Hello

I am using Workstation Pro 25H2
windows 11 as Gust
disable VBS and Hyper-V
using EfiGuard to patch

but when using this command ".debug prepare serial 115200 com1" directly BSOD with the error code DRIVER_IRQL_NOT_LESS_OR_EQUAL

I used Hyperdbg lasts beta also 0.18.1 same problem for both also try .connect local but when load vmm same issue

the processor is Intel Core i7

@HughEverett

Coming from github

Hey
What generation is your processor?

12th Gen Intel(R) Core(TM) i7

Could you also test v0.20-beta?
https://github.com/HyperDbg/HyperDbg/releases/tag/v0.20-beta

Already test both

0.20-beta
0.18.1

same problem

Could you connect to a windbg using kdnet? I might be able to help if I could have the results of '!analyze -v'.

Generally a 12 gen core processor should work unless there is a bug or the UEFI firmware behaves weirdly once configuring memory mapped regions.

I will try.

Also, before you try, could you please test the latest version of the 'dev' branch too? You can compile it using VS2026 but if you don't have Visual Studio setup, you can download the CI/CD artifacts from here:
https://github.com/HyperDbg/HyperDbg/actions/runs/28387577701

There is a small change in the loading of VMM which is fixed in the 'dev' branch, I suspect it might be the reason for the error.

I have the 2022 version and it does not have the full requirement

You can use github artifact files.

On it

I got this error when trying without disable the DSE

But after disable the same problem happened

this is the dev version

Okay, the only way is too know what is happening there. We need result of '!analyze -k' from windbg.

you want first to connect through windbg live mode

or use the crash memory dump ??

Windbg over kdnet is preferred.

Break instruction exception - code 80000003 (first chance)
Unable to load image hyperhv.dll, Win32 error 0n2
hyperhv+0x1299:
fffff800`44061299 cc int 3
0: kd> !analyze -k
Connected to Windows 10 26100 x64 target at (Wed Jul 1 15:48:55.460 2026 (UTC + 3:00)), ptr64 TRUE
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........
Loading User Symbols
.................................
Loading unloaded module list
.........
Unable to load image \??\C:\Users\jonny\Desktop\release\hyperhv.dll, Win32 error 0n2

Unknown option '-k'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 0000000000000000
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------

BUGCHECK_CODE: 0

BUGCHECK_P1: 0

BUGCHECK_P2: 0

BUGCHECK_P3: 0

BUGCHECK_P4: 0

PROCESS_NAME: hyperdbg-cli.exe

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.

SYMBOL_NAME: hyperhv+1299

MODULE_NAME: hyperhv

IMAGE_NAME: hyperhv.dll

FAILURE_BUCKET_ID: 0x0_hyperhv!unknown_function

FAILURE_ID_HASH: {c999474f-51ff-f2c4-4b94-1233318d2035}

Followup: MachineOwner
---------

Oh okay, this one is probably easy to understand (find) the error.

Since it is within the hyperhv module (not in a random place).

Could you please load the pdb files (pdb file of hyperhv) so windbg could map hyperhv+1299 to the function name.

SYMBOL_NAME: hyperhv!AsmVmxSaveState+29

MODULE_NAME: hyperhv

IMAGE_NAME: hyperhv.dll

STACK_COMMAND: .process /r /p 0xfffff802769cef00; .thread /r /p 0xffff9a8d0a7bd080 ; kb

BUCKET_ID_FUNC_OFFSET: 29

FAILURE_BUCKET_ID: 0x0_hyperhv!AsmVmxSaveState

now send the result of this in windbg:

u hyperhv!AsmVmxSaveState+29

1: kd> u hyperhv!AsmVmxSaveState+29
hyperhv!AsmVmxSaveState+0x29 [D:\a\HyperDbg\HyperDbg\hyperdbg\hyperhv\code\assembly\AsmVmxContextState.asm @ 39]:
fffff802`0dde1299 cc int 3
fffff802`0dde129a eb00 jmp hyperhv!AsmVmxRestoreState (fffff802`0dde129c)
hyperhv!AsmVmxRestoreState [D:\a\HyperDbg\HyperDbg\hyperdbg\hyperhv\code\assembly\AsmVmxContextState.asm @ 48]:
fffff802`0dde129c 4881c400010000 add rsp,100h
fffff802`0dde12a3 415f pop r15
fffff802`0dde12a5 415e pop r14
fffff802`0dde12a7 415d pop r13
fffff802`0dde12a9 415c pop r12
fffff802`0dde12ab 415b pop r11

and this:
hyperhv+1299

it should be the same ??

