Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use other parameters in !monitor and !epthook commands to select the memory layout #90

Open
SinaKarvandi opened this issue Dec 9, 2021 · 0 comments
Labels
enhancement An enhancement to an existing feature feature New feature or request

Comments

@SinaKarvandi
Copy link
Member

HyperDbg has a caveat in the design of !monitor or possibly !epthook.

If you specify a particular process (add pid xx to your event command), only if that process accesses the memory, the event will be triggered. If another process attempts to change the memory, HyperDbg will ignore the event.

As a real-world scenario, if you modify the memory of a special process using a debugger (let say x64dbg), then as the memory is modified in an application other than the current debuggee's application, the event is ignored.

To solve this issue, one solution is adding new parameters to the commands mentioned above to specify another process as the target process to use its memory layout and use the pid parameter as a condition for the event.

One thing to mention is updating the examples in the documentation.

@SinaKarvandi SinaKarvandi added enhancement An enhancement to an existing feature feature New feature or request labels Dec 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement An enhancement to an existing feature feature New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant