hyperhv.dll
Description:
Authors:
Version:
Architecture: 64-bit
Operating System:
SHA256: 5f663f01fb1c0b3db01495ef2e9326b8
File Size: 520.9 KB
Uploaded At: May 27, 2026, 7:15 p.m.
Views: 42
Exported Functions
- BroadcastChangeAllMsrBitmapReadAllCores (Ordinal: 1, Address: 0x18a0)
- BroadcastChangeAllMsrBitmapWriteAllCores (Ordinal: 2, Address: 0x18c0)
- BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores (Ordinal: 3, Address: 0x18f0)
- BroadcastDisableDbAndBpExitingAllCores (Ordinal: 4, Address: 0x1900)
- BroadcastDisableEferSyscallEventsOnAllProcessors (Ordinal: 5, Address: 0x1910)
- BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores (Ordinal: 6, Address: 0x1920)
- BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores (Ordinal: 7, Address: 0x1940)
- BroadcastDisableMovDebugRegistersExitingAllCores (Ordinal: 8, Address: 0x1950)
- BroadcastDisableMovToControlRegistersExitingAllCores (Ordinal: 9, Address: 0x1960)
- BroadcastDisableMovToCr3ExitingOnAllProcessors (Ordinal: 10, Address: 0x1980)
- BroadcastDisableRdpmcExitingAllCores (Ordinal: 11, Address: 0x19b0)
- BroadcastDisableRdtscExitingAllCores (Ordinal: 12, Address: 0x19c0)
- BroadcastDisableRdtscExitingForClearingEventsAllCores (Ordinal: 13, Address: 0x19d0)
- BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores (Ordinal: 14, Address: 0x19e0)
- BroadcastEnableDbAndBpExitingAllCores (Ordinal: 15, Address: 0x19f0)
- BroadcastEnableEferSyscallEventsOnAllProcessors (Ordinal: 16, Address: 0x1a00)
- BroadcastEnableMovControlRegisterExitingAllCores (Ordinal: 17, Address: 0x1a10)
- BroadcastEnableMovDebugRegistersExitingAllCores (Ordinal: 18, Address: 0x1a30)
- BroadcastEnableMovToCr3ExitingOnAllProcessors (Ordinal: 19, Address: 0x1a40)
- BroadcastEnableRdpmcExitingAllCores (Ordinal: 20, Address: 0x1a70)
- BroadcastEnableRdtscExitingAllCores (Ordinal: 21, Address: 0x1a80)
- BroadcastIoBitmapChangeAllCores (Ordinal: 22, Address: 0x1a90)
- BroadcastIoBitmapResetAllCores (Ordinal: 23, Address: 0x1ab0)
- BroadcastResetAllMsrBitmapWriteAllCores (Ordinal: 24, Address: 0x1ae0)
- BroadcastResetChangeAllMsrBitmapReadAllCores (Ordinal: 25, Address: 0x1af0)
- BroadcastResetExceptionBitmapAllCores (Ordinal: 26, Address: 0x1b00)
- BroadcastSetExceptionBitmapAllCores (Ordinal: 27, Address: 0x1b20)
- BroadcastSetExternalInterruptExitingAllCores (Ordinal: 28, Address: 0x1b40)
- BroadcastUnsetExceptionBitmapAllCores (Ordinal: 29, Address: 0x1b50)
- BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores (Ordinal: 30, Address: 0x1b70)
- CheckAccessValidityAndSafety (Ordinal: 31, Address: 0x8c70)
- CheckAccessValidityAndSafetyByProcessId (Ordinal: 32, Address: 0x8c80)