1: kd> u hyperhv+1299
hyperhv!AsmVmxSaveState+0x29 [D:\a\HyperDbg\HyperDbg\hyperdbg\hyperhv\code\assembly\AsmVmxContextState.asm @ 39]:
fffff802`0dde1299 cc int 3
fffff802`0dde129a eb00 jmp hyperhv!AsmVmxRestoreState (fffff802`0dde129c)
hyperhv!AsmVmxRestoreState [D:\a\HyperDbg\HyperDbg\hyperdbg\hyperhv\code\assembly\AsmVmxContextState.asm @ 48]:
fffff802`0dde129c 4881c400010000 add rsp,100h
fffff802`0dde12a3 415f pop r15
fffff802`0dde12a5 415e pop r14
fffff802`0dde12a7 415d pop r13
fffff802`0dde12a9 415c pop r12
fffff802`0dde12ab 415b pop r11

yes

okay, for some reasons 'VmxVirtualizeCurrentSystem' failed.

Could you put several DbgBreakPoint(); in these locations? I wanna see why it returns FALSE.

I think the code should be failed here, if that's the case, please put another breakpoint here and read the 'ErrorCode' so we could understand why you couldn't execute the VMLAUNCH instruction.

Feel free to use old versions (v0.18 source code with VS2022) to compile it.

Literally remote kernel debugging

Couldn't build it
Thank you for your time

👍

Hi
I used the dev version with windows 10 it works fine
the problem was with the windows 11.

Hi
Maybe the reason was Windows SDK

Hello @PrefetchW

Hi aramando

Thank you for the warm welcome ❤️

HyperDbg v0.21 is released! 🪐💫

This release includes numerous bug fixes, improved stability, and significant progress toward integrating Intel PT (Processor Trace) into HyperDbg.

Check it out:
https://github.com/HyperDbg/HyperDbg/releases/tag/v0.21

Does hyperdbg now support debugging using the intel pt mechanism?

It's not fully supported yet but just in case if you want to test it, you can use the following command:
!pt enable path "c:\programs\my exe file.exe" size 0x200000 core 3

But just keep in mind, other parameters of the '!pt' command are not yet done, only the 'enable' and the 'path' params are working.

Which is better for debugging a hypervisor driver, windbg or Visual studio?

does the hypervisor driver load dlls into the kernel space?

[discord] <unrustled.jimmies> what do you mean by windbg or visual studio?

as I understand it, the classic way to debug a driver is with windbg. But it is possible to debug directly in the visual studio window, as if it were a user application

AFAIK, their core debuggers are the same (they both use WinDbg routines embedded in the kernel).

Need to debug interrupts, faults, or exceptions? HyperDbg has plenty of commands to help!

Use !exception to intercept exceptions (the first 32 entries of the IDT) and !interrupt to intercept interrupts (IDT entries 32–255).

You can also step through ISR instructions, inspect the IDT with !idt, and explore the Local APIC and I/O APIC state in both xAPIC and x2APIC modes using !apic and !ioapic.

If you want to create (inject) artificial interrupts, HyperDbg provides a variety of functions for that as well.

Check it out:

!exception:
https://docs.hyperdbg.org/commands/extension-commands/exception

!interrupt:
https://docs.hyperdbg.org/commands/extension-commands/interrupt

!idt:
https://docs.hyperdbg.org/commands/extension-commands/idt

!apic:
https://docs.hyperdbg.org/commands/extension-commands/apic

!ioapic:
https://docs.hyperdbg.org/commands/extension-commands/ioapic

Functions:

- event_inject: https://docs.hyperdbg.org/commands/scripting-language/functions/events/event_inject

- event_inject_error_code: https://docs.hyperdbg.org/commands/scripting-language/functions/events/event_inject_error_code

it sucks ass. almost nobody does it

use windbg itself

and what about this part?

there is a problem with rdtsc - hyperdbg hanging.... But cpuid working is done. !msrwire and !ioin also cause problems.

@HughEverett

Is there any specific type of crash? or just it is hanging?

