hyperhv.dll

Description:

Authors:

Version:

Architecture: 64-bit

Operating System:

SHA256: 5f663f01fb1c0b3db01495ef2e9326b8

File Size: 520.9 KB

Uploaded At: May 27, 2026, 7:15 p.m.

Views: 42

Exported Functions

  • BroadcastChangeAllMsrBitmapReadAllCores (Ordinal: 1, Address: 0x18a0)
  • BroadcastChangeAllMsrBitmapWriteAllCores (Ordinal: 2, Address: 0x18c0)
  • BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores (Ordinal: 3, Address: 0x18f0)
  • BroadcastDisableDbAndBpExitingAllCores (Ordinal: 4, Address: 0x1900)
  • BroadcastDisableEferSyscallEventsOnAllProcessors (Ordinal: 5, Address: 0x1910)
  • BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores (Ordinal: 6, Address: 0x1920)
  • BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores (Ordinal: 7, Address: 0x1940)
  • BroadcastDisableMovDebugRegistersExitingAllCores (Ordinal: 8, Address: 0x1950)
  • BroadcastDisableMovToControlRegistersExitingAllCores (Ordinal: 9, Address: 0x1960)
  • BroadcastDisableMovToCr3ExitingOnAllProcessors (Ordinal: 10, Address: 0x1980)
  • BroadcastDisableRdpmcExitingAllCores (Ordinal: 11, Address: 0x19b0)
  • BroadcastDisableRdtscExitingAllCores (Ordinal: 12, Address: 0x19c0)
  • BroadcastDisableRdtscExitingForClearingEventsAllCores (Ordinal: 13, Address: 0x19d0)
  • BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores (Ordinal: 14, Address: 0x19e0)
  • BroadcastEnableDbAndBpExitingAllCores (Ordinal: 15, Address: 0x19f0)
  • BroadcastEnableEferSyscallEventsOnAllProcessors (Ordinal: 16, Address: 0x1a00)
  • BroadcastEnableMovControlRegisterExitingAllCores (Ordinal: 17, Address: 0x1a10)
  • BroadcastEnableMovDebugRegistersExitingAllCores (Ordinal: 18, Address: 0x1a30)
  • BroadcastEnableMovToCr3ExitingOnAllProcessors (Ordinal: 19, Address: 0x1a40)
  • BroadcastEnableRdpmcExitingAllCores (Ordinal: 20, Address: 0x1a70)
  • BroadcastEnableRdtscExitingAllCores (Ordinal: 21, Address: 0x1a80)
  • BroadcastIoBitmapChangeAllCores (Ordinal: 22, Address: 0x1a90)
  • BroadcastIoBitmapResetAllCores (Ordinal: 23, Address: 0x1ab0)
  • BroadcastResetAllMsrBitmapWriteAllCores (Ordinal: 24, Address: 0x1ae0)
  • BroadcastResetChangeAllMsrBitmapReadAllCores (Ordinal: 25, Address: 0x1af0)
  • BroadcastResetExceptionBitmapAllCores (Ordinal: 26, Address: 0x1b00)
  • BroadcastSetExceptionBitmapAllCores (Ordinal: 27, Address: 0x1b20)
  • BroadcastSetExternalInterruptExitingAllCores (Ordinal: 28, Address: 0x1b40)
  • BroadcastUnsetExceptionBitmapAllCores (Ordinal: 29, Address: 0x1b50)
  • BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores (Ordinal: 30, Address: 0x1b70)
  • CheckAccessValidityAndSafety (Ordinal: 31, Address: 0x8c70)
  • CheckAccessValidityAndSafetyByProcessId (Ordinal: 32, Address: 0x8c80)
  • CheckAddressMaximumInstructionLength (Ordinal: 33, Address: 0x8dd0)
