RDTSC is really bad.🤨🤨🤨🤨🤨

And that makes sense, just look for rdtsc instruction inside ntdll.dll and you’ll see why

It works in VMware.

What do you mean by works?

And what is not working with hyperdbg?

In this sense

intercepts all RDTSC and doesn’t freeze😐

Well you’re adding a huge overhead to a frequently used instruction

So it just drowns the platform

I don’t quite understand… I tried to intercept rdtsc in the same program, in notepad.exe. On a physical computer and in VMware. It works fine in VMware, but not on the physical computer. Also, if you connect to VMware as a remote debugger, VMware freezes as well

Oh, I see. Have you used hyperdbg in VMware as well?

you used hyperdbg in both main windows and virtual machine?

Yes, of course

Yes

so basically you mean, like windbg you used local kernel debugging, yeah? (in main windows obvisously)

I need to intercept rdtsc in the user process. Team !tsc does not work in hyperdbg on a physical machine.

Using vmware and remote debugging !tsc doesn't work as well

But when trying to local debug in VMware !tsc worked well

Interesting. Probably rdtsc is emulated in VMware. But it’s just a guess

Check, please🙂

With !tsc is a complete trouble...(

Does this tool have an MCP?

Hmm

It has a search memory function

Hey
Yes. Thanks to @HumbleMuns https://github.com/HyperDbg/mcp

🫡

hey alexander 🙌🏼
do you think its working properly for me? just as expected?

Hello! ✋🤚Hyperdbg didn't hang?

nope

its working properly, no freezing

Thank you!🙏 This is very important information for me...

im in vmware, local mode debugging, as you did before
connect local
load vmm

It's very strange... today I'll check on another computer

maybe the issue is with the way you wrote notepad! i mean, instead of writing it like this:
Notepad.exe
i used:
notepad.exe
exactly the same as it appears in task manager
(its just my guess im not sure , maybe the reason i provide isnt logical at all 🌝😬😬😬)

but notice that, i have that freezing problem in REMOTE debugging too! i guess all users must have the same problem, and its not specifically for !tsc command. but no worry, we're trying to fix that bro 🙌🏼

Hyperdbg is a great product for reverse engineers

yup 😎
thanks to all developers, specially @HughEverett

When will nested virtualization be supported? I am currently debugging a malicious driver, and it loads VT‑x, which prevents me from using HyperDbg for debugging. Also, will there be a future feature that, when I double‑click on an executable (.exe) or a driver (.sys), records its complete call flow and its CPU instruction log for both x64 and x32 modes?

you mean syscalls?

uhm, how this would be even possible, I mean, for most processes you have WinDBG TTD, but for drivers your best bet is HyperTrace(? (Intel PT + LBR/BTS and other tracing features VMX can support)

[matrix] <kurd> im sorry

/report

Reported Jeffrey Mendez [1088081389] to admins.​​​​​​​​​​​​

[matrix] <kurd> good morning all

Good morning 🌄

Hi

[matrix] <kurd> nvm i found it

[matrix] <kurd> https://github.com/orgs/HyperDbg/projects/2

[matrix] <kurd> where are you im from eu

[matrix] <kurd> In-Kernel Script VM Bytecode Evaluator (hyperdbg/script-eval/code/ScriptEngineEval.c)
Arbitrary Memory Write / Stack Overflow in FUNC_PUSH and FUNC_CALL: ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackIndx] = SrcVal0; ScriptGeneralRegisters->StackIndx++; executes before verifying if StackIndx >= MAX_STACK_BUFFER_COUNT (256). Allows an attacker or malformed script to overwrite adjacent non-paged pool memory in kernel mode.

[matrix] <kurd> Investigating why the symbols parser (DIA SDK) could not read symbols of the 'kernel32!*' can i have more info on this

[matrix] <kurd> or its just in general

Yeah, this is a problem in HyperDbg. If you try to parse symbols. Sometimes it doesn't show function names for kernelbase.dll or kernel32.dll.

[matrix] <kurd> oh ok

[matrix] <kurd> i'm seeing it my self now

I don't know if it's a problem with Microsoft symbol parser or a problem with our code

[discord] <kurd> i think fix is incoming

[discord] <kurd> Stripped Public PDBs in pdbex (DIA SDK Integration)
Problem: Microsoft's public symbols (such as kernel32.pdb) are stripped: they contain 0 UDTs (SymTagUDT) and 0 Enums (SymTagEnum), but contain thousands of SymTagPublicSymbol items (e.g. 5,945 in kernel32.pdb).
Previously, pdbex only stored UDTs and Enums in its primary symbol maps (m_SymbolMap and m_SymbolNameMap). SymTagPublicSymbol entries were only examined for a comment output list if the -f flag was enabled, but were never indexed as first-class symbols. As a result:
Wildcard query (*) returned 0 symbols.
Single symbol query (CreateFileW) threw Symbol not found.

Is it the one you sent a PR for it? Or is it different from the PR?

