{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/HyperDbg/HyperDbg/blob/ff3ba351a1059ce558967aa45a2c70ed25620aa4/README.md#L136-L187",
    "https://github.com/HyperDbg/HyperDbg/blob/ff3ba351a1059ce558967aa45a2c70ed25620aa4/CHANGELOG.md",
    "https://github.com/HyperDbg/HyperDbg/blob/ff3ba351a1059ce558967aa45a2c70ed25620aa4/LICENSE",
    "https://github.com/HyperDbg/HyperDbg/tree/ff3ba351a1059ce558967aa45a2c70ed25620aa4/.github/workflows",
    "https://github.com/HyperDbg/docs/blob/8bc60c027e741b8c77bba2200423e27cd18d8ed1/getting-started/build-and-install.md",
    "https://github.com/HyperDbg/docs/blob/8bc60c027e741b8c77bba2200423e27cd18d8ed1/getting-started/faq.md",
    "https://github.com/HyperDbg/HyperDbg/releases/tag/v0.24"
  ],
  "category": "dynamic-analysis",
  "description_en": "Hypervisor-assisted Windows debugger that virtualizes the running system with Intel VT-x and Extended Page Tables to debug kernel and user mode, either locally as a tracing and introspection tool or from a host attached over a serial connection to a guest virtual machine. Its events include EPT-based hidden breakpoints and hooks, memory read, write and execute monitoring without the limits of hardware debug registers, monitoring of system calls, CPUID, MSRs, I/O ports, MMIO, exceptions and interrupts, and Intel PT and LBR branch tracing. A kernel-side script engine, PDB symbol support and an SDK automate analysis.",
  "description_zh": "借助虚拟化技术的 Windows 调试器：利用 Intel VT-x 和扩展页表（EPT）将正在运行的系统虚拟化，从而调试内核态和用户态代码；既可在本机作为跟踪与内省工具运行，也可从宿主机通过串行连接附加到客户虚拟机进行调试。其事件包括基于 EPT 的隐藏断点与钩子、不受硬件调试寄存器限制的内存读写和执行监控，对系统调用、CPUID、MSR、I/O 端口、MMIO、异常和中断的监控，以及 Intel PT 与 LBR 分支跟踪。内核侧脚本引擎、PDB 符号支持和 SDK 可用于自动化分析。",
  "entry_url": "https://awesomerea.org/resources/hyperdbg/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/hyperdbg/",
  "evidence_url": "https://github.com/HyperDbg/HyperDbg/blob/ff3ba351a1059ce558967aa45a2c70ed25620aa4/README.md",
  "group": "tools",
  "id": "hyperdbg",
  "json_url": "https://awesomerea.org/resources/hyperdbg/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/hyperdbg/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/hyperdbg/index.md",
  "name": "HyperDbg",
  "name_zh": "HyperDbg 虚拟化辅助调试器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v0.24, published 2026-09-22 as a single compiled ZIP; the reviewed master commit is that release. The README and FAQ name Windows as the only supported OS. The v0.24 changelog reports that the kernel modules now compile on Linux, but Linux support is still under development.",
    "Requires an Intel x64 processor with VT-x and EPT; AMD and ARM processors are not supported, and the FAQ says most features need a 4th-generation or later Intel processor. The driver is not digitally signed, so the documented setup enables VT-x in firmware and turns off driver signature enforcement and virtualization-based security on the debugged machine. The documentation recommends a guest VM under VMware Workstation, ESXi or KVM in Debugger Mode, because local VMI Mode cannot pause or step.",
    "Building from source needs a recursive clone, Visual Studio 2026 and current Windows SDK and WDK releases; CI builds with Visual Studio 2022 and 2026. The user supplies the drivers, programs or systems to debug, and the README recommends OpenSecurityTraining2’s Reversing with HyperDbg (Dbg3301) course for getting started.",
    "GPL-3.0 for HyperDbg and its submodules unless a file states otherwise; dependencies keep their own licenses. The README also describes transparency features aimed at debugger detection."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v0.24，发布于 2026-09-22，以单个编译好的 ZIP 提供；所审阅的 master 提交即该版本。README 和 FAQ 均称 Windows 是唯一受支持的操作系统。v0.24 的更新日志称内核模块现已可在 Linux 上编译，但 Linux 支持仍在开发中。",
    "需要支持 VT-x 和 EPT 的 Intel x64 处理器；不支持 AMD 和 ARM 处理器，FAQ 指出大部分功能需要第 4 代或更新的 Intel 处理器。其驱动没有数字签名，因此文档中的配置步骤要求在固件中启用 VT-x，并在被调试的机器上关闭驱动签名强制和基于虚拟化的安全（VBS）。文档建议在 VMware Workstation、ESXi 或 KVM 下的客户虚拟机中以调试器模式使用，因为本机的 VMI 模式无法暂停或单步执行。",
    "从源码构建需要递归克隆仓库，并安装 Visual Studio 2026 以及最新的 Windows SDK 和 WDK；CI 使用 Visual Studio 2022 和 2026 构建。待调试的驱动、程序或系统由使用者提供；README 推荐通过 OpenSecurityTraining2 的 Reversing with HyperDbg（Dbg3301）课程入门。",
    "HyperDbg 及其子模块除另有声明外均采用 GPL-3.0，依赖项适用各自的许可证。README 还介绍了针对调试器检测的透明化功能。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/HyperDbg/HyperDbg",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}