  • CheckAddressPhysical (Ordinal: 34, Address: 0x8f00)
  • CheckAddressValidityUsingTsx (Ordinal: 35, Address: 0x8f20)
  • ConfigureChangeIoBitmapOnSingleCore (Ordinal: 36, Address: 0x72c0)
  • ConfigureChangeMsrBitmapReadOnSingleCore (Ordinal: 37, Address: 0x72d0)
  • ConfigureChangeMsrBitmapWriteOnSingleCore (Ordinal: 38, Address: 0x72e0)
  • ConfigureDirtyLoggingInitializeOnAllProcessors (Ordinal: 39, Address: 0x72f0)
  • ConfigureDirtyLoggingUninitializeOnAllProcessors (Ordinal: 40, Address: 0x7300)
  • ConfigureDisableEferSyscallEventsOnAllProcessors (Ordinal: 41, Address: 0x7310)
  • ConfigureDisableMovToCr3ExitingOnAllProcessors (Ordinal: 42, Address: 0x7320)
  • ConfigureEnableEferSyscallEventsOnAllProcessors (Ordinal: 43, Address: 0x7330)
  • ConfigureEnableEferSyscallHookOnSingleCore (Ordinal: 44, Address: 0x7340)
  • ConfigureEnableMovToControlRegisterExitingOnSingleCore (Ordinal: 45, Address: 0x7350)
  • ConfigureEnableMovToCr3ExitingOnAllProcessors (Ordinal: 46, Address: 0x7370)
  • ConfigureEnableMovToDebugRegistersExitingOnSingleCore (Ordinal: 47, Address: 0x7380)
  • ConfigureEnableRdpmcExitingOnSingleCore (Ordinal: 48, Address: 0x7390)
  • ConfigureEnableRdtscExitingOnSingleCore (Ordinal: 49, Address: 0x73a0)
  • ConfigureEptHook (Ordinal: 50, Address: 0x73b0)
  • ConfigureEptHook2 (Ordinal: 51, Address: 0x73c0)
  • ConfigureEptHook2FromVmxRoot (Ordinal: 52, Address: 0x73e0)
  • ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks (Ordinal: 53, Address: 0x7400)
  • ConfigureEptHookFromVmxRoot (Ordinal: 54, Address: 0x7410)
  • ConfigureEptHookModifyInstructionFetchState (Ordinal: 55, Address: 0x7420)
  • ConfigureEptHookModifyPageReadState (Ordinal: 56, Address: 0x7440)
  • ConfigureEptHookModifyPageWriteState (Ordinal: 57, Address: 0x7460)
  • ConfigureEptHookMonitor (Ordinal: 58, Address: 0x7480)
  • ConfigureEptHookMonitorFromVmxRoot (Ordinal: 59, Address: 0x74a0)
  • ConfigureEptHookReservePreallocatedPoolsForEptHooks (Ordinal: 60, Address: 0x74c0)
  • ConfigureEptHookUnHookAllByHookingTag (Ordinal: 61, Address: 0x74d0)
  • ConfigureEptHookUnHookSingleAddress (Ordinal: 62, Address: 0x74e0)
  • ConfigureEptHookUnHookSingleAddressFromVmxRoot (Ordinal: 63, Address: 0x74f0)
  • ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot (Ordinal: 64, Address: 0x7500)
  • ConfigureExecTrapAddProcessToWatchingList (Ordinal: 65, Address: 0x7510)
  • ConfigureExecTrapApplyMbecConfiguratinFromKernelSide (Ordinal: 66, Address: 0x7520)
  • ConfigureExecTrapRemoveProcessFromWatchingList (Ordinal: 67, Address: 0x7540)
  • ConfigureInitializeExecTrapOnAllProcessors (Ordinal: 68, Address: 0x7550)
  • ConfigureModeBasedExecHookUninitializeOnAllProcessors (Ordinal: 69, Address: 0x7560)
