Commit graph

51 commits

Author SHA1 Message Date
sina
cd52174d82 fix and remove unused VMM callbacks 2026-06-09 15:04:20 +02:00
sina
bb3b09beb9 replace VMM callbacks 2026-06-09 01:37:48 +02:00
Sina Karvandi
b0f3fa1ffd
Merge pull request #602 from jtaw5649/upstream/transparent-mode-mask-api
Add transparent-mode evade mask selection
2026-06-07 13:28:06 +02:00
jtaw5649
9fd4034855 feat(hide): add transparent evade mask API 2026-06-05 19:01:14 +01:00
sina
b6b8320518 moving pool mananger from hyperhv to hyperkd 2026-06-04 00:06:41 +02:00
Sina Karvandi
01e513c876
Merge branch 'trace-module' into dev 2026-05-31 19:39:14 +02:00
sina
cbb28edde3 refactor doxygen, variables, function names 7 2026-05-31 19:29:14 +02:00
sina
468927a30f export LBR type as an argument on HyperTrace
Some checks failed
vs2022-ci / win-amd64-build (debug, x64) (push) Has been cancelled
vs2022-ci / win-amd64-build (release, x64) (push) Has been cancelled
vs2022-ci / Deploy release (push) Has been cancelled
2026-05-28 14:41:37 +02:00
sina
81f3d9f3d2 export HyperTrace LBR support and capacity function to the VMM and HyperEvade module
Some checks failed
vs2022-ci / win-amd64-build (debug, x64) (push) Has been cancelled
vs2022-ci / win-amd64-build (release, x64) (push) Has been cancelled
vs2022-ci / Deploy release (push) Has been cancelled
2026-05-26 16:41:23 +02:00
sina
6f004f1ffd Add ARCH LBR functions from hypervisor 2026-05-01 18:40:39 +02:00
sina
469f12c645 compile HyperDbg SDK for Linux (user-mode)
Some checks failed
vs2022-ci / win-amd64-build (debug, x64) (push) Has been cancelled
vs2022-ci / win-amd64-build (release, x64) (push) Has been cancelled
vs2022-ci / Deploy release (push) Has been cancelled
2026-04-28 17:17:45 +02:00
sina
c5ba5ccd89 compile HyperDbg SDK for Linux 2026-04-28 14:39:54 +02:00
sina
af50093b9b apply LBR filters from VMX-root mode 2026-04-27 03:16:41 +02:00
Sina Karvandi
54c2a9923b
Merge pull request #576 from HyperDbg/LBR
Lbr
2026-04-23 16:44:08 +02:00
sina
24875bda88 apply VM-exit and VM-entry load and save controls from VMCALLs 2026-04-23 16:42:34 +02:00
copilot-swe-agent[bot]
774d61782f
fix: correct typos and one copy-paste error in comments and messages
Agent-Logs-Url: https://github.com/HyperDbg/HyperDbg/sessions/0817c887-8808-4080-a701-6a0211b10595

Co-authored-by: SinaKarvandi <13383992+SinaKarvandi@users.noreply.github.com>
2026-04-23 12:38:48 +00:00
sina
efded3790b protect load and save vm-entry and vm-exit controls from setting and unsetting in different routines 2026-04-22 16:27:20 +02:00
sina
111bead68d check for hypervisor support of load and save VMCS exit and entry controls 2026-04-19 20:08:47 +02:00
sina
a1984fed70 change instances for VMWRITE into a single function 2026-04-19 16:57:48 +02:00
sina
1b08f14add add cross VMCALLs for setting core-specific LBR state 2026-04-14 19:23:51 +02:00
sina
a1d30abdf2 remove VMX instructions from hypertrace in favor of linking to hyperhv callbacks 2026-04-14 17:53:54 +02:00
sina
c37ec6f3c0
apply command to the target thread from MBEC 2025-08-23 01:30:12 +02:00
sina
8e111d93c6
remove extra code from XSETBV command 2025-08-21 00:39:35 +02:00
sina
77029f330d
add XSETBV event extension command 2025-08-21 00:17:26 +02:00
sina
3961196112
add support for SMI related functionalities 2025-08-02 23:18:18 +02:00
sina
15061014c7
Fixed retrieving valid watching process IDs for the execution trap and user-mode execution prevention 2025-07-08 19:41:08 +02:00
sina
e8e0489a6b
fix removing process from pausing list 2025-06-29 20:22:51 +02:00
sina
d6f0e22928
intercept the execution when the module loaded on the user debugger 2025-06-28 18:53:35 +02:00
sina
2637965512
apply user mode debugger to the kernel debugger 2025-06-26 19:14:29 +02:00
sina
cc8167c089
only apply thread interception to user mode 2025-06-24 18:12:02 +02:00
sina
6893c1b19f
change user debugger from supervisor bit of regular page table to mbec 2025-06-21 02:59:44 +02:00
sina
e7a7668325
get process name and process id for the transparent mode 2025-06-11 01:43:19 +02:00
sina
0e649c6107
check for race condition while configuring the transparent mode 2025-06-10 23:59:21 +02:00
sina
bba0bd2a4c
fix changes from transparent-mode to syscall callback 2025-06-08 08:58:40 +02:00
sina
bdfd1f30eb
change the syscall callback initialization scope 2025-06-08 00:06:52 +02:00
sina
664e84a14f
fixing compilation errors and add hyperevade callbacks 2025-06-07 23:57:04 +02:00
sina
1eb9606073
add dynamic system call numbers for transparent mode 2025-06-06 23:01:29 +02:00
Sina Karvandi
d0610661ba
Merge pull request #521 from CokeTree3/SysCall-transparency
Windows system call transparency
2025-06-06 22:01:04 +02:00
sina
04e3e1e6f5
update versioning and changelog 2025-06-04 20:10:20 +02:00
unknown
0d5ee6ab60 implement microsleep function 2025-06-02 11:26:48 +02:00
CokeTree3
d44e2ff219 Small fix 2025-05-30 12:28:50 +02:00
CokeTree3
a443283a71 SystemCall handler hooking 2025-05-04 20:50:34 +02:00
sina
5c92dca212 add logging mechanism for RDMSR and WRMSR 2025-02-14 16:48:32 +01:00
SinaKarvandi
b7b2b303d8 add new description for changing script engine constants 2025-01-25 18:37:54 +01:00
SinaKarvandi
0bb3398b30 move the idt query functions from debugger to hypervisor 2024-12-30 05:04:07 +01:00
SinaKarvandi
bb9c4e30d7 add support for IO APIC 2024-11-19 13:56:22 +01:00
SinaKarvandi
a6c6c88d05 show different APIC modes (x2apic or xapic) 2024-11-09 15:08:32 +01:00
SinaKarvandi
f09fc83643 store APIC fields in user-mode constructed structures 2024-11-08 18:46:52 +01:00
SinaKarvandi
ac87707a0b add support to read Local APIC in xAPIC and x2APIC modes 2024-11-08 15:14:12 +01:00
SinaKarvandi
14f463e6eb fix unhooking monitor hooks on a different process or if the process is closed (#409) 2024-07-05 17:29:39 +09:00