v0.22

HyperDbg v0.22 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

This release wouldn't have been possible without the help and outstanding work of @xmaple555, @maxraulea, @FallinBinary, @munraimix, and @SinaKarvandi.

Added

• Added a new 'dl' command to traverse linked lists using virtual addresses, thanks to @FallinBinary (link)(link)
• Added a new '!dl' command to traverse linked lists using physical addresses, thanks to @FallinBinary (link)(link)
• Exported SDK API for traversing linked lists (using virtual and physical memory) (link)
• Added 'pname' to the '!pt' command (link)
• Added '!pt' initialization to a separate thread (link)
• Added new definitions for GCC Linux compilation (link)(link)
• Added mitigation for hypervisor crash in a non- long mode RIP overflow (link)
• Added new lib calls and reverted sleep macro to functions (link)
• Added status for porting HyperDbg to Linux (link)
• Add 'ud.cpp' new additions to the platform API and guards (link)
• Added driver install for Linux stub, and new platform functions and 1:1 mappings (link)
• Added a new platform IOCTL function and some sweeps of already existing platform functions (link)
• Added structures in the script engine, thanks to @xmaple555 (link)(link)

Changed

• Fix the double-enable error of the '!pt' command and create a new window for the suspended process (link)
• Fix creating a new window for the suspended process in the '!pt' command (link)
• Compiling user-mode KD functions on Linux (link)
• One-to-one conversion and stubbed w_char issue (link)
• Compiling Linux PE-parser (left for the future) (link)
• Fix DRIVER_IRQL_NOT_LESS_OR_EQUAL when reading registers on a manually-halted core, thanks to @munraimix (link)
• Fix the error for referencing guest registers twice in both KD and VMX codes (link)
• Fix handle compound assignment to struct members (link)
• Updated semantic scripts by adding test cases for the structs in the script engine (link)

v0.21

HyperDbg v0.21 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

[0.21.0.0] - 2026-07-05

New release of the HyperDbg Debugger.

Added

• Added structure for the hyperperf (Hardware Performance Counter) project (link)
• The 'unload' command checks whether any module is loaded or not (link)
• Exported SDK API for checking whether any module is loaded or not (link)
• Added user mode and kernel mode PT parameter parser (link)
• Added thread (TID) and process (PID) helper functions for Intel PT (link)

Changed

• Separated SDK libraries for user mode and kernel mode modules (link)
• Added hypertrace, hyperevade, and hyperperf DLL files to SDK (link)
• Fix pool manager uninitialize list corruption (link)
• Fix 'access denied' error on loading all modules using 'load all' (link)(link)
• Fix the concatenation error for the "hyperkd" string on the hypertrace project (2b0cc18))
• Organized header files for the libhyperdbg project (link)

v0.20-beta

HyperDbg v0.20-beta is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

This release wouldn't have been possible without the help and outstanding work of @maxraulea, @masoudrahimi01, @Idov31.

Important Note: This is a beta release and may contain bugs or stability issues. If you encounter any problems, please report them and consider using the previous stable release.

Added

• Added the libipt library to the project and the SDK
• Added Intel Processor Trace (PT) example app
• Added Linux distinction and pragmas together with new platform functions (link)
• Added interfaces to Linux port for the serial devices (link)
• Added platform IOCTL interface (link)
• Added typecast for wchar, mismatch on Linux and Windows (link)
• Added missing IOCTLs for Intel PT (link)
• Added NuGet packages for Windows SDK and WDK
• Added Signal handler platform API for Linux (link)
• Added contribution guidelines for Linux (link)

Changed

• Moved to Visual Studio 2026 (link)
• Zydis and pdbex submodules are updated to VS2026
• Fix the new form of loading and unloading in the example app and PT app (link)
• Check whether the top-level hypervisor is Hyper-V and disable/enable VPIDs based on that, thanks to @Idov31 (link)
• Fix PT operation IOCTL buffer size (link)
• CI/CD updated with NuGet packages for Visual Studio 2026 (link)

v0.19-beta

HyperDbg v0.19-beta is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

This release wouldn't have been possible without the help and outstanding work of @maxraulea, @masoudrahimi01, @jtaw5649, @harimishal1, @Idov31.