  • ConfigureSetEferSyscallOrSysretHookType (Ordinal: 70, Address: 0x7570)
  • ConfigureSetExceptionBitmapOnSingleCore (Ordinal: 71, Address: 0x7590)
  • ConfigureSetExternalInterruptExitingOnSingleCore (Ordinal: 72, Address: 0x75a0)
  • ConfigureUninitializeExecTrapOnAllProcessors (Ordinal: 73, Address: 0x75b0)
  • CounterThreadHandle (Ordinal: 74, Address: 0x7d0c0)
  • CounterUpdater (Ordinal: 75, Address: 0x10670)
  • DirectVmcallChangeIoBitmap (Ordinal: 76, Address: 0x75c0)
  • DirectVmcallChangeMsrBitmapRead (Ordinal: 77, Address: 0x75e0)
  • DirectVmcallChangeMsrBitmapWrite (Ordinal: 78, Address: 0x7600)
  • DirectVmcallDisableEferSyscallEvents (Ordinal: 79, Address: 0x7620)
  • DirectVmcallDisableMov2CrExitingForClearingCrEvents (Ordinal: 80, Address: 0x7640)
  • DirectVmcallDisableMov2DrExitingForClearingDrEvents (Ordinal: 81, Address: 0x7660)
  • DirectVmcallDisableRdpmcExiting (Ordinal: 82, Address: 0x7680)
  • DirectVmcallDisableRdtscExitingForClearingTscEvents (Ordinal: 83, Address: 0x76a0)
  • DirectVmcallEnableEferSyscall (Ordinal: 84, Address: 0x76c0)
  • DirectVmcallEnableExternalInterruptExiting (Ordinal: 85, Address: 0x76e0)
  • DirectVmcallEnableMov2DebugRegsExiting (Ordinal: 86, Address: 0x7700)
  • DirectVmcallEnableMovToCrExiting (Ordinal: 87, Address: 0x7720)
  • DirectVmcallEnableRdpmcExiting (Ordinal: 88, Address: 0x7740)
  • DirectVmcallEnableRdtscpExiting (Ordinal: 89, Address: 0x7760)
  • DirectVmcallInvalidateEptAllContexts (Ordinal: 90, Address: 0x7780)
  • DirectVmcallInvalidateSingleContext (Ordinal: 91, Address: 0x77a0)
  • DirectVmcallPerformVmcall (Ordinal: 92, Address: 0x77c0)
  • DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents (Ordinal: 93, Address: 0x77e0)
  • DirectVmcallResetIoBitmap (Ordinal: 94, Address: 0x7800)
  • DirectVmcallResetMsrBitmapRead (Ordinal: 95, Address: 0x7820)
  • DirectVmcallResetMsrBitmapWrite (Ordinal: 96, Address: 0x7840)
  • DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents (Ordinal: 97, Address: 0x7860)
  • DirectVmcallSetExceptionBitmap (Ordinal: 98, Address: 0x7880)
  • DirectVmcallSetHiddenBreakpointHook (Ordinal: 99, Address: 0x78a0)
  • DirectVmcallTest (Ordinal: 100, Address: 0x78c0)
  • DirectVmcallUnhookSinglePage (Ordinal: 101, Address: 0x78e0)
  • DirectVmcallUnsetExceptionBitmap (Ordinal: 102, Address: 0x7900)
  • DisassemblerLengthDisassembleEngine (Ordinal: 103, Address: 0x36f0)
  • DisassemblerLengthDisassembleEngineByProcessId (Ordinal: 104, Address: 0x37e0)
  • DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess (Ordinal: 105, Address: 0x3880)
  • DisassemblerShowInstructionsInVmxNonRootMode (Ordinal: 106, Address: 0x38f0)
  • DisassemblerShowOneInstructionInVmxNonRootMode (Ordinal: 107, Address: 0x3af0)
  • DisassemblerShowOneInstructionInVmxRootMode (Ordinal: 108, Address: 0x3ce0)