The output to the console goes non-stop... the command used in notepad.exe

I see, so technically you are flooding HyperDbg with events in which HyperDbg couldn't service a 'CTRL+C'. If it's the case, couldn't you use conditional statement (if else) to remove a certain number of generated events?

but...
!tsc stage post script{
if (strcmp($pname, "Notepad.exe") == 0) {
printf("TSC 1\n");
printf("RAX proccess: %x\n", @rax);
printf("RBX proccess: %x\n", @rbx);
printf("RCX proccess: %x\n", @rcx);
printf("RDX proccess: %x\n", @rdx);
printf("TSC 2\n");
printf("RAX proccess: %x\n", @rax);
printf("RBX proccess: %x\n", @rbx);
printf("RCX proccess: %x\n", @rcx);
printf("RDX proccess: %x\n", @rdx);
}
}
I already use the if then block to get tsc only for a specific exe...

cpuid is working fine:
!cpuid stage pre script{
if (strcmp($pname, "Notepad.exe") == 0) {
printf("CPUID 1\n");
printf("RAX proccess: %x\n", @rax);
printf("RBX proccess: %x\n", @rbx);
printf("RCX proccess: %x\n", @rcx);
printf("RDX proccess: %x\n", @rdx);
if (@rax==1) {@rax=0;}
printf("CPUID 2\n");
printf("RAX proccess: %x\n", @rax);
printf("RBX proccess: %x\n", @rbx);
printf("RCX proccess: %x\n", @rcx);
printf("RDX proccess: %x\n", @rdx);
}
}

The rate of execution of RDTSC/RDTSCP is usually very high.

and by default, even if you specify process ID it has a system-wide effect meaning that RDTSC/RDTSCP will cause VM-exit on all cores and all processes.

The problem with RDTSC/RDTSCP is that emulating them will cause a lot of trouble for the system sicne it breaks some of system's functionalities.

and for this case it will cause VM-exit on all processes and HyperDbg only filters it based on your provided PID (software filtering).

One suggestion that I have for this is that you can make it per process (create VM-exit only on that specific process while remaining without VM-exit on other processes). For implementing it this way, one option that you have is that you can use the same functionality that we have for the '!mode' command to filter based on CR3. Take a look at the implementation of the '!mode' command and use the same implementation to activate and deactivate RDTSC/RDTSCP exiting.

This way, only when CR3 is changed and reached to your target process, it activates RDTSC/RDTSCP exiting and once it context switches to another process, it won't cause VM-exit again.

I think if you look at the source code for the '!mode' command you'll understand how you could modify it but in case if you didn't understand any part feel free to send it here so I could help.

how would you catch tsc for a specific process (notepad.exe), and what command would you use?

I mean the idea is that we cause VM-exits for all Mov-to-CR3-exiting events, and once the target process is reached (at the change of the CR3), you can check for the process id (or process name) and decide whether to enable or disable RDTSC/P exiting from the control registers within VMCS.

If I say I need to track all rdtsc for notepad.exe, how can I do it without getting into the hypervisor code?

I think it needs hypervisor code modifications.

Otherwise it will cause VM-exit on all processes.

hey so I have this program that allocates a custom payload at the end of a mapped view that triggers a vmexit via cpuid and makes hyperdbg get stuck in vmx root mode because RIP is invalid (it's outside of the page).

the payload is inside of a mapped view allocated at 0x0000fffd0000 and the cpuid (which triggers the vmexit) is at 0x0000ffffffffe

i was unable to find a workaround to this. All I could do is just make the program not jump to that payload.
My question here was, is this worth even "fixing" or is it up to me, as the user, to find my own ways? (just like I described above)

thanks for your attention!

Hey,

I'm not sure if I understand the scenario. Are you trying to block the execution at a certain point and then depend on the continuation to the execution of a cpuid?

The cpuid executes -> VMExit handles it -> It can't go resume execution because the address pointed to by RIP is invalid

Result: hypervisor halts and never leaves vmx root mode

So you are changing the RIP?

I don't understand why CPUID handler should break the RIP.

It's not the CPUID handler, it's the VMExit handler that can't resume execution because the next instruction doesn't exist

I'll make an illustration, one sec

I see. But then it should a create a page-fault, and OS should handle it, not HyperDbg.

