Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

HyperDbg Debugger - Introduction to Hypervisor-Assisted Reverse Engineering

OpenSecurityTraining2 via YouTube

Overview

Coursera Flash Sale
40% Off Coursera Plus for 3 Months!
Grab it
Learn to master HyperDbg, a hypervisor-assisted debugger, through this comprehensive 12-hour 59-minute course that covers essential debugging concepts, practical implementation, and advanced reverse engineering techniques. Begin with fundamental concepts including subsystems, operation modes, building processes, and lab setup procedures. Explore core debugging functionalities such as symbol handling, user debugger configuration, multi-core system debugging, and Windows internal processes and threads management. Master memory operations including reading and writing memory and registers, virtual memory searching, code disassembly, and stack, heap, and pool analysis. Develop proficiency in function call tracking, breakpoint implementation, and stepping techniques. Advance to scripting capabilities covering command evaluation, argument handling, variables, conditional statements, loops, resource sharing, and script engine functions. Investigate hooking mechanisms including classic hidden hooks, detours hooks, memory monitoring, event management, and buffer flushing. Examine system call hooks, return hooks, and Heaven's Gate techniques. Delve into virtualization technologies covering VT-x paging, EPT (Extended Page Tables), and memory considerations. Study advanced monitoring techniques for faults, exceptions, interrupts, MSRs, CPUID hooking, RDTSC/RDTSCP hooking, VMCALL monitoring, and debug register monitoring. Learn I/O debugging methods and explore practical applications including logging, batch scripts, CPU examination, PE parsing, build customization, settings configuration, DFIR event logging, event ignoring, memory management, event calling stages, and anti-debugging defeat techniques. Conclude with real-world debugging scenarios including socket connections and WinDbg debugging, providing a complete foundation for hypervisor-assisted reverse engineering and advanced debugging methodologies.

Syllabus

Dbg3301: HyperDbg 01 01 Intro and Overview
Dbg3301: HyperDbg 02 01 Concepts
Dbg3301: HyperDbg 02 02 Subsystems and Operation Modes
Dbg3301: HyperDbg 02 03 Building and Attaching
Dbg3301: HyperDbg 02 04 HyperDbg Lab Setup
Dbg3301: HyperDbg 03 01 Intro and Symbols
Dbg3301: HyperDbg 03 02 User Debugger Setup
Dbg3301: HyperDbg 03 03 kHyperDbg
Dbg3301: HyperDbg 03 04 Debugging Multi-Core Systems
Dbg3301: HyperDbg 03 05 Windows Internal Basics: Processes & Threads
Dbg3301: HyperDbg 03 06 Debugging Processes & Threads (Kernel)
Dbg3301: HyperDbg 03 07 List Modules
Dbg3301: HyperDbg 03 08 Structures
Dbg3301: HyperDbg 03 09 Read Write Memory
Dbg3301: HyperDbg 03 10 Read Write Registers
Dbg3301: HyperDbg 03 11 Searching Virtual Memory
Dbg3301: HyperDbg 03 12 Disassembling Code
Dbg3301: HyperDbg 03 13 Stack Heaps Pools
Dbg3301: HyperDbg 03 14 Tracking Function Calls
Dbg3301: HyperDbg 03 15 Breakpoints
Dbg3301: HyperDbg 03 16 Stepping
Dbg3301: HyperDbg 03 17 Hands on Recap
Dbg3301: HyperDbg 04 01 Intro and Scripting Preliminaries
Dbg3301: HyperDbg 04 02 Evaluating Commands
Dbg3301: HyperDbg 04 03 Command Arguments
Dbg3301: HyperDbg 04 04 Variables and Assignment
Dbg3301: HyperDbg 04 05 Conditional Statements
Dbg3301: HyperDbg 04 06 Loops
Dbg3301: HyperDbg 04 07 Resource Sharing
Dbg3301: HyperDbg 04 08 Script Engine Functions
Dbg3301: HyperDbg 04 09 Hands on Recap
Dbg3301: HyperDbg 05 01 Intro and Classic Hidden Hooks
Dbg3301: HyperDbg 05 02 Detours Hooks
Dbg3301: HyperDbg 05 03 Memory Monitor
Dbg3301: HyperDbg 05 04 Managing Events
Dbg3301: HyperDbg 05 05 Flushing Buffers
Dbg3301: HyperDbg 05 06 Hands on Recap
Dbg3301: HyperDbg 06 01 Intro and System Call Hooks
Dbg3301: HyperDbg 06 02 System Call Return Hooks
Dbg3301: HyperDbg 06 03 Heavens Gate
Dbg3301: HyperDbg 06 04 Hands on Recap
Dbg3301: HyperDbg 07 01 Intro VT x Paging EPT
Dbg3301: HyperDbg 07 02 Memory Considerations
Dbg3301: HyperDbg 08 01 Faults Exceptions Interrupts
Dbg3301: HyperDbg 08 02 MSRs
Dbg3301: HyperDbg 08 03 CPUID Hooking
Dbg3301: HyperDbg 08 04 RDTSC RDTSCP Hooking
Dbg3301: HyperDbg 08 05 VMCALL Monitoring
Dbg3301: HyperDbg 08 06 Debug Register Monitoring
Dbg3301: HyperDbg 08 07 Hands on Recap
Dbg3301: HyperDbg 09 01 IO Debugging
Dbg3301: HyperDbg 10 01 Intro and Logging
Dbg3301: HyperDbg 10 02 Batch Scripts
Dbg3301: HyperDbg 10 03 Examining CPU
Dbg3301: HyperDbg 10 04 PE Parsing
Dbg3301: HyperDbg 10 05 Customizing Builds
Dbg3301: HyperDbg 10 06 Customizing Settings
Dbg3301: HyperDbg 10 07 DFIR Event Logging
Dbg3301: HyperDbg 10 08 Ignoring Events
Dbg3301: HyperDbg 10 09 Bringing Pages Into RAM
Dbg3301: HyperDbg 10 10 Event Calling Stages
Dbg3301: HyperDbg 10 11 Defeating Anti Debugging
Dbg3301: HyperDbg 11 01 Intro and Debugging Socket Connections
Dbg3301: HyperDbg 11 02 Debugging WinDbg
Dbg3301: HyperDbg 11 03 Conclusion

Taught by

OpenSecurityTraining2

Reviews

Start your review of HyperDbg Debugger - Introduction to Hypervisor-Assisted Reverse Engineering

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.