  • DllInitialize (Ordinal: 109, Address: 0x2bc0)
  • DllUnload (Ordinal: 110, Address: 0x2bc0)
  • GetGuestCr0 (Ordinal: 111, Address: 0xe380)
  • GetGuestCr2 (Ordinal: 112, Address: 0xe390)
  • GetGuestCr3 (Ordinal: 113, Address: 0xe3a0)
  • GetGuestCr4 (Ordinal: 114, Address: 0xe3b0)
  • GetGuestCr8 (Ordinal: 115, Address: 0xe3c0)
  • GetGuestCs (Ordinal: 116, Address: 0xe3d0)
  • GetGuestDr0 (Ordinal: 117, Address: 0xe420)
  • GetGuestDr1 (Ordinal: 118, Address: 0xe430)
  • GetGuestDr2 (Ordinal: 119, Address: 0xe440)
  • GetGuestDr3 (Ordinal: 120, Address: 0xe450)
  • GetGuestDr6 (Ordinal: 121, Address: 0xe460)
  • GetGuestDr7 (Ordinal: 122, Address: 0xe470)
  • GetGuestDs (Ordinal: 123, Address: 0xe480)
  • GetGuestEs (Ordinal: 124, Address: 0xe4d0)
  • GetGuestFs (Ordinal: 125, Address: 0xe520)
  • GetGuestGdtr (Ordinal: 126, Address: 0xe570)
  • GetGuestGs (Ordinal: 127, Address: 0xe580)
  • GetGuestIdtr (Ordinal: 128, Address: 0xe5d0)
  • GetGuestLdtr (Ordinal: 129, Address: 0xe5e0)
  • GetGuestRFlags (Ordinal: 130, Address: 0xe5f0)
  • GetGuestRIP (Ordinal: 131, Address: 0xe600)
  • GetGuestSs (Ordinal: 132, Address: 0xe610)
  • GetGuestTr (Ordinal: 133, Address: 0xe660)
  • LayoutGetCr3ByProcessId (Ordinal: 134, Address: 0x9140)
  • LayoutGetCurrentProcessCr3 (Ordinal: 135, Address: 0x9180)
  • LayoutGetExactGuestProcessCr3 (Ordinal: 136, Address: 0x91a0)
  • LstarHook (Ordinal: 137, Address: 0x7d018)
  • MemoryManagerReadProcessMemoryNormal (Ordinal: 138, Address: 0x91d0)
  • MemoryManagerWritePhysicalMemoryNormal (Ordinal: 139, Address: 0x9370)
  • MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess (Ordinal: 140, Address: 0x9480)
  • MemoryMapperCheckIfPdeIsLargePageOnTargetProcess (Ordinal: 141, Address: 0x9550)
  • MemoryMapperCheckPteIsPresentOnTargetProcess (Ordinal: 142, Address: 0x9620)
  • MemoryMapperFreeMemoryOnTargetProcess (Ordinal: 143, Address: 0x9690)
  • MemoryMapperGetPteVa (Ordinal: 144, Address: 0x9790)
  • MemoryMapperGetPteVaByCr3 (Ordinal: 145, Address: 0x97a0)
  • MemoryMapperGetPteVaOnTargetProcess (Ordinal: 146, Address: 0x9800)
  • MemoryMapperGetPteVaWithoutSwitchingByCr3 (Ordinal: 147, Address: 0x9860)
  • MemoryMapperReadMemorySafe (Ordinal: 148, Address: 0x9a50)
  • MemoryMapperReadMemorySafeByPhysicalAddress (Ordinal: 149, Address: 0x9a80)
  • MemoryMapperReadMemorySafeFromVmxNonRootByPhysicalAddress (Ordinal: 150, Address: 0x9ab0)
  • MemoryMapperReadMemorySafeOnTargetProcess (Ordinal: 151, Address: 0x9ae0)
  • MemoryMapperReadMemoryUnsafe (Ordinal: 152, Address: 0x9d60)
  • MemoryMapperReserveUsermodeAddressOnTargetProcess (Ordinal: 153, Address: 0x9d90)
  • MemoryMapperSetExecuteDisableToPteOnTargetProcess (Ordinal: 154, Address: 0x9ee0)