- CheckAddressMaximumInstructionLength (Ordinal: 33, Address: 0x8dd0)
- CheckAddressPhysical (Ordinal: 34, Address: 0x8f00)
- CheckAddressValidityUsingTsx (Ordinal: 35, Address: 0x8f20)
- ConfigureChangeIoBitmapOnSingleCore (Ordinal: 36, Address: 0x72c0)
- ConfigureChangeMsrBitmapReadOnSingleCore (Ordinal: 37, Address: 0x72d0)
- ConfigureChangeMsrBitmapWriteOnSingleCore (Ordinal: 38, Address: 0x72e0)
- ConfigureDirtyLoggingInitializeOnAllProcessors (Ordinal: 39, Address: 0x72f0)
- ConfigureDirtyLoggingUninitializeOnAllProcessors (Ordinal: 40, Address: 0x7300)
- ConfigureDisableEferSyscallEventsOnAllProcessors (Ordinal: 41, Address: 0x7310)
- ConfigureDisableMovToCr3ExitingOnAllProcessors (Ordinal: 42, Address: 0x7320)
- ConfigureEnableEferSyscallEventsOnAllProcessors (Ordinal: 43, Address: 0x7330)
- ConfigureEnableEferSyscallHookOnSingleCore (Ordinal: 44, Address: 0x7340)
- ConfigureEnableMovToControlRegisterExitingOnSingleCore (Ordinal: 45, Address: 0x7350)
- ConfigureEnableMovToCr3ExitingOnAllProcessors (Ordinal: 46, Address: 0x7370)
- ConfigureEnableMovToDebugRegistersExitingOnSingleCore (Ordinal: 47, Address: 0x7380)
- ConfigureEnableRdpmcExitingOnSingleCore (Ordinal: 48, Address: 0x7390)
- ConfigureEnableRdtscExitingOnSingleCore (Ordinal: 49, Address: 0x73a0)
- ConfigureEptHook (Ordinal: 50, Address: 0x73b0)
- ConfigureEptHook2 (Ordinal: 51, Address: 0x73c0)
- ConfigureEptHook2FromVmxRoot (Ordinal: 52, Address: 0x73e0)
- ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks (Ordinal: 53, Address: 0x7400)
- ConfigureEptHookFromVmxRoot (Ordinal: 54, Address: 0x7410)
- ConfigureEptHookModifyInstructionFetchState (Ordinal: 55, Address: 0x7420)
- ConfigureEptHookModifyPageReadState (Ordinal: 56, Address: 0x7440)
- ConfigureEptHookModifyPageWriteState (Ordinal: 57, Address: 0x7460)
- ConfigureEptHookMonitor (Ordinal: 58, Address: 0x7480)
- ConfigureEptHookMonitorFromVmxRoot (Ordinal: 59, Address: 0x74a0)
- ConfigureEptHookReservePreallocatedPoolsForEptHooks (Ordinal: 60, Address: 0x74c0)
- ConfigureEptHookUnHookAllByHookingTag (Ordinal: 61, Address: 0x74d0)
- ConfigureEptHookUnHookSingleAddress (Ordinal: 62, Address: 0x74e0)
- ConfigureEptHookUnHookSingleAddressFromVmxRoot (Ordinal: 63, Address: 0x74f0)
- ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot (Ordinal: 64, Address: 0x7500)
- ConfigureExecTrapAddProcessToWatchingList (Ordinal: 65, Address: 0x7510)
- ConfigureExecTrapApplyMbecConfiguratinFromKernelSide (Ordinal: 66, Address: 0x7520)
- ConfigureExecTrapRemoveProcessFromWatchingList (Ordinal: 67, Address: 0x7540)
- ConfigureInitializeExecTrapOnAllProcessors (Ordinal: 68, Address: 0x7550)
- ConfigureModeBasedExecHookUninitializeOnAllProcessors (Ordinal: 69, Address: 0x7560)
