HyperDbg v0.23
State-of-the-art native debugging tools
HyperDbg Debugger
HyperDbg Debugger is an open-source, hypervisor-assisted debugger for Windows (Linux support is currently under development!) with support for both user-mode and kernel-mode (native) debugging. It is built for reverse engineering, fuzzing, and advanced system analysis using modern hardware virtualization and tracing features.
You can follow HyperDbg on Twitter or Mastodon to get notified about new releases, or join any of the HyperDbg groups, where you can ask developers and open-source reversing enthusiasts for help setting up and using HyperDbg.
Description
HyperDbg is built around modern hardware virtualization technologies to introduce capabilities beyond those of traditional debuggers. It runs on top of the operating system by virtualizing an already running system using Intel VT-x and Extended Page Tables (EPT). By combining virtualization with advanced tracing technologies such as Intel Processor Trace (Intel PT), HyperDbg provides powerful tracing and Virtual Machine Introspection (VMI) capabilities.
Core Capabilities
HyperDbg provides a wide range of advanced debugging features, including several types of EPT-based hidden hooks. It can emulate hardware data breakpoints for monitoring memory reads, writes, and executions at specific address ranges while remaining transparent to both the operating system and target applications. Unlike hardware debug registers, these monitoring facilities are not limited by the number of available debug registers or size constraints. Moreover, HyperDbg is capable of tracking execution across different privilege levels, including transitions from user mode to kernel mode (e.g., through system calls, heaven's gate, faults, exceptions, and interrupts), from the kernel to device drivers, and from kernel mode back to user mode, enabling comprehensive analysis of the entire execution flow.
In addition, HyperDbg supports system call hooking, control flow tracing through hardware tracing features, and comprehensive monitoring of I/O operations, including both Memory-Mapped I/O (MMIO) and Port-Mapped I/O (PMIO), enabling detailed analysis of device interactions and external peripherals.
Beyond that, HyperDbg includes a large collection of additional events specifically designed for reverse engineering, malware analysis, and low-level program analysis. For a complete list of supported events and their documentation, refer to the full feature list.
HyperDbg is designed to operate as stealthily as possible. It does not use any debugging APIs to debug the operating system or any application, so classic anti-debugging methods will not detect it. It also includes a specialized module designed to enhance its stealth capabilities. This module monitors attempts to detect the presence of a hypervisor or debugger and applies various techniques to first report and then mitigate or bypass such detection mechanisms. Although complete transparency cannot be guaranteed in all scenarios, these features significantly increase the difficulty of detecting HyperDbg, making it substantially harder for applications, packers, software protectors, malware, anti-cheat systems, and other security mechanisms to identify its presence.
Why HyperDbg?
HyperDbg is harder to set up and use, and also requires deeper low-level system knowledge compared to traditional debuggers. However, it provides two major advantages:
-
Full System & OS Control
HyperDbg operates at the hypervisor level, giving you powerful capabilities that are simply not possible with classic debuggers. This allows you to leverage hardware-assisted features for advanced reverse engineering and debugging scenarios. -
Stealth & Detection Resistance
Since HyperDbg doesn't rely on standard OS debugging APIs, it is generally much harder (though not impossible) to detect. This makes it a strong choice when working against anti-debugging protections.
These advantages open up entirely new debugging and reverse engineering techniques that go beyond what conventional debuggers can offer.
Build & Installation
You can download the latest compiled binary files from releases; otherwise, if you want to build HyperDbg, you should clone HyperDbg with the --recursive flag.
git clone --recursive https://github.com/HyperDbg/HyperDbg.git
Please visit Build & Install and Quick Start for a detailed explanation of how to start with HyperDbg. You can also see the FAQ for more information, or if you previously used other native debuggers like GDB, LLDB, or WinDbg, you could see the command map.