| description | Description of the 'unload' command in HyperDbg. |
|---|
unload
unload [remove] [ModuleName (string)]
Unloads the HyperDbg drivers and kernel modules from the target system.
[remove] (optional)
If you want to remove the installed driver. (See Remarks for more information)
[ModuleName (string)]
The name of the module that you want to unload.
| Module Name | Description |
|---|---|
| all | Loading all available modules |
| kd | Kernel module (parent module for all modules) |
| vmm | Hypervisor-related capabilities |
| trace | Tracing (Intel LBR, Intel PT) capabilities |
The following example unloads vmm module.
HyperDbg> unload vmm
The following example unloads all modules.
HyperDbg> unload all
The following example unloads vmm module and removes all drivers.
HyperDbg> unload remove vmm
The following example unloads all modules and removes all drivers.
HyperDbg> unload remove all
The following example unloads trace module.
HyperDbg> unload trace
The following example unloads kd module.
HyperDbg> unload kd
To unload the HyperDbg driver on the local machine, you need to use the following functions in libhyperdbg (depending on the module you want to load):
//
// All Modules
//
INT
hyperdbg_u_unload_all_modules();
//
// VMM Module
//
INT
hyperdbg_u_unload_vmm();
//
// KD (Kernel Debugger) Module
//
INT
hyperdbg_u_unload_kd();
//
// HyperTrace Module
//
INT
hyperdbg_u_unload_hypertrace_module();Later you can stop and uninstall (remove) the driver using the following SDK function:
INT
hyperdbg_u_stop_kd_driver();
INT
hyperdbg_u_uninstall_kd_driver();This command will continue the debuggee for some time (in Debugger Mode). This means that you lose the current context (registers & memory) after executing this command.
None