- ConfigureSetEferSyscallOrSysretHookType (Ordinal: 70, Address: 0x7570)
- ConfigureSetExceptionBitmapOnSingleCore (Ordinal: 71, Address: 0x7590)
- ConfigureSetExternalInterruptExitingOnSingleCore (Ordinal: 72, Address: 0x75a0)
- ConfigureUninitializeExecTrapOnAllProcessors (Ordinal: 73, Address: 0x75b0)
- CounterThreadHandle (Ordinal: 74, Address: 0x7d0c0)
- CounterUpdater (Ordinal: 75, Address: 0x10670)
- DirectVmcallChangeIoBitmap (Ordinal: 76, Address: 0x75c0)
- DirectVmcallChangeMsrBitmapRead (Ordinal: 77, Address: 0x75e0)
- DirectVmcallChangeMsrBitmapWrite (Ordinal: 78, Address: 0x7600)
- DirectVmcallDisableEferSyscallEvents (Ordinal: 79, Address: 0x7620)
- DirectVmcallDisableMov2CrExitingForClearingCrEvents (Ordinal: 80, Address: 0x7640)
- DirectVmcallDisableMov2DrExitingForClearingDrEvents (Ordinal: 81, Address: 0x7660)
- DirectVmcallDisableRdpmcExiting (Ordinal: 82, Address: 0x7680)
- DirectVmcallDisableRdtscExitingForClearingTscEvents (Ordinal: 83, Address: 0x76a0)
- DirectVmcallEnableEferSyscall (Ordinal: 84, Address: 0x76c0)
- DirectVmcallEnableExternalInterruptExiting (Ordinal: 85, Address: 0x76e0)
- DirectVmcallEnableMov2DebugRegsExiting (Ordinal: 86, Address: 0x7700)
- DirectVmcallEnableMovToCrExiting (Ordinal: 87, Address: 0x7720)
- DirectVmcallEnableRdpmcExiting (Ordinal: 88, Address: 0x7740)
- DirectVmcallEnableRdtscpExiting (Ordinal: 89, Address: 0x7760)
- DirectVmcallInvalidateEptAllContexts (Ordinal: 90, Address: 0x7780)
- DirectVmcallInvalidateSingleContext (Ordinal: 91, Address: 0x77a0)
- DirectVmcallPerformVmcall (Ordinal: 92, Address: 0x77c0)
- DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents (Ordinal: 93, Address: 0x77e0)
- DirectVmcallResetIoBitmap (Ordinal: 94, Address: 0x7800)
- DirectVmcallResetMsrBitmapRead (Ordinal: 95, Address: 0x7820)
- DirectVmcallResetMsrBitmapWrite (Ordinal: 96, Address: 0x7840)
- DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents (Ordinal: 97, Address: 0x7860)
- DirectVmcallSetExceptionBitmap (Ordinal: 98, Address: 0x7880)
- DirectVmcallSetHiddenBreakpointHook (Ordinal: 99, Address: 0x78a0)
- DirectVmcallTest (Ordinal: 100, Address: 0x78c0)
- DirectVmcallUnhookSinglePage (Ordinal: 101, Address: 0x78e0)
- DirectVmcallUnsetExceptionBitmap (Ordinal: 102, Address: 0x7900)
- DisassemblerLengthDisassembleEngine (Ordinal: 103, Address: 0x36f0)
- DisassemblerLengthDisassembleEngineByProcessId (Ordinal: 104, Address: 0x37e0)
- DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess (Ordinal: 105, Address: 0x3880)
- DisassemblerShowInstructionsInVmxNonRootMode (Ordinal: 106, Address: 0x38f0)
- DisassemblerShowOneInstructionInVmxNonRootMode (Ordinal: 107, Address: 0x3af0)
