# hyperdbg/hyperdbg **Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/hyperdbg-hyperdbg).** 3,885 stars · 488 forks · C · GPL-3.0 ## Links - GitHub: https://github.com/HyperDbg/HyperDbg - Homepage: https://hyperdbg.org - awesome-repositories: https://awesome-repositories.com/repository/hyperdbg-hyperdbg.md ## Topics `binary-analysis` `debug` `debugger` `debugging` `debugging-tool` `ept` `hook` `hyperdbg` `hypervisor` `kernel-debugger` `logic-analyzer` `malware-analysis` `reverse-engineering` `security` `security-tools` `virtualization` `virtualization-framework` `windows-kernel` ## Description HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It employs advanced techniques such as extended page table hooking and hardware-assisted branch recording to intercept memory access and processor control flow transitions. These capabilities allow for stealthy analysis, effectively bypassing common anti-debugging and anti-hypervisor detection mechanisms by masking timing discrepancies and avoiding traditional software hooks. Beyond its core monitoring capabilities, the platform includes a robust scripting engine that supports event-driven automation. Users can define custom logic to execute in response to specific system triggers, enabling complex workflows like conditional breakpoints, automated memory patching, and real-time data manipulation. The system also supports remote debugging through a dedicated message bus, facilitating connectivity between a host debugger and a target machine via serial or network protocols. The tool provides extensive support for symbol-based memory mapping, allowing users to translate raw addresses into human-readable data structures and function names. It is designed for installation and use across local and remote environments, including physical hardware and virtualized guests. ## Tags ### Development Tools & Productivity - [Stealth Debugging Modes](https://awesome-repositories.com/f/development-tools-productivity/runtime-debuggers/anti-debugging-mechanisms/stealth-debugging-modes.md) — Provides a hardware-assisted kernel-mode debugging platform that remains invisible to the target environment by leveraging hypervisor-level isolation. ([source](https://docs.hyperdbg.org/commands/extension-commands.md)) - [Conditional Triggers](https://awesome-repositories.com/f/development-tools-productivity/breakpoint-managers/conditional-triggers.md) — Triggers debugger pauses or events only when specific criteria, such as memory access or register states, are met. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples.md)) - [Debug Session Management](https://awesome-repositories.com/f/development-tools-productivity/debug-session-management.md) — Connects to, disconnects from, or listens for sessions to facilitate remote or local system analysis. ([source](https://docs.hyperdbg.org/commands/meta-commands.md)) - [Instruction Stepping Tools](https://awesome-repositories.com/f/development-tools-productivity/instruction-stepping-tools.md) — Executes the next instruction while automatically skipping over function calls. ([source](https://docs.hyperdbg.org/commands/debugging-commands/p.md)) - [Breakpoint Debugging](https://awesome-repositories.com/f/development-tools-productivity/interactive-debug-consoles/breakpoint-debugging.md) — Inserts breakpoint instructions at specific memory addresses to pause execution in both user and kernel modes. ([source](https://docs.hyperdbg.org/commands/debugging-commands/bp.md)) - [Stealth Breakpoint Interception](https://awesome-repositories.com/f/development-tools-productivity/interactive-debug-consoles/breakpoint-debugging/stealth-breakpoint-interception.md) — Intercepts execution at specific memory addresses using hardware virtualization to trigger debugging events without modifying the underlying code. ([source](https://docs.hyperdbg.org/commands/extension-commands/epthook.md)) - [Remote Debugger Connectivity](https://awesome-repositories.com/f/development-tools-productivity/remote-debugger-connectivity.md) — Links a debugger host to a target machine via serial or network protocols for remote kernel-mode analysis. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/beginning/connecting-to-hyperdbg.md)) - [Event-Driven Scripting](https://awesome-repositories.com/f/development-tools-productivity/shell-script-execution-engines/custom-run-scripts/scheduled-script-executions/event-driven-scripting.md) — Executes custom logic or logging routines directly within the kernel when specific system events occur. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites.md)) - [Remote User-Mode Debugging](https://awesome-repositories.com/f/development-tools-productivity/application-debugging/remote-debugging/remote-user-mode-debugging.md) — Connects to remote targets via network to step through user-mode execution without kernel interruption. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg/debug.md)) - [Breakpoint Managers](https://awesome-repositories.com/f/development-tools-productivity/breakpoint-managers.md) — Displays and manages configured breakpoints to control execution flow during analysis. ([source](https://docs.hyperdbg.org/commands/debugging-commands/bl.md)) - [Session Termination](https://awesome-repositories.com/f/development-tools-productivity/debugging-profiling-testing/debugging-diagnostics/debugging-inspection-tools/debugging-and-inspection-tools/runtime-debugging/native-debugging-sessions/session-termination.md) — Safely stops analysis sessions by unloading kernel-mode drivers and modules. ([source](https://docs.hyperdbg.org/commands/debugging-commands/exit.md)) - [Debugger Execution Resumption](https://awesome-repositories.com/f/development-tools-productivity/debugging-profiling-testing/debugging-diagnostics/in-app-debugging-consoles/console-execution-debuggers/debugger-execution-resumption.md) — Continues the execution of a paused debuggee in either local or remote debugging sessions after an interruption. ([source](https://docs.hyperdbg.org/commands/debugging-commands/g.md)) - [Event Filtering Logic](https://awesome-repositories.com/f/development-tools-productivity/event-triggers/event-filtering-logic.md) — Triggers debugger actions only when specific criteria are met, allowing for precise control over execution flow. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites.md)) - [Process Execution Restarting](https://awesome-repositories.com/f/development-tools-productivity/hot-reloading-servers/process-restarters/process-execution-restarting.md) — Resets the execution of a previously started program with specified parameters and pauses execution automatically upon reaching the entry point. ([source](https://docs.hyperdbg.org/commands/meta-commands/.restart.md)) - [Function Return Stepping](https://awesome-repositories.com/f/development-tools-productivity/instruction-stepping-tools/function-return-stepping.md) — Enables stepping out of functions by executing until a return instruction is encountered. ([source](https://docs.hyperdbg.org/commands/debugging-commands/gu.md)) - [Breakpoint Removal](https://awesome-repositories.com/f/development-tools-productivity/interactive-debug-consoles/breakpoint-debugging/breakpoint-removal.md) — Deletes active breakpoints from the target process or kernel to resume normal execution flow without interruption. ([source](https://docs.hyperdbg.org/commands/debugging-commands/bc.md)) - [Debuggee](https://awesome-repositories.com/f/development-tools-productivity/mathematical-calculators/expression-evaluators/debuggee.md) — Calculates and displays the result of mathematical or memory-dereferencing expressions within the target system context. ([source](https://docs.hyperdbg.org/commands/debugging-commands/print.md)) - [Memory Pattern Searching](https://awesome-repositories.com/f/development-tools-productivity/memory-pattern-searching.md) — Scans memory ranges for byte sequences or values to locate data structures or code patterns. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/displaying-and-editing-and-searching-memory.md)) - [Virtual](https://awesome-repositories.com/f/development-tools-productivity/memory-pattern-searching/virtual.md) — Scans memory ranges for specific byte, double-word, or quad-word patterns within a target process or kernel space to locate data. ([source](https://docs.hyperdbg.org/commands/debugging-commands/s.md)) - [Memory Search Tools](https://awesome-repositories.com/f/development-tools-productivity/memory-search-tools.md) — Scans a specified memory range or process for specific byte sequences or word values. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/displaying-and-editing-and-searching-memory.md)) - [User-Mode Process Attachments](https://awesome-repositories.com/f/development-tools-productivity/performance-debugging/kernel-debuggers/user-mode-process-attachments.md) — Connects to active user-mode processes at the hypervisor level to pause execution and intercept threads without standard OS APIs. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg.md)) - [Execution Pausing](https://awesome-repositories.com/f/development-tools-productivity/performance-debugging/kernel-debuggers/user-mode-process-attachments/execution-pausing.md) — Interrupts the execution of a running user-mode thread to allow for instruction stepping or state inspection. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg/start-process.md)) - [Symbol Table Inspection](https://awesome-repositories.com/f/development-tools-productivity/symbol-table-inspection.md) — Maps data structures and enumerations from symbol servers to interpret kernel memory. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [Task Automation Scripts](https://awesome-repositories.com/f/development-tools-productivity/task-automation-scripts.md) — Executes custom scripts to automate repetitive analysis routines and complex debugging workflows. ([source](https://cdn.jsdelivr.net/gh/hyperdbg/hyperdbg@master/README.md)) ### Operating Systems & Systems Programming - [Kernel-Mode Execution Models](https://awesome-repositories.com/f/operating-systems-systems-programming/file-system-drivers/kernel-mode-implementations/kernel-mode-execution-models.md) — Intercepts user-mode and kernel-mode activity using hardware-assisted virtualization to remain transparent to the target system. ([source](https://docs.hyperdbg.org/getting-started/quick-start.md)) - [Kernel Debuggers](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-debuggers.md) — Provides a kernel-mode debugging platform that uses hardware-assisted virtualization to monitor and control system execution. - [System Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-analysis-capabilities/system-debugging.md) — Provides low-level system debugging capabilities for inspecting kernel and user-mode execution flow and state. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md)) - [Virtual CPU Register Accessors](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-register-inspection/virtual-cpu-register-accessors.md) — Provides read and write access to general-purpose, control, and debug registers for system state manipulation. ([source](https://docs.hyperdbg.org/commands/scripting-language/assumptions-and-evaluations.md)) - [Memory Inspectors](https://awesome-repositories.com/f/operating-systems-systems-programming/direct-memory-access/memory-address-identification/memory-inspectors.md) — Reads and displays memory at specific addresses in various formats including hex bytes, double-words, or quad-words, optionally scoped to a specific process or physical address. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/displaying-and-editing-and-searching-memory.md)) - [Execution Flow Control](https://awesome-repositories.com/f/operating-systems-systems-programming/execution-flow-control.md) — Provides capabilities for controlling execution paths, stepping through code, and pausing processes during debugging. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics.md)) - [Virtual Machine Introspection Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/hardware-attached-virtual-machine-access/local-virtual-machine-attachments/virtual-machine-introspection-debugging.md) — Inspects and controls the execution state of virtualized guest systems by hooking hardware events and memory access. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes.md)) - [System and Hardware Event Hooks](https://awesome-repositories.com/f/operating-systems-systems-programming/hardware-interfacing-drivers/input-event-interception/system-and-hardware-event-hooks.md) — Hooks processor instructions, interrupts, and memory operations to trigger custom logic during kernel and user-mode execution. ([source](https://cdn.jsdelivr.net/gh/hyperdbg/hyperdbg@master/README.md)) - [Hypervisor Presence Obfuscation](https://awesome-repositories.com/f/operating-systems-systems-programming/hypervisor-exit-analysis/hypervisor-presence-obfuscation.md) — Obfuscates the analysis tool to resist detection by timing or microarchitectural attacks. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes.md)) - [Cross-Mode Execution Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-component-debugging/cross-mode-execution-debugging.md) — Monitors both user-mode and kernel-mode processes by virtualizing the system for unified execution tracking. ([source](https://docs.hyperdbg.org/readme.md)) - [System-Wide Virtualized Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-component-debugging/system-wide-virtualized-debugging.md) — Monitors system execution by virtualizing the operating system to analyze both kernel and user-mode applications. ([source](https://docs.hyperdbg.org/readme.md)) - [Stealthy Kernel Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-component-debugging/system-wide-virtualized-debugging/stealthy-kernel-debugging.md) — Uses hardware virtualization to monitor system events and memory access without modifying the target environment. ([source](https://cdn.jsdelivr.net/gh/hyperdbg/hyperdbg@master/README.md)) - [Memory Inspection Tools](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-inspection-tools.md) — Reads, writes, and searches raw memory contents to analyze data structures or inject changes into target processes. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics.md)) - [Kernel Function Instrumentation](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-function-instrumentation.md) — Uses hardware-assisted virtualization to intercept system events and monitor execution without modifying the target kernel. - [Kernel Execution Analysis](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-task-inspection/kernel-execution-analysis.md) — Analyzes kernel-mode processes using a hypervisor to monitor memory and instruction flow without standard OS interfaces. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/principles.md)) - [Stealthy Memory Hook Implementations](https://awesome-repositories.com/f/operating-systems-systems-programming/paged-memory-management/custom-memory-hooks/stealthy-memory-hook-implementations.md) — Intercepts memory access and execution using extended page tables to create invisible hooks. ([source](https://docs.hyperdbg.org/readme.md)) - [Page Table Entry Management](https://awesome-repositories.com/f/operating-systems-systems-programming/paged-memory-management/page-table-entry-management.md) — Intercepts memory access and execution by manipulating page table permissions at the hardware level. ([source](https://docs.hyperdbg.org/commands/extension-commands/pte.md)) - [Physical and Virtual Memory Operations](https://awesome-repositories.com/f/operating-systems-systems-programming/physical-and-virtual-memory-operations.md) — Provides low-level primitives for reading and writing raw physical and virtual memory addresses to inspect or modify system state. ([source](https://docs.hyperdbg.org/commands/scripting-language.md)) - [Processor State Managers](https://awesome-repositories.com/f/operating-systems-systems-programming/processor-state-control/processor-state-managers.md) — Views and updates CPU registers and flags to control execution flow during analysis. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics.md)) - [Remote Kernel Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/remote-kernel-debugging.md) — Inspects and controls kernel state through breakpoints, instruction stepping, and memory modification. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [System-Call Interception](https://awesome-repositories.com/f/operating-systems-systems-programming/system-call-interception.md) — Monitors system call execution with process-specific filtering and conditional triggering to modify system behavior. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md)) - [Stealthy Execution Modifiers](https://awesome-repositories.com/f/operating-systems-systems-programming/windows-registry-modifiers/process-execution-modifiers/stealthy-execution-modifiers.md) — Alters execution paths by modifying registers or memory from the hypervisor level, ensuring changes remain invisible. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples/patch-the-normal-sequence-of-execution.md)) - [Assembly Assemblers](https://awesome-repositories.com/f/operating-systems-systems-programming/assembly-instruction-references/assembly-assemblers.md) — Converts human-readable assembly code into executable machine instructions and writes them directly into memory for analysis. ([source](https://docs.hyperdbg.org/commands/debugging-commands/a.md)) - [Custom Instrumentation Assemblers](https://awesome-repositories.com/f/operating-systems-systems-programming/assembly-instruction-references/assembly-assemblers/custom-instrumentation-assemblers.md) — Runs arbitrary machine code instructions when specific events trigger to perform low-level instrumentation. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites.md)) - [Atomic Thread Synchronization](https://awesome-repositories.com/f/operating-systems-systems-programming/atomic-thread-synchronization.md) — Implements spinlocks and atomic primitives to manage thread synchronization and prevent race conditions during debugging tasks. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions.md)) - [Binary Assembly and Disassembly](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-analysis-capabilities/binary-assembly/binary-assembly-and-disassembly.md) — Translates raw memory at specified virtual addresses into human-readable assembly instructions for analysis. ([source](https://docs.hyperdbg.org/commands/debugging-commands/u.md)) - [Binary Disassembly](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-analysis-capabilities/binary-assembly/binary-disassembly.md) — Converts raw binary instructions into human-readable assembly language for analysis. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/diassembler.md)) - [Disassemblers](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-dumping/physical-memory-dumping-tools/disassemblers.md) — Translates raw bytes at a specified physical memory address into human-readable assembly instructions for analysis and debugging purposes. ([source](https://docs.hyperdbg.org/commands/extension-commands/u.md)) - [Structured Memory Dumping](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-dumping/structured-memory-dumping.md) — Translates raw memory into defined data structures and enumerations using symbol information to visualize complex kernel objects. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [Physical Memory Dumping](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-dumping/structured-memory-dumping/credential-memory-dumping/physical-memory-dumping.md) — Transfers bytes between physical memory addresses for low-level data manipulation. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/memory/memcpy_pa.md)) - [Guest Memory Analyzers](https://awesome-repositories.com/f/operating-systems-systems-programming/binary-memory-loading/guest-memory-analyzers.md) — Dumps virtual memory to files and forces memory pages into RAM for detailed inspection. ([source](https://docs.hyperdbg.org/commands/meta-commands.md)) - [CPUID Interceptors](https://awesome-repositories.com/f/operating-systems-systems-programming/computer-architecture/instruction-execution-models/instruction-hooking/cpuid-interceptors.md) — Hooks the execution of CPUID instructions in kernel or user mode to inspect or modify register values. ([source](https://docs.hyperdbg.org/commands/extension-commands/cpuid.md)) - [System Instruction Interceptors](https://awesome-repositories.com/f/operating-systems-systems-programming/computer-architecture/instruction-execution-models/instruction-hooking/system-instruction-interceptors.md) — Intercepts execution of hardware-level instructions like CPUID, MSR, TSC, or I/O operations to analyze system behavior. ([source](https://docs.hyperdbg.org/commands/extension-commands.md)) - [Time Stamp Counter Interceptions](https://awesome-repositories.com/f/operating-systems-systems-programming/computer-architecture/instruction-execution-models/instruction-hooking/time-stamp-counter-interceptions.md) — Provides hooks for RDTSC and RDTSCP instructions to trigger debugger breaks or custom scripts during execution. ([source](https://docs.hyperdbg.org/commands/extension-commands/tsc.md)) - [XSETBV Instruction Interceptors](https://awesome-repositories.com/f/operating-systems-systems-programming/computer-architecture/instruction-execution-models/instruction-hooking/xsetbv-instruction-interceptors.md) — Hooks the execution of the XSETBV instruction to monitor or modify system register states. ([source](https://docs.hyperdbg.org/commands/extension-commands/xsetbv.md)) - [RDPMC Instruction Interceptors](https://awesome-repositories.com/f/operating-systems-systems-programming/computer-architecture/instruction-execution-models/rdpmc-instruction-interceptors.md) — Triggers debugger breaks upon execution of the RDPMC instruction to monitor performance counter access. ([source](https://docs.hyperdbg.org/commands/extension-commands/pmc.md)) - [Cross-Core Synchronization Primitives](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-core-synchronization/cross-core-synchronization-primitives.md) — Maintains global variables accessible by multiple cores to synchronize analysis tasks. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples.md)) - [Multi-Core Spinlock Synchronizers](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-core-synchronization/multi-core-spinlock-synchronizers.md) — Prevents race conditions when accessing shared global variables across multiple processor cores by implementing spinlocks within custom scripts. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples/access-to-a-shared-variable-from-different-cores.md)) - [Model Specific Register Inspection](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-register-inspection/model-specific-register-inspection.md) — Retrieves the current value of a specific model-specific register from processor cores to inspect low-level system configuration. ([source](https://docs.hyperdbg.org/commands/debugging-commands/rdmsr.md)) - [CPU Register Manipulators](https://awesome-repositories.com/f/operating-systems-systems-programming/cpu-register-manipulators.md) — Displays and updates processor registers and status flags to manipulate execution flow. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/showing-and-modifying-registers-and-flags.md)) - [Debug Symbol Loaders](https://awesome-repositories.com/f/operating-systems-systems-programming/debug-symbol-extractors/debug-symbol-loaders.md) — Loads debugging symbols and configures paths to map raw memory to human-readable names. ([source](https://docs.hyperdbg.org/commands/meta-commands.md)) - [Debugging Symbol Managers](https://awesome-repositories.com/f/operating-systems-systems-programming/debug-symbol-extractors/debug-symbol-loaders/debugging-symbol-managers.md) — Loads, unloads, and refreshes symbol files to map memory addresses to human-readable names. ([source](https://docs.hyperdbg.org/commands/meta-commands/.sym.md)) - [Debugger Process Management](https://awesome-repositories.com/f/operating-systems-systems-programming/debugger-process-management.md) — Lists active system processes and switches the debugger context to specific processes for analysis. ([source](https://docs.hyperdbg.org/commands/meta-commands/.process.md)) - [Memory Access Validators](https://awesome-repositories.com/f/operating-systems-systems-programming/direct-memory-access/memory-access-validators.md) — Verifies memory address accessibility to prevent system crashes during debugging operations. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples/change-system-state-registers-memory-variables.md)) - [Memory Address Identification](https://awesome-repositories.com/f/operating-systems-systems-programming/direct-memory-access/memory-address-identification.md) — Verifies the validity of memory addresses to prevent errors during debugging. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/memory.md)) - [Remote Physical Memory Writing](https://awesome-repositories.com/f/operating-systems-systems-programming/direct-memory-access/remote-physical-memory-writing.md) — Writes byte, dword, or qword values directly to physical memory addresses to alter system state. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/memory/eb_pa-ed_pa-eq_pa.md)) - [Execution Context Management](https://awesome-repositories.com/f/operating-systems-systems-programming/execution-context-management.md) — Controls thread contexts and memory mappings to isolate and examine specific execution flows. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md)) - [Execution Mode Transition Monitors](https://awesome-repositories.com/f/operating-systems-systems-programming/execution-context-management/execution-mode-transitions/execution-mode-transition-monitors.md) — Tracks switches between user-mode and kernel-mode execution to identify system calls, interrupts, or exceptions. ([source](https://docs.hyperdbg.org/commands/extension-commands/mode.md)) - [x86 I/O Port Accessors](https://awesome-repositories.com/f/operating-systems-systems-programming/file-i-o-management/i-o-polling/x86-i-o-port-accessors.md) — Hooks specific hardware I/O port instructions to trigger debugger breaks or execute custom scripts. ([source](https://docs.hyperdbg.org/commands/extension-commands/ioin.md)) - [Local Virtual Machine Attachments](https://awesome-repositories.com/f/operating-systems-systems-programming/hardware-attached-virtual-machine-access/local-virtual-machine-attachments.md) — Initiates a debugging session on the current host by inspecting the virtual machine state directly. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg.md)) - [Hardware Interface Controllers](https://awesome-repositories.com/f/operating-systems-systems-programming/hardware-capability-querying/hardware-interface-controllers.md) — Reads and writes model-specific registers and checks CPU capabilities to interface directly with low-level processor features. ([source](https://docs.hyperdbg.org/commands/debugging-commands.md)) - [Hardware Debug Register Monitors](https://awesome-repositories.com/f/operating-systems-systems-programming/hardware-register-diagnostics/hardware-debug-register-monitors.md) — Intercepts and analyzes access to hardware debug registers using virtualization-based hooks to trigger custom scripts or debugger breaks. ([source](https://docs.hyperdbg.org/commands/extension-commands/dr.md)) - [Runtime Binary Patching](https://awesome-repositories.com/f/operating-systems-systems-programming/in-memory-binary-patching/runtime-binary-patching.md) — Modifies binary instructions of a running process by writing directly to memory to alter program behavior. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/switching-to-a-specific-process-or-thread.md)) - [Kernel Component Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-component-debugging.md) — Halts the system to perform deep kernel-mode analysis and instruction stepping via serial connections. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes.md)) - [Physical Address Mapping](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/process-and-memory-management/memory-management-systems/physical-address-mapping.md) — Resolves physical memory addresses to corresponding virtual addresses within process contexts. ([source](https://docs.hyperdbg.org/commands/extension-commands/pa2va.md)) - [Interrupt Descriptor Tables](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/system-programming-primitives/system-programming/hardware-interfaces/pci-bus-management/interrupt-controllers/interrupt-vector-handlers/interrupt-descriptor-tables.md) — Displays current entries of the Interrupt Descriptor Table to analyze interrupt handling. ([source](https://docs.hyperdbg.org/commands/extension-commands/idt.md)) - [External Interrupt Interceptors](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-core-internals/system-programming-primitives/system-programming/hardware-interfaces/pci-bus-management/interrupt-controllers/interrupt-vector-handlers/interrupt-descriptor-tables/external-interrupt-interceptors.md) — Hooks hardware interrupts within the interrupt descriptor table to trigger analysis events before or after the interrupt is injected. ([source](https://docs.hyperdbg.org/commands/extension-commands/interrupt.md)) - [Process Context Selection](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-execution-context-layering/process-context-handlers/context-switching-implementations/process-context-selection.md) — Allows isolating debugging operations to a specific process or thread context. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/switching-to-a-specific-process-or-thread.md)) - [Kernel Execution Halters](https://awesome-repositories.com/f/operating-systems-systems-programming/kernel-task-inspection/kernel-execution-analysis/kernel-execution-halters.md) — Stops the entire system to allow stepping through and instrumenting individual kernel instructions. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes.md)) - [Integer Atomic Operations](https://awesome-repositories.com/f/operating-systems-systems-programming/lock-free-atomic-containers/integer-atomic-operations.md) — Executes thread-safe atomic arithmetic on shared variables across multiple processor cores to ensure accurate event counting. ([source](https://docs.hyperdbg.org/commands/scripting-language.md)) - [Memory Address Translation Layers](https://awesome-repositories.com/f/operating-systems-systems-programming/memory-address-translation-layers.md) — Converts between virtual and physical memory addresses for low-level system inspection. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/memory.md)) - [Memory Block Operations](https://awesome-repositories.com/f/operating-systems-systems-programming/memory-block-operations.md) — Evaluates memory regions to identify differences or verify identical contents during debugging. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/memory.md)) - [Memory Content Manipulation](https://awesome-repositories.com/f/operating-systems-systems-programming/memory-content-manipulation.md) — Writes arbitrary values to memory addresses to patch code or modify data structures at runtime. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples/change-system-state-registers-memory-variables.md)) - [Multi-Process Debug Sessions](https://awesome-repositories.com/f/operating-systems-systems-programming/multi-process-debug-sessions.md) — Manages and switches between multiple process or thread contexts to analyze complex multi-tasking environments. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [Operating System State Analysis](https://awesome-repositories.com/f/operating-systems-systems-programming/operating-system-state-analysis.md) — Displays stack backtraces, loaded modules, and system status to provide context on the current execution environment. ([source](https://docs.hyperdbg.org/commands/debugging-commands.md)) - [Virtual Address Translators](https://awesome-repositories.com/f/operating-systems-systems-programming/paged-memory-management/virtual-address-translators.md) — Resolves virtual memory addresses to physical addresses, optionally scoped to specific processes. ([source](https://docs.hyperdbg.org/commands/extension-commands/va2pa.md)) - [Physical Memory Mapping](https://awesome-repositories.com/f/operating-systems-systems-programming/physical-memory-mapping.md) — Reads, writes, searches, and disassembles raw physical memory for analysis. ([source](https://docs.hyperdbg.org/commands/extension-commands.md)) - [Process Execution Launchers](https://awesome-repositories.com/f/operating-systems-systems-programming/process-execution-controls/process-execution-launchers.md) — Launches target applications from their entry point under debugger control to monitor execution from the start. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg.md)) - [Process Memory Scanners](https://awesome-repositories.com/f/operating-systems-systems-programming/process-memory-scanners.md) — Scans physical or virtual memory ranges for specific patterns within target processes. ([source](https://docs.hyperdbg.org/commands/extension-commands/s.md)) - [Process Tracing and Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/process-tracing-and-debugging.md) — Enables attaching to and monitoring local or remote processes for stealthy analysis and reverse engineering. ([source](https://docs.hyperdbg.org/getting-started/quick-start.md)) - [Process Launch and Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/process-tracing-and-debugging/process-launch-and-debugging.md) — Executes target applications and pauses at the entry point for hypervisor-level analysis. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg/start-process.md)) - [Raw Memory Block Copies](https://awesome-repositories.com/f/operating-systems-systems-programming/raw-memory-block-copies.md) — Transfers specified bytes between memory addresses to facilitate data inspection or modification. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/memory/memcpy.md)) - [Overlapping Memory Copies](https://awesome-repositories.com/f/operating-systems-systems-programming/raw-memory-block-copies/overlapping-memory-copies.md) — Transfers data between virtual or physical memory addresses to facilitate inspection and modification. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/memory.md)) - [Remote Debugging Bridges](https://awesome-repositories.com/f/operating-systems-systems-programming/remote-debugging-bridges.md) — Provides a dedicated message bus for connecting a host debugger to remote targets via serial or network protocols. ([source](https://docs.hyperdbg.org/getting-started/build-and-install.md)) - [Local Host Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/remote-kernel-debugging/local-host-debugging.md) — Analyzes host system execution directly without needing remote hardware or nested virtualization. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg/local-debugging.md)) - [Debugging Context Managers](https://awesome-repositories.com/f/operating-systems-systems-programming/runtime-debugging-contexts/debugging-context-managers.md) — Lists intercepted processes and threads and switches debugger focus between them using hypervisor-level control. ([source](https://docs.hyperdbg.org/commands/meta-commands/.switch.md)) - [Hypercall Interceptors](https://awesome-repositories.com/f/operating-systems-systems-programming/system-call-interception/hypercall-interceptors.md) — Provides mechanisms to intercept and analyze hypercalls for monitoring system behavior and injecting custom logic. ([source](https://docs.hyperdbg.org/commands/extension-commands/vmcall.md)) - [System Instrumentation Frameworks](https://awesome-repositories.com/f/operating-systems-systems-programming/system-instrumentation-frameworks.md) — Provides a toolkit for intercepting processor events, memory access, and system instructions for real-time analysis. - [System Memory Inspection](https://awesome-repositories.com/f/operating-systems-systems-programming/system-memory-inspection.md) — Reads, modifies, and searches for specific data patterns within system memory. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md)) - [Memory Write Operations](https://awesome-repositories.com/f/operating-systems-systems-programming/target-memory-managers/memory-write-operations.md) — Provides the ability to modify target process memory to alter program state during debugging. ([source](https://docs.hyperdbg.org/commands/debugging-commands/e.md)) - [Target Memory Reading](https://awesome-repositories.com/f/operating-systems-systems-programming/target-memory-managers/target-memory-reading.md) — Retrieves and displays raw data from specific memory addresses in the debuggee using various formatting styles. ([source](https://docs.hyperdbg.org/commands/extension-commands/d.md)) - [Modular Scripting](https://awesome-repositories.com/f/operating-systems-systems-programming/terminal-command-line-environments/shells-scripting/modular-scripting.md) — Organizes debugging and automation logic into discrete, dynamically loaded script files for improved maintainability. ([source](https://docs.hyperdbg.org/commands/scripting-language/casting-and-inclusion.md)) - [Execution Thread Managers](https://awesome-repositories.com/f/operating-systems-systems-programming/thread-inspection/multi-threaded-debugging/execution-thread-managers.md) — Inspects active threads and switches execution context to specific threads for analysis. ([source](https://docs.hyperdbg.org/commands/meta-commands/.thread.md)) - [Memory Dumpers](https://awesome-repositories.com/f/operating-systems-systems-programming/virtual-memory-management/virtual-memory-inspectors/memory-dumpers.md) — Writes specified ranges of virtual memory from a target process or system state to a local file. ([source](https://docs.hyperdbg.org/commands/meta-commands/.dump.md)) - [Instruction-Level Debugging](https://awesome-repositories.com/f/operating-systems-systems-programming/virtualization-emulation/virtualization-platforms/virtualization-configuration/instruction-level-debugging.md) — Enables full control over virtualized environments, including pausing execution and instruction-level inspection. ([source](https://docs.hyperdbg.org/getting-started/build-and-install.md)) ### Part of an Awesome List - [Debugging and Analysis](https://awesome-repositories.com/f/awesome-lists/devtools/debugging-and-analysis.md) — Links the debugger to local or remote targets for kernel-mode and user-mode analysis. ([source](https://docs.hyperdbg.org/commands/meta-commands/.connect.md)) - [Stealth Debugging Layers](https://awesome-repositories.com/f/awesome-lists/devtools/debugging-and-analysis/stealth-debugging-layers.md) — Conceals the analysis environment from the target system by masking timing discrepancies and avoiding standard software debugging interfaces. - [System Memory Managers](https://awesome-repositories.com/f/awesome-lists/devtools/memory-and-system/system-memory-managers.md) — Displays, edits, and searches memory regions and modifies processor registers. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [Symbolic Data Structure Mapping](https://awesome-repositories.com/f/awesome-lists/data/data-structures-and-memory/symbolic-data-structure-mapping.md) — Maps memory layouts and creates custom structures based on symbols to simplify data interpretation. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics.md)) - [Symbolic Memory Inspectors](https://awesome-repositories.com/f/awesome-lists/data/data-structures-and-memory/symbolic-memory-inspectors.md) — Maps data, defines structures, and searches memory contents using symbol information to interpret complex system state. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md)) - [Dynamic Analysis and Debugging](https://awesome-repositories.com/f/awesome-lists/devops/dynamic-analysis-and-debugging.md) — Switches debugging focus to specific processes or threads to isolate execution context. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics.md)) - [Guest Execution Inspectors](https://awesome-repositories.com/f/awesome-lists/devtools/debugging-and-inspection/guest-execution-inspectors.md) — Provides a debugging environment to halt and step through user-mode applications and execute scripts in both user and kernel modes. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes.md)) - [Automated Debugging Workflows](https://awesome-repositories.com/f/awesome-lists/devtools/development-workflow/automated-debugging-workflows.md) — Executes custom scripts and conditional logic to automate repetitive analysis tasks without manual intervention. - [Debug Symbol Resolvers](https://awesome-repositories.com/f/awesome-lists/devtools/unpacking-and-deobfuscation/trace-symbol-resolvers/debug-symbol-resolvers.md) — Parses debugging symbols to map memory addresses to human-readable names and reconstruct data structures for inspection. ([source](https://cdn.jsdelivr.net/gh/hyperdbg/hyperdbg@master/README.md)) - [Binary Analysis](https://awesome-repositories.com/f/awesome-lists/devtools/binary-analysis.md) — Provides a hypervisor-based debugger for Windows. ### Hardware & IoT - [Hardware Exception Interceptors](https://awesome-repositories.com/f/hardware-iot/connectivity-iot/internet-of-things/device-management/peripheral-device-managers/interrupt-handlers/hardware-exception-handlers/hardware-exception-interceptors.md) — Hooks specific processor faults, traps, or aborts within the interrupt descriptor table to trigger analysis. ([source](https://docs.hyperdbg.org/commands/extension-commands/exception.md)) - [Model Specific Register Modifiers](https://awesome-repositories.com/f/hardware-iot/low-level-protocol-control/register-management/model-specific-register-modifiers.md) — Updates the value of specific model-specific registers on target processor cores during debugging sessions. ([source](https://docs.hyperdbg.org/commands/debugging-commands/wrmsr.md)) ### Programming Languages & Runtimes - [EPT Execution Interceptors](https://awesome-repositories.com/f/programming-languages-runtimes/execution-flow-control/runtime-execution-interception/ept-execution-interceptors.md) — Hooks memory addresses using Extended Page Tables to trigger debugger actions or custom code execution for high-performance stealth analysis. ([source](https://docs.hyperdbg.org/commands/extension-commands/epthook2.md)) - [Batch Scripts](https://awesome-repositories.com/f/programming-languages-runtimes/cli-script-execution/batch-scripts.md) — Runs sequences of commands from text files to automate repetitive analysis or configuration tasks. ([source](https://docs.hyperdbg.org/commands/meta-commands/.script.md)) - [Execution Context Switching](https://awesome-repositories.com/f/programming-languages-runtimes/concurrent-thread-execution/execution-context-switching.md) — Changes the debugger focus between processes and threads to analyze targeted execution flows. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [Conditional Logic](https://awesome-repositories.com/f/programming-languages-runtimes/conditional-logic.md) — Evaluates expressions based on register or memory states to branch execution flow using conditional structures. ([source](https://docs.hyperdbg.org/commands/scripting-language/conditionals-and-loops.md)) - [Event-Driven Execution Halters](https://awesome-repositories.com/f/programming-languages-runtimes/execution-yielding-pausing/event-driven-execution-halters.md) — Stops all CPU cores when a specific event occurs, preventing further instructions from running until user permission. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites.md)) - [Expression Evaluators](https://awesome-repositories.com/f/programming-languages-runtimes/expression-evaluators.md) — Processes expressions using standard syntax to support memory dereferencing and bitwise logic. ([source](https://docs.hyperdbg.org/commands/scripting-language/assumptions-and-evaluations.md)) - [Scripted Analysis Evaluators](https://awesome-repositories.com/f/programming-languages-runtimes/expression-evaluators/scripted-analysis-evaluators.md) — Executes mathematical expressions or multi-line scripts within the target process or kernel environment. ([source](https://docs.hyperdbg.org/commands/debugging-commands/eval.md)) - [Halters](https://awesome-repositories.com/f/programming-languages-runtimes/generator-functions/function-execution-models/conditional-execution/halters.md) — Triggers a debugger pause when specific memory conditions or function arguments are met during execution. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples/pause-the-debugger-conditionally.md)) - [Thread-Synchronized Execution](https://awesome-repositories.com/f/programming-languages-runtimes/language-features-paradigms/concurrency-models/concurrency/execution-models/multi-threaded-execution/thread-synchronized-execution.md) — Acquires spinlocks on global variables to ensure exclusive access to shared resources during multi-threaded script execution. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/spinlocks.md)) - [Program Execution](https://awesome-repositories.com/f/programming-languages-runtimes/program-execution.md) — Modifies memory at a specific address to change the flow of a running program. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/switching-to-a-specific-process-or-thread.md)) - [System Halting](https://awesome-repositories.com/f/programming-languages-runtimes/stop-the-world-pauses/system-halting.md) — Interrupts the processor and transfers control to the debugger to allow for manual inspection of system state. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/debugger/pause.md)) - [Stack Backtrace Generators](https://awesome-repositories.com/f/programming-languages-runtimes/webassembly-binary-manipulators/64-bit-memory-support/32-64-bit-architecture-support/stack-backtrace-generators.md) — Retrieves and displays the current thread's call stack, supporting both 32-bit and 64-bit execution environments. ([source](https://docs.hyperdbg.org/commands/debugging-commands/k.md)) ### Scientific & Mathematical Computing - [Process and Thread Contexts](https://awesome-repositories.com/f/scientific-mathematical-computing/parallel-computation-thread-pools/threading-mode-switching/process-and-thread-contexts.md) — Provides the ability to switch between processes and threads to inspect specific execution contexts during debugging. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/switching-to-a-specific-process-or-thread.md)) ### Security & Cryptography - [Anti-Debugger Bypassing](https://awesome-repositories.com/f/security-cryptography/anti-debugger-bypassing.md) — Evades detection by avoiding standard APIs and masking hypervisor presence against timing-based checks. ([source](https://docs.hyperdbg.org/readme.md)) - [Anti-Debugging Evasion](https://awesome-repositories.com/f/security-cryptography/anti-detection-strategies/anti-debugging-evasion.md) — Defeats anti-debugging techniques by masking timing discrepancies and avoiding standard interfaces. ([source](https://docs.hyperdbg.org/readme.md)) - [Hypervisor Obfuscation](https://awesome-repositories.com/f/security-cryptography/debugger-detection/hypervisor-obfuscation.md) — Hides the hypervisor from detection techniques to prevent software from identifying the analysis environment. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/operation-modes.md)) - [Transparent Debugging Modes](https://awesome-repositories.com/f/security-cryptography/debugger-stealth/transparent-debugging-modes.md) — Conceals the analysis tool from detection mechanisms by enabling a transparent execution mode. ([source](https://docs.hyperdbg.org/commands/extension-commands/hide.md)) - [Anti-Debugging Protections](https://awesome-repositories.com/f/security-cryptography/anti-debugging-protections.md) — Analyzes the environment to identify and report active anti-debugging or anti-hypervisor techniques. ([source](https://docs.hyperdbg.org/commands/extension-commands/measure.md)) - [Debugger Stealth](https://awesome-repositories.com/f/security-cryptography/debugger-stealth.md) — Exits transparent mode to stop hiding the debugger presence from the target system. ([source](https://docs.hyperdbg.org/commands/extension-commands/unhide.md)) - [Malware Analysis](https://awesome-repositories.com/f/security-cryptography/malware-analysis.md) — Monitors suspicious software behavior and intercepts system calls while remaining invisible to anti-debugging techniques. - [Runtime Memory Patching](https://awesome-repositories.com/f/security-cryptography/runtime-memory-patching.md) — Modifies target memory addresses to patch code or alter data during runtime analysis. ([source](https://docs.hyperdbg.org/commands/scripting-language/variables-and-assignments.md)) ### Software Engineering & Architecture - [Hypervisor-Context Scripting](https://awesome-repositories.com/f/software-engineering-architecture/custom-logic-scripts/hypervisor-context-scripting.md) — Runs user-defined logic within the hypervisor context upon specific events to modify registers or memory during runtime. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/how-to-create-an-action.md)) - [System Execution Interruptions](https://awesome-repositories.com/f/software-engineering-architecture/execution-interrupts/system-execution-interruptions.md) — Pauses the target system and transfers control to the debugger for manual inspection. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/how-to-create-an-action.md)) - [Branch Execution Histories](https://awesome-repositories.com/f/software-engineering-architecture/function-execution-utilities/execution-history-inspection/branch-execution-histories.md) — Saves processor branch entries into internal storage to reconstruct and inspect execution control flow. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/tracing.md)) - [Function Hooking](https://awesome-repositories.com/f/software-engineering-architecture/function-hooking.md) — Intercepts calls to specific kernel or user functions to monitor behavior, modify arguments, or redirect execution flow. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [Stealthy Hook Implementations](https://awesome-repositories.com/f/software-engineering-architecture/function-hooking/stealthy-hook-implementations.md) — Intercepts function calls using hidden hooks that operate with the speed of inline hooks while remaining invisible. ([source](https://docs.hyperdbg.org/readme.md)) - [Memory Access Breakpoints](https://awesome-repositories.com/f/software-engineering-architecture/shared-memory-management/memory-access-breakpoints.md) — Tracks read, write, or execution operations on specific memory ranges using hardware virtualization to trigger debugger actions. ([source](https://cdn.jsdelivr.net/gh/hyperdbg/hyperdbg@master/README.md)) - [Debugging Event Triggers](https://awesome-repositories.com/f/software-engineering-architecture/state-management/hardware-register-state-managers/register-configuration-managers/debugging-event-triggers.md) — Configures and transmits event triggers to the kernel to monitor specific system activities like instruction execution or memory hooks. ([source](https://docs.hyperdbg.org/using-hyperdbg/sdk/ioctl/event-registration.md)) - [Process Termination Utilities](https://awesome-repositories.com/f/software-engineering-architecture/application-termination-handlers/process-termination-utilities.md) — Stops the execution of processes currently being monitored or attached to by the debugger. ([source](https://docs.hyperdbg.org/commands/meta-commands/.kill.md)) - [System Context Retrievers](https://awesome-repositories.com/f/software-engineering-architecture/automation-execution-contexts/system-context-retrievers.md) — Exposes system state information such as process IDs, thread addresses, and environment block pointers through dedicated pseudo-registers. ([source](https://docs.hyperdbg.org/commands/scripting-language/assumptions-and-evaluations.md)) - [Custom Logic Scripts](https://awesome-repositories.com/f/software-engineering-architecture/custom-logic-scripts.md) — Performs complex calculations and data manipulations using a C-like scripting syntax. ([source](https://docs.hyperdbg.org/commands/scripting-language/constants-and-functions.md)) - [Dynamic Function Interception](https://awesome-repositories.com/f/software-engineering-architecture/dynamic-function-interception.md) — Hooks specific system or application functions to capture arguments and execution state for analysis. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples/trace-function-calls.md)) - [Execution Flow Analyzers](https://awesome-repositories.com/f/software-engineering-architecture/execution-flow-analyzers.md) — Disassembles machine code and manages branch recording data to reconstruct and trace execution paths. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions.md)) - [Event-Triggered](https://awesome-repositories.com/f/software-engineering-architecture/execution-pausing/event-triggered.md) — Halts all processor cores upon a triggered event to allow manual inspection of system state. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites.md)) - [System](https://awesome-repositories.com/f/software-engineering-architecture/execution-pausing/system.md) — Stops the system and transfers control to the debugger for manual inspection. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/how-to-create-an-action.md)) - [Branch Record Exporters](https://awesome-repositories.com/f/software-engineering-architecture/function-execution-utilities/execution-history-inspection/branch-execution-histories/branch-record-exporters.md) — Outputs captured branch entries to the console to visualize recent execution flow. ([source](https://docs.hyperdbg.org/commands/scripting-language/functions/tracing/lbr/lbr_print.md)) - [Memory Access Interception](https://awesome-repositories.com/f/software-engineering-architecture/integer-arithmetic/pointer-arithmetic/emulated-memory-access/memory-access-interception.md) — Identifies which instructions read from or write to specific memory structures. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md)) - [Hypervisor-Level Process Launches](https://awesome-repositories.com/f/software-engineering-architecture/integration-extensibility/workflow-automation-integrations/external-application-integrations/child-process-execution/background-process-launches/hypervisor-level-process-launches.md) — Launches programs with hypervisor-level interception to avoid reliance on standard operating system APIs. ([source](https://docs.hyperdbg.org/commands/meta-commands/.start.md)) - [Debug Message Buses](https://awesome-repositories.com/f/software-engineering-architecture/message-bus-systems/debug-message-buses.md) — Provides communication channels for routing system logs and debug information to external consoles. - [Execution Event Hooks](https://awesome-repositories.com/f/software-engineering-architecture/software-architecture/architectural-patterns/plugin-module-systems/modular-plugin-architectures/plugin-based-architectures/hook-based-plugin-systems/execution-event-hooks.md) — Attaches user-defined callbacks to low-level execution events like instructions, memory access, and syscalls. ([source](https://docs.hyperdbg.org/commands/extension-commands/epthook2.md)) - [Execution Event Managers](https://awesome-repositories.com/f/software-engineering-architecture/state-management/hardware-register-state-managers/register-configuration-managers/debugging-event-triggers/execution-event-managers.md) — Controls the triggering and forwarding of system events to monitor specific behaviors. ([source](https://docs.hyperdbg.org/getting-started/quick-start.md)) - [Programmatic Debugging Event Registration](https://awesome-repositories.com/f/software-engineering-architecture/state-management/hardware-register-state-managers/register-configuration-managers/debugging-event-triggers/programmatic-debugging-event-registration.md) — Triggers specific debugging events or monitoring actions by sending control codes directly to the hypervisor interface. ([source](https://docs.hyperdbg.org/using-hyperdbg/sdk/ioctl.md)) - [System Event Handlers](https://awesome-repositories.com/f/software-engineering-architecture/state-management/hardware-register-state-managers/register-configuration-managers/debugging-event-triggers/system-event-handlers.md) — Configures and triggers custom handlers for system-level activities including syscalls and interrupts. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging.md)) - [System Event Managers](https://awesome-repositories.com/f/software-engineering-architecture/state-management/hardware-register-state-managers/register-configuration-managers/debugging-event-triggers/system-event-managers.md) — Controls the short-circuiting behavior of active system events to manage debugger processing. ([source](https://docs.hyperdbg.org/getting-started/quick-start.md)) - [User Register State Management](https://awesome-repositories.com/f/software-engineering-architecture/state-management/hardware-register-state-managers/register-state-preservation/user-register-state-management.md) — Displays and modifies processor registers and status flags to analyze execution state. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md)) - [MSR Write Interceptors](https://awesome-repositories.com/f/software-engineering-architecture/write-interception-middleware/msr-write-interceptors.md) — Provides hooks to monitor or modify model-specific register writes at the hypervisor level. ([source](https://docs.hyperdbg.org/commands/extension-commands/msrwrite.md)) ### System Administration & Monitoring - [Conditional Debugging Triggers](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/event-debugging-utilities/conditional-debugging-triggers.md) — Executes actions based on custom conditions defined via hex or assembly code. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/how-to-create-a-condition.md)) - [Kernel Execution Path Tracing](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/kernel-tracing-frameworks/kernel-execution-path-tracing.md) — Records function calls and return addresses to visualize execution paths and mode transitions. ([source](https://docs.hyperdbg.org/commands/extension-commands.md)) - [Kernel-Mode Target Connections](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/infrastructure-diagnostic-tools/connection-failure-debugging/kernel-mode-target-connections.md) — Establishes a live connection to a target system for kernel-mode inspection and control. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/beginning.md)) - [Hardware Virtualization Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/hardware-event-profilers/hardware-virtualization-monitoring.md) — Leverages hardware virtualization to track memory operations and code coverage without modifying the target environment. ([source](https://docs.hyperdbg.org/readme.md)) - [Process ID Attachment](https://awesome-repositories.com/f/system-administration-monitoring/process-id-attachment.md) — Intercepts and halts execution threads of a specific process using its identifier for analysis. ([source](https://docs.hyperdbg.org/getting-started/attach-to-hyperdbg.md)) - [Processor State Inspection](https://awesome-repositories.com/f/system-administration-monitoring/runtime-state-inspection/processor-state-inspection.md) — Reads processor registers, memory, and variables to provide a snapshot of the execution environment. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples.md)) - [Processor Register Modifiers](https://awesome-repositories.com/f/system-administration-monitoring/runtime-state-inspection/processor-state-inspection/processor-register-modifiers.md) — Allows direct modification of processor registers and flags to alter execution flow during debugging. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples.md)) - [Event Debugging Utilities](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/event-debugging-utilities.md) — Configures custom triggers for kernel or user-mode events by sending control codes to the hypervisor. ([source](https://docs.hyperdbg.org/using-hyperdbg/sdk.md)) - [Kernel Function Call Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/diagnostic-tools/diagnostics/execution-tracers/kernel-tracing-frameworks/kernel-execution-profilers/kernel-function-call-monitoring.md) — Logs function calls and parameters to monitor program flow and kernel interactions. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples.md)) - [System Return](https://awesome-repositories.com/f/system-administration-monitoring/execution-logs/instruction-tracing/system-return.md) — Intercepts the execution of sysret instructions to track transitions from kernel-mode to user-mode. ([source](https://docs.hyperdbg.org/commands/extension-commands/sysret.md)) - [Hardware Inspection](https://awesome-repositories.com/f/system-administration-monitoring/graphics-hardware-monitors/hardware-inspection.md) — Provides tools for querying technical specifications and hardware metadata like PCI devices, IDT entries, and APIC modes. ([source](https://cdn.jsdelivr.net/gh/hyperdbg/hyperdbg@master/README.md)) - [Remote Debug Execution Control](https://awesome-repositories.com/f/system-administration-monitoring/remote-device-controllers/remote-debug-execution-control.md) — Pauses execution, steps through kernel code, or resumes normal operation of a connected debuggee from the host. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/beginning/connecting-to-hyperdbg.md)) - [Processor Core Selection](https://awesome-repositories.com/f/system-administration-monitoring/runtime-state-inspection/processor-state-inspection/processor-core-selection.md) — Provides the ability to switch the debugger's focus between different CPU cores for granular kernel-mode analysis. ([source](https://docs.hyperdbg.org/commands/debugging-commands/core.md)) - [System Logging and Debugging](https://awesome-repositories.com/f/system-administration-monitoring/system-logging-and-debugging.md) — Captures session output to log files to maintain a record of analysis events. ([source](https://docs.hyperdbg.org/commands/meta-commands.md)) - [System Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/system-monitoring.md) — Observes system behavior in a non-intrusive mode that buffers messages and avoids halting the target environment. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/principles.md)) - [Event-Triggered Scripts](https://awesome-repositories.com/f/system-administration-monitoring/task-automation-scripts/event-triggered-scripts.md) — Executes custom scripts in response to specific system events to modify memory and register states. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites/how-to-create-an-action.md)) ### Testing & Quality Assurance - [Process Execution Control](https://awesome-repositories.com/f/testing-quality-assurance/general-testing-utilities/test-utilities-assertions/test-lifecycle-execution-control/testing-lifecycle-management/process-execution-control.md) — Manages the lifecycle of applications under analysis by starting, attaching, or terminating processes. ([source](https://docs.hyperdbg.org/commands/meta-commands.md)) - [Execution State Inspectors](https://awesome-repositories.com/f/testing-quality-assurance/general-testing-utilities/test-failure-debugging-tools/failure-verification-tools/execution-state-inspection/execution-state-inspectors.md) — Retrieves the current operational status of the target system, including connection details and active mode. ([source](https://docs.hyperdbg.org/commands/debugging-commands/status.md)) ### Data & Databases - [Iterative Task Execution](https://awesome-repositories.com/f/data-databases/collection-iterators/sequential-iterators/iterative-task-execution.md) — Repeats blocks of code using loops to automate repetitive analysis or data processing. ([source](https://docs.hyperdbg.org/commands/scripting-language/conditionals-and-loops.md)) - [System Event Counters](https://awesome-repositories.com/f/data-databases/frequency-analyzers/event-frequency-counters/system-event-counters.md) — Tracks and tallies the frequency of system events like page faults to identify performance patterns. ([source](https://docs.hyperdbg.org/commands/scripting-language/examples.md)) - [Memory Structure Overlays](https://awesome-repositories.com/f/data-databases/memory-mapped-data-structures/memory-structure-overlays.md) — Overlays defined data structures onto specific memory addresses to read or modify internal system values during debugging. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/basics/mapping-data-and-create-structures-and-enums-from-symbols.md)) ### DevOps & Infrastructure - [Hardware State Inspection](https://awesome-repositories.com/f/devops-infrastructure/automation-orchestration/task-execution-frameworks/state-inspection-tools/hardware-state-inspection.md) — Dumps and inspects low-level system components including PCI devices, interrupt tables, and APIC configurations. ([source](https://docs.hyperdbg.org/commands/extension-commands.md)) - [Code Injection Utilities](https://awesome-repositories.com/f/devops-infrastructure/execution-environments/code-execution-runtimes/code-execution-sandboxes/code-injection-utilities.md) — Executes user-defined machine code instructions in response to specific system events to extend debugger functionality. ([source](https://docs.hyperdbg.org/using-hyperdbg/prerequisites.md)) - [System Resource Fault Injections](https://awesome-repositories.com/f/devops-infrastructure/fault-tolerance/kernel-fault-injection/fault-injection-testing/system-resource-fault-injections.md) — Triggers custom interrupts, exceptions, and page faults into the target environment to test stability and error handling. ([source](https://cdn.jsdelivr.net/gh/hyperdbg/hyperdbg@master/README.md)) ### Game Development - [Memory Symbol Resolution](https://awesome-repositories.com/f/game-development/game-memory-modifiers/memory-address-mapping/symbolic-address-resolution/memory-symbol-resolution.md) — Maps binary addresses to human-readable function names and source code using external symbol servers. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples/beginning.md)) ### Mobile Development - [Navigation State Inspection](https://awesome-repositories.com/f/mobile-development/android-application-debugging/navigation-state-inspection.md) — Switches between active processes and threads to inspect specific execution contexts within the target environment. ([source](https://docs.hyperdbg.org/commands/meta-commands.md)) - [System-Level Debugging](https://awesome-repositories.com/f/mobile-development/android-application-debugging/system-level-debugging.md) — Intercepts exceptions, interrupts, and Model Specific Register accesses to monitor low-level hardware interactions. ([source](https://docs.hyperdbg.org/using-hyperdbg/kernel-mode-debugging/examples.md))