  • MemoryMapperSetSupervisorBitWithoutSwitchingByCr3 (Ordinal: 155, Address: 0x9f60)
  • MemoryMapperWriteMemorySafe (Ordinal: 156, Address: 0xa060)
  • MemoryMapperWriteMemorySafeByPhysicalAddress (Ordinal: 157, Address: 0xa0a0)
  • MemoryMapperWriteMemorySafeFromVmxNonRootyPhysicalAddress (Ordinal: 158, Address: 0x9370)
  • MemoryMapperWriteMemorySafeOnTargetProcess (Ordinal: 159, Address: 0xa0d0)
  • MemoryMapperWriteMemoryUnsafe (Ordinal: 160, Address: 0xa3c0)
  • NotifyRoutineActive (Ordinal: 161, Address: 0x7d118)
  • OrigLstar (Ordinal: 162, Address: 0x7d0d0)
  • PciReadCam (Ordinal: 163, Address: 0x3470)
  • PciWriteCam (Ordinal: 164, Address: 0x35a0)
  • PhysicalAddressToVirtualAddress (Ordinal: 165, Address: 0x8f40)
  • PhysicalAddressToVirtualAddressByCr3 (Ordinal: 166, Address: 0x8f50)
  • PhysicalAddressToVirtualAddressByProcessId (Ordinal: 167, Address: 0x8fa0)
  • PhysicalAddressToVirtualAddressOnTargetProcess (Ordinal: 168, Address: 0x8ff0)
  • PoolManagerCheckAndPerformAllocationAndDeallocation (Ordinal: 169, Address: 0xa3f0)
  • PoolManagerFreePool (Ordinal: 170, Address: 0xa610)
  • PoolManagerRequestAllocation (Ordinal: 171, Address: 0xa700)
  • PoolManagerRequestPool (Ordinal: 172, Address: 0xa7a0)
  • PoolManagerShowPreAllocatedPools (Ordinal: 173, Address: 0xa8a0)
  • ProcessExitCleanup (Ordinal: 174, Address: 0x7d0b9)
  • ProcessExitNotifyRoutine (Ordinal: 175, Address: 0x10af0)
  • ReadPhysicalMemoryUsingMapIoSpace (Ordinal: 176, Address: 0x93a0)
  • SetDebugRegisters (Ordinal: 177, Address: 0x2bd0)
  • SetGuestCr0 (Ordinal: 178, Address: 0xe670)
  • SetGuestCr2 (Ordinal: 179, Address: 0xe680)
  • SetGuestCr3 (Ordinal: 180, Address: 0xe690)
  • SetGuestCr4 (Ordinal: 181, Address: 0xe6a0)
  • SetGuestCr8 (Ordinal: 182, Address: 0xe6b0)
  • SetGuestCs (Ordinal: 183, Address: 0xe6c0)
  • SetGuestCsSel (Ordinal: 184, Address: 0xe6f0)
  • SetGuestDr0 (Ordinal: 185, Address: 0xe700)
  • SetGuestDr1 (Ordinal: 186, Address: 0xe710)
  • SetGuestDr2 (Ordinal: 187, Address: 0xe720)
  • SetGuestDr3 (Ordinal: 188, Address: 0xe730)
  • SetGuestDr6 (Ordinal: 189, Address: 0xe740)
  • SetGuestDr7 (Ordinal: 190, Address: 0xe750)
  • SetGuestDs (Ordinal: 191, Address: 0xe760)
  • SetGuestDsSel (Ordinal: 192, Address: 0xe7b0)
  • SetGuestEs (Ordinal: 193, Address: 0xe7c0)
  • SetGuestEsSel (Ordinal: 194, Address: 0xe810)
  • SetGuestFs (Ordinal: 195, Address: 0xe820)
  • SetGuestFsSel (Ordinal: 196, Address: 0xe870)
  • SetGuestGdtr (Ordinal: 197, Address: 0xe880)
  • SetGuestGs (Ordinal: 198, Address: 0xe890)
  • SetGuestGsSel (Ordinal: 199, Address: 0xe8e0)
  • SetGuestIdtr (Ordinal: 200, Address: 0xe8f0)
  • SetGuestLdtr (Ordinal: 201, Address: 0xe900)
  • SetGuestRFlags (Ordinal: 202, Address: 0xd670)
  • SetGuestRIP (Ordinal: 203, Address: 0xd680)