- DisassemblerShowOneInstructionInVmxRootMode (Ordinal: 108, Address: 0x3ce0)
- DllInitialize (Ordinal: 109, Address: 0x2bc0)
- DllUnload (Ordinal: 110, Address: 0x2bc0)
- GetGuestCr0 (Ordinal: 111, Address: 0xe380)
- GetGuestCr2 (Ordinal: 112, Address: 0xe390)
- GetGuestCr3 (Ordinal: 113, Address: 0xe3a0)
- GetGuestCr4 (Ordinal: 114, Address: 0xe3b0)
- GetGuestCr8 (Ordinal: 115, Address: 0xe3c0)
- GetGuestCs (Ordinal: 116, Address: 0xe3d0)
- GetGuestDr0 (Ordinal: 117, Address: 0xe420)
- GetGuestDr1 (Ordinal: 118, Address: 0xe430)
- GetGuestDr2 (Ordinal: 119, Address: 0xe440)
- GetGuestDr3 (Ordinal: 120, Address: 0xe450)
- GetGuestDr6 (Ordinal: 121, Address: 0xe460)
- GetGuestDr7 (Ordinal: 122, Address: 0xe470)
- GetGuestDs (Ordinal: 123, Address: 0xe480)
- GetGuestEs (Ordinal: 124, Address: 0xe4d0)
- GetGuestFs (Ordinal: 125, Address: 0xe520)
- GetGuestGdtr (Ordinal: 126, Address: 0xe570)
- GetGuestGs (Ordinal: 127, Address: 0xe580)
- GetGuestIdtr (Ordinal: 128, Address: 0xe5d0)
- GetGuestLdtr (Ordinal: 129, Address: 0xe5e0)
- GetGuestRFlags (Ordinal: 130, Address: 0xe5f0)
- GetGuestRIP (Ordinal: 131, Address: 0xe600)
- GetGuestSs (Ordinal: 132, Address: 0xe610)
- GetGuestTr (Ordinal: 133, Address: 0xe660)
- LayoutGetCr3ByProcessId (Ordinal: 134, Address: 0x9140)
- LayoutGetCurrentProcessCr3 (Ordinal: 135, Address: 0x9180)
- LayoutGetExactGuestProcessCr3 (Ordinal: 136, Address: 0x91a0)
- LstarHook (Ordinal: 137, Address: 0x7d018)
- MemoryManagerReadProcessMemoryNormal (Ordinal: 138, Address: 0x91d0)
- MemoryManagerWritePhysicalMemoryNormal (Ordinal: 139, Address: 0x9370)
- MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess (Ordinal: 140, Address: 0x9480)
- MemoryMapperCheckIfPdeIsLargePageOnTargetProcess (Ordinal: 141, Address: 0x9550)
- MemoryMapperCheckPteIsPresentOnTargetProcess (Ordinal: 142, Address: 0x9620)
- MemoryMapperFreeMemoryOnTargetProcess (Ordinal: 143, Address: 0x9690)
- MemoryMapperGetPteVa (Ordinal: 144, Address: 0x9790)
- MemoryMapperGetPteVaByCr3 (Ordinal: 145, Address: 0x97a0)
- MemoryMapperGetPteVaOnTargetProcess (Ordinal: 146, Address: 0x9800)
- MemoryMapperGetPteVaWithoutSwitchingByCr3 (Ordinal: 147, Address: 0x9860)
- MemoryMapperReadMemorySafe (Ordinal: 148, Address: 0x9a50)
- MemoryMapperReadMemorySafeByPhysicalAddress (Ordinal: 149, Address: 0x9a80)
- MemoryMapperReadMemorySafeFromVmxNonRootByPhysicalAddress (Ordinal: 150, Address: 0x9ab0)
- MemoryMapperReadMemorySafeOnTargetProcess (Ordinal: 151, Address: 0x9ae0)
- MemoryMapperReadMemoryUnsafe (Ordinal: 152, Address: 0x9d60)
- MemoryMapperReserveUsermodeAddressOnTargetProcess (Ordinal: 153, Address: 0x9d90)
- MemoryMapperSetExecuteDisableToPteOnTargetProcess (Ordinal: 154, Address: 0x9ee0)