Yes, that's what should happen but the thing is, HyperDbg is unable to get back to non root so the OS handles the page fault

Is there any error or something? Like an unhandeled VM-exit after it happens?

yes

one moment ill replicate it

Because, VM-exit handler of CPUID as far as I remember doesn't have to do anything with the next instruction (but I might be wrong).

basically the processor performs its guest area checks and it throws an error

👍

A guest state invalid VM-exit?

sort of

wait im making the illustration

I tried to print the contents of RIP to show you it's invalid

this is the script I made to catch the malicious cpuid "!cpuid pid $arg1 script {
if (@eip > 0xffff0000)
{
printf("suspicious cpuid detected.\n");
pause();
}
}"

I assume it goes unhandled because it's a guest area check error

also forgot to mention

as a result it keeps trying to resume execution by incrementing RIP but fails infinitely

I see. Do you happen to have a PoC for generating such a behavior so we can test a HyperDbg patch based on the PoC? Ideally a small C code that could generate this behavior.

Sorry for the late response. I'm not home right now and I will work on it as soon as I can

This behavior comes from a program that's not mine

But sure I'll write a PoC

[discord] <unrustled.jimmies> [reply]: Yeah this looks like a hypervisor detection check where it switches the cpu to be in compatibility mode and execute a vmexit instruction at max eip so eip overflows per arch but hv just increments it as if it was a 64bit number.

"a program that's not mine", is it an anticheat?

no it's protected malware

[discord] <unrustled.jimmies> can you send me the bin?

you'll get a PoC just wait

That would be great. Thanks.

You know what? I'm thinking that the same behavior might happen in other conditional/non-conditional VM-exits too. 🤔

We could mitigate it for the CPUID but it might be a little bit overkill if we add checks to read the next running instruction in all VM-exits as it might add a considerable overhead to the VM-exit handler.

Or maybe even a better solution would be to make these checks whenever Invalid Guest State VM-exit is thrown.

@itshopelesshopeless

I made a patch for this. Could you test it and verify if it fixes the problem?
(Thanks to a community member for sending mentioning this solution ❤️)

https://github.com/HyperDbg/HyperDbg/commit/90c1513adb7a83bfb3a1f622130748b9deb2c34e

If you couldn't build it, you can use GitHub built artifacts here:

https://github.com/HyperDbg/HyperDbg/actions/runs/29527259427

sorry I couldn't write a PoC in time. I should've done that from the beginning

no problem. if you could just test this patch that would be fine too.

sure

thanks

it works

you mean the problem is solved?

yeah no halts

vm is resumed and the page fault exception gets caught

great

So, I worked on it a little. I thought that adding this check to all VM-exits (that require a VMRESUME) might be overkill and cause a performance penalty for a scenario that might only occur if anti-debugging or hypervisor evasion methods are present. To avoid incurring this cost by default in HyperDbg, I thought it might be better to move the mitigation for this technique to the HyperEvade project instead.

So, here it is, if you want to use it in the future, you could enable HyperEvade:

https://github.com/HyperDbg/HyperDbg/commit/14e7d88c3c05c5cde7d51c87b5ecd5d9ce5e5af5

That's great.

Hey all 👋 came across an issue similar to #30 (DRIVER_IRQL_NOT_LESS_OR_EQUAL when reading registers after a break in Debugger Mode) and managed to track it down and get it working on my setup, so I've opened a PR: https://github.com/HyperDbg/HyperDbg/pull/648 🙂

Hey,
Cool. I'll review it later today. 👍

And will come back to have if I have any question about this PR.

Okay, I went through this issue. First of all, thanks really. It was a really hidden problem, and I see now what you mean, so thanks for putting time and effort into fixing it. I merged your PR. However, I think it is more fundamental than we thought.

The problem is that we are using two references for 'regs'. I initially thought this might be a silly idea, as we could simply query the guest registers from the VMX code and completely remove the need for a second reference to the guest registers (just as you did). However, this assumption does not work in certain locations, such as !epthook2, which basically runs everything from VMX non-root mode. Because of this, I created another PR to remove the reference to the guest registers in the debugger (and also replaced some of your code). I believe this approach will prevent possible future errors since we will have only one place for storing and using registers and fundamentally solves this issue.

@HumbleMuns I would appreciate it if you could check and test this PR (merged into the dev branch) and tell me if it works (and fixes the problem) or not: https://github.com/HyperDbg/HyperDbg/commit/d37352fd7ee3b7c9a4a5383c847f210dc6c3d716

Yes, I would like to refine this approach into a stable model.

