AwesomeREA.org

Tool

HyperDbg

Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. Its events include EPT-based hidden breakpoints and hooks, memory read, write and execute monitoring without the limits of hardware debug registers, monitoring of system calls, CPUID, MSRs, I/O ports, MMIO, exceptions and interrupts, and Intel PT and LBR branch tracing. A kernel-side script engine, PDB symbol support and an SDK automate analysis.

Requirements and limitations

  • Latest release at review: v0.24, published 2026-09-22 as a single compiled ZIP; the reviewed master commit is that release. The README and FAQ name Windows as the only supported OS. The v0.24 changelog reports that the kernel modules now compile on Linux, but Linux support is still under development.
  • Requires an Intel x64 processor with VT-x and EPT; AMD and ARM processors are not supported, and the FAQ says most features need a 4th-generation or later Intel processor. The driver is not digitally signed, so the documented setup enables VT-x in firmware and turns off driver signature enforcement and virtualization-based security on the debugged machine. The documentation recommends a guest VM under VMware Workstation, ESXi or KVM in Debugger Mode, because local VMI Mode cannot pause or step.
  • Building from source needs a recursive clone, Visual Studio 2026 and current Windows SDK and WDK releases; CI builds with Visual Studio 2022 and 2026. The user supplies the drivers, programs or systems to debug, and the README recommends OpenSecurityTraining2’s Reversing with HyperDbg (Dbg3301) course for getting started.
  • GPL-3.0 for HyperDbg and its submodules unless a file states otherwise; dependencies keep their own licenses. The README also describes transparency features aimed at debugger detection; this entry covers debugging and tracing only. The cited papers were not reviewed, and nothing was installed or run.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · HyperDbg/HyperDbg · Revision ff3ba35
  2. README.md#L136-L187 GitHub · HyperDbg/HyperDbg · Revision ff3ba35
  3. CHANGELOG.md GitHub · HyperDbg/HyperDbg · Revision ff3ba35
  4. LICENSE GitHub · HyperDbg/HyperDbg · Revision ff3ba35
  5. .github/workflows GitHub · HyperDbg/HyperDbg · Revision ff3ba35
  6. getting-started/build-and-install.md GitHub · HyperDbg/docs · Revision 8bc60c0
  7. getting-started/faq.md GitHub · HyperDbg/docs · Revision 8bc60c0
  8. https://github.com/HyperDbg/HyperDbg/releases/tag/v0.24