- MemoryMapperSetSupervisorBitWithoutSwitchingByCr3 (Ordinal: 155, Address: 0x9f60)
- MemoryMapperWriteMemorySafe (Ordinal: 156, Address: 0xa060)
- MemoryMapperWriteMemorySafeByPhysicalAddress (Ordinal: 157, Address: 0xa0a0)
- MemoryMapperWriteMemorySafeFromVmxNonRootyPhysicalAddress (Ordinal: 158, Address: 0x9370)
- MemoryMapperWriteMemorySafeOnTargetProcess (Ordinal: 159, Address: 0xa0d0)
- MemoryMapperWriteMemoryUnsafe (Ordinal: 160, Address: 0xa3c0)
- NotifyRoutineActive (Ordinal: 161, Address: 0x7d118)
- OrigLstar (Ordinal: 162, Address: 0x7d0d0)
- PciReadCam (Ordinal: 163, Address: 0x3470)
- PciWriteCam (Ordinal: 164, Address: 0x35a0)
- PhysicalAddressToVirtualAddress (Ordinal: 165, Address: 0x8f40)
- PhysicalAddressToVirtualAddressByCr3 (Ordinal: 166, Address: 0x8f50)
- PhysicalAddressToVirtualAddressByProcessId (Ordinal: 167, Address: 0x8fa0)
- PhysicalAddressToVirtualAddressOnTargetProcess (Ordinal: 168, Address: 0x8ff0)
- PoolManagerCheckAndPerformAllocationAndDeallocation (Ordinal: 169, Address: 0xa3f0)
- PoolManagerFreePool (Ordinal: 170, Address: 0xa610)
- PoolManagerRequestAllocation (Ordinal: 171, Address: 0xa700)
- PoolManagerRequestPool (Ordinal: 172, Address: 0xa7a0)
- PoolManagerShowPreAllocatedPools (Ordinal: 173, Address: 0xa8a0)
- ProcessExitCleanup (Ordinal: 174, Address: 0x7d0b9)
- ProcessExitNotifyRoutine (Ordinal: 175, Address: 0x10af0)
- ReadPhysicalMemoryUsingMapIoSpace (Ordinal: 176, Address: 0x93a0)
- SetDebugRegisters (Ordinal: 177, Address: 0x2bd0)
- SetGuestCr0 (Ordinal: 178, Address: 0xe670)
- SetGuestCr2 (Ordinal: 179, Address: 0xe680)
- SetGuestCr3 (Ordinal: 180, Address: 0xe690)
- SetGuestCr4 (Ordinal: 181, Address: 0xe6a0)
- SetGuestCr8 (Ordinal: 182, Address: 0xe6b0)
- SetGuestCs (Ordinal: 183, Address: 0xe6c0)
- SetGuestCsSel (Ordinal: 184, Address: 0xe6f0)
- SetGuestDr0 (Ordinal: 185, Address: 0xe700)
- SetGuestDr1 (Ordinal: 186, Address: 0xe710)
- SetGuestDr2 (Ordinal: 187, Address: 0xe720)
- SetGuestDr3 (Ordinal: 188, Address: 0xe730)
- SetGuestDr6 (Ordinal: 189, Address: 0xe740)
- SetGuestDr7 (Ordinal: 190, Address: 0xe750)
- SetGuestDs (Ordinal: 191, Address: 0xe760)
- SetGuestDsSel (Ordinal: 192, Address: 0xe7b0)
- SetGuestEs (Ordinal: 193, Address: 0xe7c0)
- SetGuestEsSel (Ordinal: 194, Address: 0xe810)
- SetGuestFs (Ordinal: 195, Address: 0xe820)
- SetGuestFsSel (Ordinal: 196, Address: 0xe870)
- SetGuestGdtr (Ordinal: 197, Address: 0xe880)
- SetGuestGs (Ordinal: 198, Address: 0xe890)
- SetGuestGsSel (Ordinal: 199, Address: 0xe8e0)
- SetGuestIdtr (Ordinal: 200, Address: 0xe8f0)
- SetGuestLdtr (Ordinal: 201, Address: 0xe900)
- SetGuestRFlags (Ordinal: 202, Address: 0xd670)
