首页
社区
课程
招聘
[转帖]HyperDbg
发表于: 2010-4-22 20:22 6215

[转帖]HyperDbg

2010-4-22 20:22
6215
HyperDbg

HyperDbg is a kernel debugger that leverages hardware-assisted virtualization. More precisely, HyperDbg is based on a minimalistic hypervisor that is installed while the system runs. Compared to traditional kernel debuggers (e.g., WinDbg, SoftIce, Rasta R0 Debugger) HyperDbg is completely transparent to the kernel and can be used to debug kernel code without the need of serial (or USB) cables. For example, HyperDbg allows to single step the execution of the kernel, even when the kernel is executing exception and interrupt handlers. Compared to traditional virtual machine based debuggers (e.g., the VMware builtin debugger), HyperDbg does not require the kernel to be run as a guest of a virtual machine, although it is as powerful.

Note: the current version only supports Windows XP SP2 with no PAE. Please refer to the README file if you are experiencing video issues.


http://security.dico.unimi.it/hyperdbg/releases/hyperdbg_20100325_auto_1280x1024.zip

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 1
支持
分享
最新回复 (8)
雪    币: 246
活跃值: (10)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
2
我的是xp sp3,没法用了,呵呵
2010-4-22 21:37
0
雪    币: 7325
活跃值: (3803)
能力值: (RANK:1130 )
在线值:
发帖
回帖
粉丝
3
这个要求太高了
xp sp2 with no PAE...
2010-4-23 09:05
0
雪    币: 67
活跃值: (66)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
4
开源,免费的 好像不错 现在只是个原型版本 对环境要求比较苛刻..

下面是readme的内容
HyperDbg is a kernel debugger that leverages hardware-assisted
virtualization. More precisely, HyperDbg is based on a minimalistic hypervisor
that is installed while the system runs. Compared to traditional kernel
debuggers (e.g., WinDbg, SoftIce, Rasta R0 Debugger) HyperDbg is completely
transparent to the kernel and can be used to debug kernel code without the need
of serial (or USB) cables. For example, HyperDbg allows to single step the
execution of the kernel, even when the kernel is executing exception and
interrupt handlers. Compared to traditional virtual machine based debuggers
(e.g., the VMware builtin debugger), HyperDbg does not require the kernel to be
run as a guest of a virtual machine, although it is as powerful.

Once loaded, the debugger will sits in background and will pop up the GUI when
the F12 hot-key is pressed or when a debug event occurs.

The current version of HyperDbg is a prototype and will evolve drastically in
the future. Currently the debugger allows to set breakpoints, to single step
the execution of the kernel, to inspect the memory of the operating system and
of a particular process. However, the debugger currently does not distinguish
between threads, has limited support for kernel's symbols, and has does not
clone shared pages before setting a breakpoint. Future version of the debugger
will be based on an enhanced version of the hypervisor that guarantees complete
isolation and transparency.

HyperDbg currently only supports:

* systems with PS/2 keyboards
* systems with Intel VT-x
* systems running 32-bit OSes and applications (no PAE)
* Windows XP (SP2).

HyperDbg renders the GUI by writing directly to the memory of the video
card. Some video cards are known to give problems. The debugger does not work
correctly when the accelerated drivers for the following cards are loaded:

* Intel 82915g
* nvidia GeForce 9800GT
* nvidia GeForce GT 130

If you have any of the aforementioned cards (and you are using the accelerated
driver) or if the interface is not correctly rendered on the screen, you have
to disable the driver in order to be able to use HyperDbg. The driver used by
default by Windows XP does not give any problem.

See the file INSTALL for compilation instructions.

HyperDbg is developed by:

* Aristide Fattori    <joystick@security.dico.unimi.it>
* Lorenzo Martignoni  <martignlo@gmail.com>
* Roberto Paleari     <roberto.paleari@gmail.com>

Comments, suggestions, criticisms, and patches are very welcome and can be sent
by email to the authors.
2010-4-23 14:10
0
雪    币: 2134
活跃值: (14)
能力值: (RANK:170 )
在线值:
发帖
回帖
粉丝
5
ps/2满足了,sp2没有:(
2010-4-27 13:16
0
雪    币: 9049
活跃值: (4449)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
好东西,谢楼主了!
2010-4-28 11:22
0
雪    币: 287
活跃值: (25)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
7
已成功编译,稍后琢磨怎么使用。遇到问题再向大家请教
2010-4-28 13:34
0
雪    币: 287
活跃值: (25)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
8
我启动驱动的时候报#31错误,不知大家遇到没有?
2010-4-29 15:27
0
雪    币: 120
活跃值: (58)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
关注一下。环境的话要用Virtual Box里面再运行个Bochs,真够繁的。
2010-5-15 08:16
0
游客
登录 | 注册 方可回帖
返回
//