Important Note: This is a beta release and may contain bugs or stability issues. If you encounter any problems, please report them and consider using the previous stable release.

Added

• First release of the HyperTrace module (link)
• HyperTrace now enables/disables VM-entry/VM-exit controls for Load and Save IA32_DEBUGCTL MSR
• Added Legacy LBR support to the HyperTrace module
• Added Architectural LBR support to the HyperTrace module
• Added the '!lbr' command for performing different Last Branch Record (LBR) operations (link)
• Added the '!lbrdump' command for dumping saved Last Branch Record (LBR) entries (link)
• Added lbr_save() and lbr_print() functions in the script engine (link)(link)
• Added mock application for compiling SDK for Linux
• Added '!help' alias for the '.help' command
• Added 'vm' alias for the 'load' command (link)
• Added lbr_check() and lbr_restore() functions in the script engine (link)(link)
• Added lbr_restore_by_filter(filter) function in the script engine (link)
• Added the 'kd' module in the 'load' command (link)
• Added the 'trace' module in the 'load' command (link)
• Exported SDK API for detecting CPU vendors
• Initial codes for the HyperTrace project by using Intel Processor Trace (PT), thanks to @masoudrahimi01 (link)
• Exported SDK APIs for loading and unloading the 'kd' and the 'trace' modules
• Exported SDK APIs for starting (installing) the 'kd' driver
• Exported SDK APIs for loading/unloading all modules
• Added tests for checking PE parser in 'hyperdbg-test' project
• Added example for loading HyperDbg in VMI mode directly from libhyperdbg
• Fix action cleanup list removal in debugger events (link)
• Added transparent-mode evade mask selection thanks to @jtaw5649 (link)
• Added synthetic MSR handling thanks to @Idov31 (link)
• Added use of relative RSDS fixture paths when loading PDB symbols, thanks to @jtaw5649 (link)

Changed

• Fix the problem of not applying the EAX index in the CPUID event extension command (link)
• Refactoring the IOCTL parameter checks and status routines
• All basic types are now defined for Linux
• VMX instructions are ported to platform-independent files to support Linux
• All CPU-related intrinsic instructions are ported to platform-independent files to support Linux
• HyperDbg SDK now compiles on Linux (GCC) for both user-mode and kernel-mode
• Fix the 'wrmsr' command IOCTL checks by receiving output in the buffer (link)
• Extensive refactoring of code base (doxygen, variables, function names)
• Building certain modules on Linux and fixing CMake files thanks to @maxraulea (link)
• Fix the '!hide' command's HyperEvade activation guard thanks to @jtaw5649 (link)
• Fix synchronous debugger device IOCTL handles thanks to @jtaw5649 (link)
• PE parser ('.pe' command) now supports richer DOS/NT/COFF/optional-header output, section bounds checking, data directory reporting, import/export parsing, TLS/debug/PDB/load-config metadata, overlay reporting, and malformed metadata warnings thanks to @jtaw5649 (link)(link)
• Building the script engine module on Linux (GCC) thanks to @maxraulea (link)
• The pool manager moved from 'hyperhv' to 'hyperkd'
• The 'load' command could load all modules using a new alias 'load all' (link)
• The 'unload' command could remove all modules using two new aliases 'unload all' and 'unload remove all' (link)
• Change device handle checks with module loading status checks for IOCTLs (link)
• Fix standard callbacks for the VMM module (link)
• Fix race condition bug within the pool manager

v0.18.1

HyperDbg v0.18.1 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

Added

• Hypertrace now works with HyperDbg VMM (link)
• Progress on implementing Last Branch Recode (LBR) (link)
• Applying LBR registers on the VMCS instead of the DEBUGCTL MSR (link)