The core idea is not to let the reader determine which process is accessing the target page at read time. Instead, the reader should use a separate address translation path prepared in advance:

Target process VA
-> target guest PFN G0
-> EPT
-> fake host PFN F

Reader VA
-> alias guest PFN G1
-> EPT
-> original host PFN O

The most important point is that the reader’s PTE must not continue pointing to the target’s original guest PFN, G0. Once G0 has been redirected to the fake page through EPT, any access through G0 will also reach the fake page.

The reader must therefore point to a new alias guest PFN, G1, while EPT maps G1 to the real original backing page.

The proposed design is as follows.

1. Prepare an alias guest PFN for every payload page

The most stable option may be to allocate and lock one page of nonpaged physical memory and use it as a placeholder PFN.

For example:

G1 = guest PFN of the alias placeholder page

The original contents of this page are irrelevant. Its purpose is simply to provide a valid PFN that Windows and the reader’s PTE can reference.

2. Create two stable EPT mappings

G0 -> fake PFN, R/W/X
G1 -> original PFN, read-only, X=0, W=0

With this arrangement, the target process always sees the fake page and can read, write, and execute it without generating frequent traps.

The reader accesses only its own alias VA and therefore always sees the original page.

3. Modify the reader’s VA or PTE mapping

When the reader uses a fixed kernel virtual address:

reader_va PTE.PFN = G1

When the reader dynamically maps physical pages, the mapping path must be modified so that it maps G1 instead of G0.

4. Handle synchronization correctly

After modifying the reader’s PTE, the TLB entry for the reader’s virtual address must be invalidated.

After changing EPT mappings, INVEPT must be performed.

The cache type must also remain consistent with the original page. The same host physical page should not be aliased through incompatible memory-cache attributes.

5. The following validation matrix must pass

Target reads G0 -> fake page
Target writes G0 -> fake page
Target executes G0 -> fake page
Reader reads reader_va/G1 -> original page
High-frequency reader access -> no increase in EPT violations
Target writes do not modify the original page

Failure handling should also be strict. If the reader alias cannot be created, or if the reader is detected pointing to G0 again, the system must not report that initialization completed successfully.

Once the reader’s PTE points to G0, EPT will redirect its access to the fake page as well.

In summary, EPT provides two fixed mappings:

G0 -> fake
G1 -> original

The reader is separated through its PTE or mapping path:

The reader never accesses G0. It accesses only G1.

This should be more suitable for high-frequency access than switching EPTPs or handling every read through EPT violations.

Could experienced developers please comment on whether this design is realistically implementable?

This proposed solution was generated with the help of AI, so I would especially appreciate feedback about any incorrect assumptions involving Windows PFN management, PTE modification, EPT aliasing, TLB invalidation, cache attributes, or page lifetime management.

My actual goal is to make a particular kernel module always receive a specified value when it reads a certain memory address, while normal execution, reads, and writes through that memory address continue to observe a different value.

I am not looking for a design that triggers an EPT violation on every access. In my current high-frequency scenario, trap-based EPT handling causes severe performance problems and may freeze the system. The requirement is therefore a stable dual-view mapping with no per-read trapping on the normal access path.

@HughEverett Help me out, pro.

your message is longer than my physics exam lecture

Tested your dev commit on bare metal (Intel 9th gen, Win11 24H2, serial debugger mode). Break then r now returns the registers fine, no more 0xD1, and g continues cleanly too. Confirmed fixed on my hardware. Thanks for sorting it so quick, and nice call collapsing it down to one reg reference.

HyperDbg v0.22 is released! 💫

Apart from bringing bug fixes, major progress toward porting HyperDbg for #Linux, HyperDbg now supports structures in the script engine.

This version also introduces new commands to display linked lists.

Check it out:
https://github.com/HyperDbg/HyperDbg/releases/tag/v0.22

For more information,

Check structures in the script engine:
https://docs.hyperdbg.org/commands/scripting-language/structures-and-arrays#structures

displaying linked lists in the virtual memory:
https://docs.hyperdbg.org/commands/debugging-commands/dl

And physical memory:
https://docs.hyperdbg.org/commands/extension-commands/dl

I'll get back to you later today.

great. thanks

This release wouldn't have been possible without the help and outstanding work of @xmaple555, @maxraulea, @Ablfzl4m , and @HumbleMuns .

Thanks, Sina, for giving me this opportunity.❤🙏

Thanks to you for all your great works ❤️

I read this idea; honestly, I'm not sure if I understand it quite accurately. In case you want to have a page with Execute-only permissions while providing read and write access to a different value, isn't that the same as what HyperDbg does with '!epthook'?

Basically, there is a breakpoint while the process is executing, but if the process or kernel wants to read it, there is nothing there.

By the way, I might be inaccurate. If that's the case, could you elaborate more on that?

Can HyperDbg automatically bypass common anti-VM checks like CAPE does, or is that something the analyst has to implement manually?

as far as I see yes some: https://github.com/HyperDbg/HyperDbg/blob/056793954e876d6f127c0ff5cc52cb84c053c9d6/hyperdbg/hyperevade/header/SyscallFootprints.h

@HughEverett Thank you so much for your answer. This is a bit different from EPT. EPT involves canceling one of the three rwx permissions on a page, which causes an exception

But it directly modifies your mapped memory address pointer

Maybe I got it wrong? From what I found out, that's just how it seems to be?

anyone know a good forum software?

xenforo maybe

[discord] <tallylc> Hello All, I have just come across HyperDbg and am looking forward to experimenting with it. Looks like I have to disable the VBS on my Windows 11 (x64) first.

[discord] <rayanfam> [reply]: yes, you can follow instructions here: https://docs.hyperdbg.org/getting-started/build-and-install

maybe

[discord] <tallylc> [reply]: Thanks and i am working on making the changes to my Windows 11 (x64). I also had a question in wondering if there were plans to make a UEFI bootable version that could have nested virtualization so that you would not have to go through all of the configuration changes?

On that note, there is an interesting project called Bitvisor (https://www.bitvisor.org/en/) that I have played with a bit in the past and although it is not a debugger, it is a type of Para- passthrough hypervisor that can coexist with Hyper-V. Just my thoughts on things so far but have to admit that what i have seen and learned so far in the videos about HyperDbg is really awesome and your team has done an amazing job. 🙂

You're right. Yes, in that case, it could be useful, and it is also possible to implement it with the least modification to the HyperDbg core if you want to use HyperDbg as the baseline.

[discord] <rayanfam> [reply]: Thanks 🙏. Yes it's possible to release HyperDbg as a UEFI module and support nested virtualization.

[discord] <rayanfam> [reply]: This is also in the todo list, hopefully we could reach to it in the future. Right now, we are actively working on porting HyperDbg to Linux, enhancing hypertrace project (for supporting Intel PT) and improving hyperevade project for anti-anti-debug and hypervisor methods.

[discord] <unrustled.jimmies> [reply]: > nested virtualization

debugging hyperv with hyperdbg coming soon 👀

[discord] <rayanfam> [reply]: Not really planned for now. It is just in the todo list. Might take years to come unless we find someone interested in implementing that. 🙂

I'll take it if I'm laid off soon ;)

[discord] <unrustled.jimmies> haha yeah ik, having nested virtualization that can boot another bluepill style hv is totally different than being able to boot hyperv under it.

Then I hope you get laid off soon. 😅😉

Thanks mate :D

Sure thing 🫡

[discord] <tallylc> [reply]: Any projections on the Linux version. Mostly just wondering?

[discord] <rayanfam> [reply]: @maxraulea is leading this project. He is more informed about the current state.

[discord] <maxraulea> [reply]: Rn we are just getting to a compiled version with stubs for some OS specific parts, the user space lib (libhyprdbg) almost compiles, a couple of files left. Then we will have to compile the kernel module and fill in the stubs for linux for the userspace

[discord] <rayanfam> [reply]: 👍 🫡

[discord] <q_iwirieow> hello

[discord] <q_iwirieow> is there an mcp server for hyperdbg

[discord] <q_iwirieow> gotta get claude up to skid

[discord] <jakob944> [reply]: wrong debugger

[discord] <q_iwirieow> [reply]: edited

HyperDbg doesn't have an MCP server yet 😞

A new command 'ucpuid' is added thanks to @anti_zealot :

https://docs.hyperdbg.org/commands/debugging-commands/ucpuid#command

Feel free to test it, it's on the 'dev' branch now.