  • SetGuestRSP (Ordinal: 204, Address: 0xe910)
  • SetGuestSs (Ordinal: 205, Address: 0xe920)
  • SetGuestSsSel (Ordinal: 206, Address: 0xe970)
  • SetGuestTr (Ordinal: 207, Address: 0xe980)
  • StopCounterThread (Ordinal: 208, Address: 0x7d0b8)
  • SwitchToCurrentProcessMemoryLayout (Ordinal: 209, Address: 0xaba0)
  • SwitchToPreviousProcess (Ordinal: 210, Address: 0xabc0)
  • SwitchToProcessMemoryLayout (Ordinal: 211, Address: 0xabd0)
  • SwitchToProcessMemoryLayoutByCr3 (Ordinal: 212, Address: 0xac20)
  • SyscallBypassMagic (Ordinal: 213, Address: 0x7d010)
  • TargetDR3 (Ordinal: 214, Address: 0x7d008)
  • TargetProcessId (Ordinal: 215, Address: 0x7d120)
  • TargetSysHandler (Ordinal: 216, Address: 0x7d0d8)
  • TrackedProcessId (Ordinal: 217, Address: 0x7d0c8)
  • TransparentHideDebuggerWrapper (Ordinal: 218, Address: 0x8b40)
  • TransparentUnhideDebuggerWrapper (Ordinal: 219, Address: 0x8c20)
  • VirtualAddressToPhysicalAddress (Ordinal: 220, Address: 0x9040)
  • VirtualAddressToPhysicalAddressByProcessCr3 (Ordinal: 221, Address: 0x9050)
  • VirtualAddressToPhysicalAddressByProcessId (Ordinal: 222, Address: 0x90a0)
  • VirtualAddressToPhysicalAddressOnTargetProcess (Ordinal: 223, Address: 0x90f0)
  • VmFuncApicStoreIoApicFields (Ordinal: 224, Address: 0x8580)
  • VmFuncApicStoreLocalApicFields (Ordinal: 225, Address: 0x8590)
  • VmFuncChangeIgnoreOneMtfState (Ordinal: 226, Address: 0x85a0)
  • VmFuncChangeMtfUnsettingState (Ordinal: 227, Address: 0x85c0)
  • VmFuncCheckAndEnableExternalInterrupts (Ordinal: 228, Address: 0x85e0)
  • VmFuncClearSteppingBits (Ordinal: 229, Address: 0x8600)
  • VmFuncDisableExternalInterruptsAndInterruptWindow (Ordinal: 230, Address: 0x8610)
  • VmFuncEnableAndCheckForPreviousExternalInterrupts (Ordinal: 231, Address: 0x8630)
  • VmFuncEnableMtfAndChangeExternalInterruptState (Ordinal: 232, Address: 0x8650)
  • VmFuncEventInjectBreakpoint (Ordinal: 233, Address: 0x8670)
  • VmFuncEventInjectInterruption (Ordinal: 234, Address: 0x8680)
  • VmFuncEventInjectPageFaultRangeAddress (Ordinal: 235, Address: 0x8690)
  • VmFuncEventInjectPageFaultWithCr2 (Ordinal: 236, Address: 0x86b0)
  • VmFuncGetCsSelector (Ordinal: 237, Address: 0x86d0)
  • VmFuncGetInterruptibilityState (Ordinal: 238, Address: 0x86e0)
  • VmFuncGetLastVmexitRip (Ordinal: 239, Address: 0x86f0)
  • VmFuncGetRflags (Ordinal: 240, Address: 0x8710)
  • VmFuncGetRip (Ordinal: 241, Address: 0x8720)
  • VmFuncIdtQueryEntries (Ordinal: 242, Address: 0x8730)
  • VmFuncInitVmm (Ordinal: 243, Address: 0x8740)
  • VmFuncInjectPendingExternalInterrupts (Ordinal: 244, Address: 0x8750)
  • VmFuncInvalidateEptAllContexts (Ordinal: 245, Address: 0x8770)
  • VmFuncInvalidateEptSingleContext (Ordinal: 246, Address: 0x8780)