Changed

• Fix the problem of the '!epthook' not finding the PML1 entry (link)
• Fix the problem of getting the PML1 entry of the target address on Intel Core Ultra processors (#567) (link)
• Fix the '.clang-format' formatting error

v0.18

HyperDbg v0.18 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

Added

• Script engine now supports writing libraries using the '#include' keyword thanks to @xmaple555 (link)(link)(link)
• Initial codes for the hypertrace project by using Intel Last Branch Record (LBR) and Branch Trace Store (BTS) thanks to @harimishal1 (link)
• The hypertrace project is now linked to the hyperkd
• Initial efforts to port HyperDbg to Linux have started thanks to @Alish14 (link)

Changed

• Fix compilation error in Zydis with the new Windows WDK (link)

v0.17

HyperDbg v0.17 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

Added

• Added 1D and 2D arrays (multidimensional arrays) in the script engine (link)(link)
• Added compound assignments in the script engine (link)(link)
• Added multiple assignments in the script engine (link)(link)

Changed

• Fix bugs for interpreting 'db_pa, 'dd_pa', 'eb_pa', and 'ed_pa' keywords in the script engine (link)(link)
• Fix variable types in the script engine (link)
• Fix and update array index for boolean expressions in the script engine (link)

v0.16

HyperDbg v0.16 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

Added

• The !xsetbv event command was added for handling the execution of the XSETBV instruction, thanks to HyperDbg group members (link)
• Display of the number of blocked context switches in the '.switch' command (link)
• Added support for step-in (the 't' command) in the user debugger (link)
• Added support for step-over (the 'p' command) in the user debugger (link)
• Added support to show all registers or a specific register in the user debugger (link)
• Exported SDK API for running scripts in either the kernel debugger or the user debugger
• Added support to modify registers or a specific register in the user debugger (link)
• Added support to evaluate (run) scripts on the target thread in the user debugger (link)
• Added an indication of a thread's running or paused state to the HyperDbg signature in the user debugger (link)
• Added support for the '.formats' command in the user debugger (link)
• Added support for interpreting parameters based on script engine expressions in the user debugger
• Exported SDK API for evaluating expressions based on the context of the kernel debugger or the user debugger
• Added a new mechanism for showing the 'printf' and the 'print' function messages in the user debugger (link)(link)

Changed

• Non-volatile XMM registers are no longer saved/restored on VM-exit handler (link)
• Fix grammar and spelling errors throughout HyperDbg codebase (link)
• Relocate extension command files into their corresponding VS directory
• Fix infinite VM-exit bug for the '!monitor x' command thanks to @unlockable (link)

v0.15

HyperDbg v0.15 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

Added

• Added the '!smi' command for performing operations related to System Management Interrupt (SMI) (link)
• Export the SDK functions for SMI operations (link)
• Check for Intel CET IBT (indirect branch tracking) support
• Check for Intel CET shadow stack support
• Added support to Intel CET for SYSCALL/SYSRET emulation (link)(link)

Changed

• The 'hyperhv' project now has build optimizations enabled
• Reformat VMXOFF restoring routines to restore general-purpose and XMM registers correctly before moving to the previous stack
• Fix unloading (VMXOFF) crash when restoring XMM registers
• Fix the problem with restoring XMM registers (#468) (link)
• Enhanced the '.pe' command to support PE Rich Headers thanks to @Alish14 (link)
• Updated ia32-doc to fix VMCS PL3 SSP fields (link)
• Fix the terminating process issue of the '!syscall/!sysret' commands on 11 generation (Rocket Lake/Tiger Lake) and newer Intel processors (link)
• Reenable the support for the '.start' command in the Debugger mode (link)
• The '!mode' event command is now compatible with different EPT hook commands (e.g., !epthook, !epthook2, !monitor, .start, and .restart) (link)
• The '!mode' command doesn't need allocating extra EPTPs (link)

v0.14.1

HyperDbg v0.14 is released!

If you’re enjoying HyperDbg, don’t forget to give a star 🌟 on GitHub!

Please visit Build & Install to configure the environment for running HyperDbg. Check out the Quick Start and Frequently Asked Questions (FAQs) to learn more. You can use the examples of using the debugger and the script engine to get started with HyperDbg.

Changed

• Restored the previous optimization on the release builds
• Fixed the issue of not properly restoring registers after the 'CPUID' instruction
• Fixed the building issues of the user debugger with the 'bp' and the '.start' commands