I appreciate you my brother, almighty God bless you 🙏✌️

[discord] <q_iwirieow> [reply]: do you know anything about this? its quite old

https://github.com/HyperDbg/mcp

I don't think that it's on a working state.

But if you have any idea of writing an MCP server, let me know so we can host on the GitHub org. Basically it should be some AI generated MCP server.

[discord] <q_iwirieow> [reply]: Ok

I could probs have a look into this

I'll build something out and PR it

👍

Major milestone in bringing HyperDbg to Linux! 🐧

Huge thanks to @MaxRaulea, all HyperDbg user-mode modules now compile on Linux. 🎉🪐💫

Next step is porting the kernel modules...

🔥🔥🔥

[discord] <q_iwirieow> get 3 opus 5 agents to make this shit work on amd

👍👍👍

Hey Sina, following up on your note about wanting an MCP server for HyperDbg. I built one and put it up here: https://github.com/munraimix/hyperdbg-mcp

It's a Python MCP server that drives HyperDbg through libhyperdbg over ctypes (no HTTP shim), so it gets the script engine and structured SDK calls, not just CLI text. Around 77 tools covering registers, memory, disassembly, breakpoints, events and hooks, paging, symbols, and the hardware SDK. Works in both local VMI mode and Debugger Mode (serial, named pipe, net), connects lazily so the agent attaches on demand, and ships a read-only mode plus a confirmation gate on anything that mutates the target. GPLv3 to match the rest of HyperDbg.

I've run it end to end on a real two-machine serial rig: connect, read ring-0 registers, disassemble at RIP, clean disconnect. Building it also surfaced a serial framing bug (the receiver floods and can wedge the driver after an unclean disconnect), so I opened a fix for that against dev: https://github.com/HyperDbg/HyperDbg/pull/663 (Fixes #661).

Happy to have the org host it however you prefer: transfer the repo, move it under HyperDbg/mcp, or use it as a base. Open to feedback on the tool design too.

Hey,
Thank you very much.
I would appreciate if you could add it here:
https://github.com/HyperDbg/mcp

And for the PR, yes, that's great. I saw it. I'll review it in the coming day and will merge it. Also do you have an example that I could create the issue that you mentioned for reproducing it?

Thanks again for all your efforts ❤️

Thanks Sina, really appreciate it 🙏

Done, I opened it as a PR into the org repo: https://github.com/HyperDbg/mcp/pull/1 (it swaps the old Go prototype for the Python server). Happy to adjust the structure, naming, or packaging to whatever you prefer.

For the serial bug, I'll get you a clean reproduction example this afternoon so you can spin up the issue and verify it easily.

And no rush on #663, thanks for taking a look 👍

Reproduction is up on the issue: https://github.com/HyperDbg/HyperDbg/issues/661#issuecomment-5103311367

Good news is it needs no driver, no test-signing and no hypervisor, since the debuggee runs its handshake loop before the module is loaded. So one machine with a com0com pair is enough: `.debug prepare serial 115200 com10` on one end, then write a continuous stream of marker-free bytes to the other end.

I ran it against both builds with the same 327680 bytes. On dev it prints the "exceeds the buffer limitation" plus "invalid buffer received" pair once per 81920 bytes and the handshake retries stop. With #663 it prints one resync line and the handshake loop keeps running. Counts and the exact console output are in the comment.

[discord] <q_iwirieow> mcp server is such a good idea

[discord] <q_iwirieow> deadass

I see.

Great. Thanks

hey, anybody have experience with debugger mode with two physical machines linked by serial link?

Are there good first issues or anything a newcomer could work on (who’s been using the tool for a bit)

Hey,

There was a discussion in the group about this in the past. It seems HyperDbg doesn't perform validation of packets, and since the serial port is prone to errors, it fails. So, I don't recommend using it at this stage. However, we have a contributor working on implementing Intel e1000 NICs. I don't know the current progress state, but I suppose it should be ready in the coming months, so I recommend waiting for it to debug a remote machine.

Hey,
Nice that you want to work on HyperDbg. ❤️
Please check all todo lists here, and if you find any of them interesting or you need more explanation about any of them, mention it here so we can discuss about it:
https://github.com/orgs/HyperDbg/projects/2

Thanks!!

Thanks for the info!