-D9057400E7EE}.release|x64.Build.0 = release|x64
292+
{9FA45E25-DAEB-4C2D-806C-7908A180195D}.debug|x64.ActiveCfg = debug|x64
293+
{9FA45E25-DAEB-4C2D-806C-7908A180195D}.debug|x64.Build.0 = debug|x64
294+
{9FA45E25-DAEB-4C2D-806C-7908A180195D}.release|x64.ActiveCfg = release|x64
295+
{9FA45E25-DAEB-4C2D-806C-7908A180195D}.release|x64.Build.0 = release|x64
282296
EndGlobalSection
283297
GlobalSection(SolutionProperties) = preSolution
284298
HideSolutionNode = FALSE

hyperdbg/hyperevade/CMakeLists.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ set(SourceFiles
66
"code/UnloadDll.c"
77
"../include/components/spinlock/header/Spinlock.h"
88
"../include/platform/kernel/header/Environment.h"
9-
"../include/platform/kernel/header/Mem.h"
9+
"../include/platform/kernel/header/PlatformMem.h"
1010
"header/Logging.h"
1111
"header/pch.h"
1212
"header/UnloadDll.h"

hyperdbg/hyperevade/header/pch.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
//
7575
// Platform independent headers
7676
//
77-
#include "platform/kernel/header/Mem.h"
77+
#include "platform/kernel/header/PlatformMem.h"
7878

7979
//
8080
// Hyperevade Callbacks

hyperdbg/hyperevade/hyperevade.vcxproj

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@
107107
<ClCompile Include="..\include\components\optimizations\code\InsertionSort.c" />
108108
<ClCompile Include="..\include\components\optimizations\code\OptimizationsExamples.c" />
109109
<ClCompile Include="..\include\components\spinlock\code\Spinlock.c" />
110-
<ClCompile Include="..\include\platform\kernel\code\Mem.c" />
110+
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
111111
<ClCompile Include="code\SyscallFootprints.c" />
112112
<ClCompile Include="code\Transparency.c" />
113113
<ClCompile Include="code\UnloadDll.c" />
@@ -116,7 +116,7 @@
116116
<ItemGroup>
117117
<ClInclude Include="..\include\components\interface\HyperLogCallback.h" />
118118
<ClInclude Include="..\include\platform\kernel\header\Environment.h" />
119-
<ClInclude Include="..\include\platform\kernel\header\Mem.h" />
119+
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
120120
<ClInclude Include="header\SyscallFootprints.h" />
121121
<ClInclude Include="header\Transparency.h" />
122122
<ClInclude Include="header\pch.h" />

hyperdbg/hyperevade/hyperevade.vcxproj.filters

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
<ClCompile Include="code\UnloadDll.c">
4646
<Filter>code</Filter>
4747
</ClCompile>
48-
<ClCompile Include="..\include\platform\kernel\code\Mem.c">
48+
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c">
4949
<Filter>code\platform</Filter>
5050
</ClCompile>
5151
<ClCompile Include="..\hyperhv\code\components\registers\DebugRegisters.c">
@@ -86,7 +86,7 @@
8686
<ClInclude Include="..\include\platform\kernel\header\Environment.h">
8787
<Filter>header\platform</Filter>
8888
</ClInclude>
89-
<ClInclude Include="..\include\platform\kernel\header\Mem.h">
89+
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h">
9090
<Filter>header\platform</Filter>
9191
</ClInclude>
9292
<ClInclude Include="..\include\components\interface\HyperLogCallback.h">

0 commit comments

Comments
 (0)