[matrix] <kurd> i sended i massive pr request

I see. That one is a bit hard to check all of it. Could you also send a separate PR for this specific issue?

[discord] <xssd> sure gimme sec

[discord] <xssd> Fix kernel32 symbol loading- #688
#688
Open
xssd84
wants to merge 14 commits into
HyperDbg:master
from
xssd84:fix-kernel32-symbol-loading

Could you send it to the 'dev' please?

[discord] <xssd> ok

[discord] <xssd> Review required
At least 6 approving reviews are required by reviewers with write access.

1 workflow awaiting approval
This workflow requires approval from a maintainer. Learn more about approving workflows.

Merging is blocked
At least 6 approving reviews are required by reviewers with write access.
You're not authorized to push to this branch. Visit https://docs.github.com/repositories/configuring-branches-and-

[discord] <xssd> how i change it

Yes, I could see it now, but apparently your other modification is also in this PR. Not just the symbol parser problem.

[matrix] <kurd> sorry for the mess

No worries. Let's continue this discussion in DM, so we won't be annoying for others in the group.

[discord] <xssd> eny dev here

[discord] <xssd> i'l been brianstorming for some more feartures

[discord] <xssd> https://github.com/HyperDbg/HyperDbg/issues/690

SPP is not worth it - there were only couple of cpus supporting it and it won't be supported in the future

[discord] <xssd> oh ok

[discord] <xssd> i was brainstorming on new ideas

[discord] <xssd> you mean point 1 or

[discord] <xssd> Sub-Page Permissions (SPP) Memory Monitor

Well I assume it is based on sub page permissions capability

And no client CPU supports that

[discord] <xssd> some do i think

[discord] <xssd> let me look it up

https://pulsedbg.com/vmx.html

[discord] <xssd> eek thnx

wasn't it like deprecated iirc?

It is

[discord] <xssd> Oki

It makes sense to ask the question before pinging someone

@alex_wow90
Hi Alexander, i guess the freezing problem wasnt really a problem! if you press G or type`continue` in debugger (which is your main windows) you can unfreeze the debuggee (the system you connected to)

Hello! Unfortunately, it doesn't work that way ... when hyperdbg hangs, it can not be stopped (ctrl+c) not turned off (exit). It's just that rdtsc lines are constantly coming

It's been a while since we passed 4K GitHub stars ⭐️

And more good news: HyperDbg's kernel-mode drivers now build on #Linux! 🐧

After successfully getting the user-mode components compiled, thanks to @MaxRaulea, we're now moving on to debugging, implementing, and testing cross-platform functionality.

Step by step, we’re getting closer to running HyperDbg on Linux!

https://github.com/HyperDbg/HyperDbg/tree/dev/hyperdbg/linux

No
I think it was one of the problems we discussed before, i mean not specifically usage of rdtsc but the connection between debugger and debuggee. when we try to debug remotely, after indication of successful connection we press ctrl+c in order to be able to send command to the target system, the target windows freezes which is normal, and if you want to regain access ( unfreeze ) the target windows, you should send G or continue using debugger (main windows) to the debuggee. But in case of your problem with RDTSC, you know what? If you think about it, its normal to experience such a thing, hooking RDTSC causes instability, slowness... And eventually freezing 🥶
I experienced that too with just a simple windows application like notepad, just imagine intercepting/emulating/(or any other related terms for it) rdtsc of a larger program 🌚 yikes 💀

It's possible... but we need ideas

Hello friends

Hello 👋🏼

Hi
Anyone experience in reverse engineering?
I need have software to reve

Hey,
Here we discuss hypervisors and Hyperdbg in general. Please avoid asking these types of questions and try to ask more specific ones.

HyperDbg v0.24 is released!

It includes nine new commands, support for arrays as function parameters, char and wide-char arrays, fix kernel-mode builds on Linux, plus major bug fixes and refactoring.

Check it out:
https://github.com/HyperDbg/HyperDbg/releases/tag/v0.24

---

More information:

- dw, da, dds, dqs, dps
https://docs.hyperdbg.org/commands/debugging-commands/d

- !dw, !da
https://docs.hyperdbg.org/commands/extension-commands/d

- uin:
https://docs.hyperdbg.org/commands/debugging-commands/uin

- uout:
https://docs.hyperdbg.org/commands/debugging-commands/uout

- Arrays as function parameters:
https://docs.hyperdbg.org/commands/scripting-language/constants-and-functions#arrays-as-function-parameters

- char & wide-char arrays in the script engine:
https://docs.hyperdbg.org/commands/scripting-language/structures-and-arrays#char-and-wide-char-wchar_t-arrays

This release wouldn't have been possible without the help and outstanding work of @xmaple555, @MaxRaulea, @mhmd_nikzad, @FallinBinary, @elprimo6393816. Thank you guys. 💪💪✨✨

I appreciate you brother, for your support, attention and helping other developers 🫂🙏🏼

Thank you for helping with this. 🙏