  • VmFuncNmiBroadcastInvalidateEptAllContexts (Ordinal: 247, Address: 0x87a0)
  • VmFuncNmiBroadcastInvalidateEptSingleContext (Ordinal: 248, Address: 0x87c0)
  • VmFuncNmiBroadcastRequest (Ordinal: 249, Address: 0x87e0)
  • VmFuncPerformRipIncrement (Ordinal: 250, Address: 0x8800)
  • VmFuncQueryModeExecTrap (Ordinal: 251, Address: 0x8820)
  • VmFuncReadExceptionBitmap (Ordinal: 252, Address: 0x8830)
  • VmFuncRegisterMtfBreak (Ordinal: 253, Address: 0x8840)
  • VmFuncSetExceptionBitmap (Ordinal: 254, Address: 0x8860)
  • VmFuncSetExternalInterruptExiting (Ordinal: 255, Address: 0x8880)
  • VmFuncSetInterruptWindowExiting (Ordinal: 256, Address: 0x88a0)
  • VmFuncSetInterruptibilityState (Ordinal: 257, Address: 0x88b0)
  • VmFuncSetLoadDebugControls (Ordinal: 258, Address: 0x88c0)
  • VmFuncSetMonitorTrapFlag (Ordinal: 259, Address: 0x88d0)
  • VmFuncSetMovControlRegsExiting (Ordinal: 260, Address: 0x88e0)
  • VmFuncSetMovDebugRegsExiting (Ordinal: 261, Address: 0x88f0)
  • VmFuncSetMovToCr3Vmexit (Ordinal: 262, Address: 0x8910)
  • VmFuncSetNmiExiting (Ordinal: 263, Address: 0x8930)
  • VmFuncSetNmiWindowExiting (Ordinal: 264, Address: 0x8940)
  • VmFuncSetPmcVmexit (Ordinal: 265, Address: 0x8950)
  • VmFuncSetRdtscExiting (Ordinal: 266, Address: 0x8960)
  • VmFuncSetRflagTrapFlag (Ordinal: 267, Address: 0x8980)
  • VmFuncSetRflags (Ordinal: 268, Address: 0x8990)
  • VmFuncSetRip (Ordinal: 269, Address: 0x89a0)
  • VmFuncSetSaveDebugControls (Ordinal: 270, Address: 0x89b0)
  • VmFuncSetTriggerEventForCpuids (Ordinal: 271, Address: 0x89c0)
  • VmFuncSetTriggerEventForVmcalls (Ordinal: 272, Address: 0x89d0)
  • VmFuncSetTriggerEventForXsetbvs (Ordinal: 273, Address: 0x89e0)
  • VmFuncSmmPerformSmiOperation (Ordinal: 274, Address: 0x89f0)
  • VmFuncSuppressRipIncrement (Ordinal: 275, Address: 0x8a00)
  • VmFuncUnRegisterMtfBreak (Ordinal: 276, Address: 0x8a20)
  • VmFuncUninitVmm (Ordinal: 277, Address: 0x8a40)
  • VmFuncUnsetExceptionBitmap (Ordinal: 278, Address: 0x8a50)
  • VmFuncVmxBroadcastInitialize (Ordinal: 279, Address: 0x8a70)
  • VmFuncVmxBroadcastUninitialize (Ordinal: 280, Address: 0x8a80)
  • VmFuncVmxCompatibleMemcmp (Ordinal: 281, Address: 0x8a90)
  • VmFuncVmxCompatibleMicroSleep (Ordinal: 282, Address: 0x8aa0)
  • VmFuncVmxCompatibleStrcmp (Ordinal: 283, Address: 0x8ab0)
  • VmFuncVmxCompatibleStrlen (Ordinal: 284, Address: 0x8ac0)
  • VmFuncVmxCompatibleStrncmp (Ordinal: 285, Address: 0x8ad0)
  • VmFuncVmxCompatibleWcscmp (Ordinal: 286, Address: 0x8ae0)
  • VmFuncVmxCompatibleWcslen (Ordinal: 287, Address: 0x8af0)
  • VmFuncVmxCompatibleWcsncmp (Ordinal: 288, Address: 0x8b00)
  • VmFuncVmxGetCurrentExecutionMode (Ordinal: 289, Address: 0x8b10)
  • VmFuncVmxVmcall (Ordinal: 290, Address: 0x8b20)
  • VmFuncWriteExceptionBitmap (Ordinal: 291, Address: 0x8b30)
