rainmurk
5d5eab09fc
Fix MBEC physical address decoding for split EPT entries
2026-10-19 07:31:12 +08:00
Sina Karvandi
950954acc7
Merge pull request #680 from enzo-berry/fix/hidden-bp-first-original-byte
...
Preserve the original byte of the first hidden breakpoint on a page
2026-09-22 13:33:40 +02:00
enzo-berry
80e1f6276b
Preserve the original byte of the first hidden breakpoint on a page
...
EptHookCreateHookPage() records BreakpointAddresses[0] and sets
CountOfBreakpoints to 1, but never fills in the matching
PreviousBytesOnBreakpointAddresses[0]. The entry is allocated with
PlatformMemAllocateZeroedNonPagedPool(), so that slot deterministically
holds 0x00.
Every later breakpoint on the same page does save its original byte in
EptHookUpdateHookPage(), and EptHookUnHookSingleAddressHiddenBreakpoint()
restores all slots the same way. Removing the first breakpoint while a
second one is still on the page therefore writes 0x00 into the fake page
instead of the instruction byte that was there, corrupting the fake-page
instruction stream. The 0x00 can also swallow the remaining 0xcc as a
ModRM byte, so the surviving breakpoint stops triggering.
Read the byte after the page contents are copied and before the 0xcc is
written over it. This also makes the existing comment in the unhooking
path correct, which already assumed the first entry holds a valid
previous byte.
Fixes #637
2026-08-26 11:49:04 +02:00
Max Raulea
e439fd38d3
Added new platform API functions and changed them in the source code
2026-08-23 13:04:20 +02:00
Max Raulea
82ad5fc9b6
Swepped hyperhv project for platform functions and swapped them
2026-08-17 15:24:25 +02:00
Sina Karvandi
b0f3fa1ffd
Merge pull request #602 from jtaw5649/upstream/transparent-mode-mask-api
...
Add transparent-mode evade mask selection
2026-06-07 13:28:06 +02:00
jtaw5649
9fd4034855
feat(hide): add transparent evade mask API
2026-06-05 19:01:14 +01:00
sina
b6b8320518
moving pool mananger from hyperhv to hyperkd
2026-06-04 00:06:41 +02:00
sina
cbb28edde3
refactor doxygen, variables, function names 7
2026-05-31 19:29:14 +02:00
sina
de0c56b466
create platform independent intrinsics functions
2026-05-05 21:25:20 +02:00
copilot-swe-agent[bot]
774d61782f
fix: correct typos and one copy-paste error in comments and messages
...
Agent-Logs-Url: https://github.com/HyperDbg/HyperDbg/sessions/0817c887-8808-4080-a701-6a0211b10595
Co-authored-by: SinaKarvandi <13383992+SinaKarvandi@users.noreply.github.com>
2026-04-23 12:38:48 +00:00
sina
a1984fed70
change instances for VMWRITE into a single function
2026-04-19 16:57:48 +02:00
sina
2ad4fa56ee
create separate example for LBR
2026-04-19 15:49:12 +02:00
sina
16f64afd4f
check for the compatibility of Intel CET to for emulating SYSCALL and SYSRET
2025-08-17 17:33:13 +02:00
sina
61d45c518d
move pool allocations to a single function
2025-08-17 16:25:02 +02:00
sina
ece94e748f
update ia32-doc submodule to update the correct value for VMCS PL3 SSP
2025-08-17 16:17:16 +02:00
sina
39920ccfa5
change VMX headers to IA32doc headers
2025-08-17 14:26:38 +02:00
sina
360b0e5863
support CET SYSCALL emulation on VMCS
2025-08-17 13:51:32 +02:00
sina
cdadcfaded
add CET emulation for syscall extension command
2025-08-14 12:21:53 +02:00
sina
945ae55563
check for EPT hooks above 512 GB
2025-07-22 01:21:11 +02:00
sina
15061014c7
Fixed retrieving valid watching process IDs for the execution trap and user-mode execution prevention
2025-07-08 19:41:08 +02:00
sina
0e5ff45c30
set user mode execute bit for different core EPTPs
2025-07-08 00:10:43 +02:00
sina
e8e0489a6b
fix removing process from pausing list
2025-06-29 20:22:51 +02:00
sina
d6f0e22928
intercept the execution when the module loaded on the user debugger
2025-06-28 18:53:35 +02:00
sina
8aa8289236
adjust mbec and user debugger initialization
2025-06-28 04:28:39 +02:00
sina
a93b78dfad
use the same EPTP for MBEC
2025-06-28 03:54:07 +02:00
sina
2637965512
apply user mode debugger to the kernel debugger
2025-06-26 19:14:29 +02:00
sina
fe4dd107cb
add hyperdbg test mode for the user debugger
2025-06-25 18:48:11 +02:00
sina
cc8167c089
only apply thread interception to user mode
2025-06-24 18:12:02 +02:00
sina
664e84a14f
fixing compilation errors and add hyperevade callbacks
2025-06-07 23:57:04 +02:00
sina
872947677e
link hyperevade to hyperhv
2025-06-07 21:57:57 +02:00
CokeTree3
80820e21d3
Syscall NtQuerySystemInformation transparency
2025-05-06 17:16:45 +02:00
sina
a8e3cf55e1
add context to the syscall interceptor
2025-04-30 20:52:04 +02:00
SinaKarvandi
14f463e6eb
fix unhooking monitor hooks on a different process or if the process is closed ( #409 )
2024-07-05 17:29:39 +09:00
SinaKarvandi
48c362255e
build based on new libhyperdbg
2024-06-24 18:05:54 +09:00