  • WritePhysicalMemoryUsingMapIoSpace (Ordinal: 292, Address: 0x9410)

Imported DLLs & Functions

HAL.dll
  • KeQueryPerformanceCounter (Address: 0x18001d000)
hyperevade.dll
  • TransparentCheckAndModifyCpuid (Address: 0x18001d028)
  • TransparentCheckAndModifyMsrRead (Address: 0x18001d030)
  • TransparentCheckAndModifyMsrWrite (Address: 0x18001d038)
  • TransparentHandleSystemCallHook (Address: 0x18001d018)
  • TransparentHideDebugger (Address: 0x18001d010)
  • TransparentUnhideDebugger (Address: 0x18001d020)
ntoskrnl.exe
  • __C_specific_handler (Address: 0x18001d168)
  • __chkstk (Address: 0x18001d088)
  • ExAllocatePoolWithTag (Address: 0x18001d1b8)
  • ExFreePoolWithTag (Address: 0x18001d1a8)
  • IoAllocateMdl (Address: 0x18001d140)
  • IoFreeMdl (Address: 0x18001d148)
  • IoGetCurrentProcess (Address: 0x18001d0a0)
  • KeBugCheckEx (Address: 0x18001d108)
  • KeDelayExecutionThread (Address: 0x18001d110)
  • KeGenericCallDpc (Address: 0x18001d198)
  • KeGetCurrentIrql (Address: 0x18001d170)
  • KeGetCurrentProcessorNumberEx (Address: 0x18001d0b8)
  • KeInitializeDpc (Address: 0x18001d190)
  • KeInsertQueueDpc (Address: 0x18001d188)
  • KeQueryActiveProcessorCount (Address: 0x18001d178)
  • KeSetTargetProcessorDpc (Address: 0x18001d180)
  • KeSignalCallDpcDone (Address: 0x18001d048)
  • KeSignalCallDpcSynchronize (Address: 0x18001d050)
  • KeStackAttachProcess (Address: 0x18001d0d0)
  • KeUnstackDetachProcess (Address: 0x18001d0d8)
  • KfRaiseIrql (Address: 0x18001d058)
  • MmAllocateContiguousMemory (Address: 0x18001d1a0)
  • MmAllocateMappingAddress (Address: 0x18001d0e0)
  • MmCopyMemory (Address: 0x18001d0c8)
  • MmFreeContiguousMemory (Address: 0x18001d100)
  • MmFreeMappingAddress (Address: 0x18001d0e8)
  • MmGetPhysicalAddress (Address: 0x18001d090)
  • MmGetVirtualForPhysical (Address: 0x18001d098)
  • MmMapIoSpace (Address: 0x18001d068)
  • MmMapIoSpaceEx (Address: 0x18001d0c0)
  • MmMapLockedPagesSpecifyCache (Address: 0x18001d128)
  • MmProbeAndLockPages (Address: 0x18001d118)
  • MmUnlockPages (Address: 0x18001d120)
  • MmUnmapIoSpace (Address: 0x18001d070)
  • MmUnmapLockedPages (Address: 0x18001d130)
  • ObfDereferenceObject (Address: 0x18001d0a8)
  • PsAcquireProcessExitSynchronization (Address: 0x18001d158)
  • PsGetCurrentProcessId (Address: 0x18001d078)
  • PsGetCurrentThreadId (Address: 0x18001d080)
  • PsGetProcessImageFileName (Address: 0x18001d060)
  • PsInitialSystemProcess (Address: 0x18001d1b0)
  • PsLookupProcessByProcessId (Address: 0x18001d0b0)
  • PsReleaseProcessExitSynchronization (Address: 0x18001d160)
  • PsSetCreateProcessNotifyRoutine (Address: 0x18001d150)
  • PsTerminateSystemThread (Address: 0x18001d138)
  • ZwAllocateVirtualMemory (Address: 0x18001d0f0)
  • ZwFreeVirtualMemory (Address: 0x18001d0f8)