- SetGuestRIP (Ordinal: 203, Address: 0xd680)
- SetGuestRSP (Ordinal: 204, Address: 0xe910)
- SetGuestSs (Ordinal: 205, Address: 0xe920)
- SetGuestSsSel (Ordinal: 206, Address: 0xe970)
- SetGuestTr (Ordinal: 207, Address: 0xe980)
- StopCounterThread (Ordinal: 208, Address: 0x7d0b8)
- SwitchToCurrentProcessMemoryLayout (Ordinal: 209, Address: 0xaba0)
- SwitchToPreviousProcess (Ordinal: 210, Address: 0xabc0)
- SwitchToProcessMemoryLayout (Ordinal: 211, Address: 0xabd0)
- SwitchToProcessMemoryLayoutByCr3 (Ordinal: 212, Address: 0xac20)
- SyscallBypassMagic (Ordinal: 213, Address: 0x7d010)
- TargetDR3 (Ordinal: 214, Address: 0x7d008)
- TargetProcessId (Ordinal: 215, Address: 0x7d120)
- TargetSysHandler (Ordinal: 216, Address: 0x7d0d8)
- TrackedProcessId (Ordinal: 217, Address: 0x7d0c8)
- TransparentHideDebuggerWrapper (Ordinal: 218, Address: 0x8b40)
- TransparentUnhideDebuggerWrapper (Ordinal: 219, Address: 0x8c20)
- VirtualAddressToPhysicalAddress (Ordinal: 220, Address: 0x9040)
- VirtualAddressToPhysicalAddressByProcessCr3 (Ordinal: 221, Address: 0x9050)
- VirtualAddressToPhysicalAddressByProcessId (Ordinal: 222, Address: 0x90a0)
- VirtualAddressToPhysicalAddressOnTargetProcess (Ordinal: 223, Address: 0x90f0)
- VmFuncApicStoreIoApicFields (Ordinal: 224, Address: 0x8580)
- VmFuncApicStoreLocalApicFields (Ordinal: 225, Address: 0x8590)
- VmFuncChangeIgnoreOneMtfState (Ordinal: 226, Address: 0x85a0)
- VmFuncChangeMtfUnsettingState (Ordinal: 227, Address: 0x85c0)
- VmFuncCheckAndEnableExternalInterrupts (Ordinal: 228, Address: 0x85e0)
- VmFuncClearSteppingBits (Ordinal: 229, Address: 0x8600)
- VmFuncDisableExternalInterruptsAndInterruptWindow (Ordinal: 230, Address: 0x8610)
- VmFuncEnableAndCheckForPreviousExternalInterrupts (Ordinal: 231, Address: 0x8630)
- VmFuncEnableMtfAndChangeExternalInterruptState (Ordinal: 232, Address: 0x8650)
- VmFuncEventInjectBreakpoint (Ordinal: 233, Address: 0x8670)
- VmFuncEventInjectInterruption (Ordinal: 234, Address: 0x8680)
- VmFuncEventInjectPageFaultRangeAddress (Ordinal: 235, Address: 0x8690)
- VmFuncEventInjectPageFaultWithCr2 (Ordinal: 236, Address: 0x86b0)
- VmFuncGetCsSelector (Ordinal: 237, Address: 0x86d0)
- VmFuncGetInterruptibilityState (Ordinal: 238, Address: 0x86e0)
- VmFuncGetLastVmexitRip (Ordinal: 239, Address: 0x86f0)
- VmFuncGetRflags (Ordinal: 240, Address: 0x8710)
- VmFuncGetRip (Ordinal: 241, Address: 0x8720)
- VmFuncIdtQueryEntries (Ordinal: 242, Address: 0x8730)
- VmFuncInitVmm (Ordinal: 243, Address: 0x8740)
- VmFuncInjectPendingExternalInterrupts (Ordinal: 244, Address: 0x8750)
- VmFuncInvalidateEptAllContexts (Ordinal: 245, Address: 0x8770)
- VmFuncInvalidateEptSingleContext (Ordinal: 246, Address: 0x8780)
- VmFuncNmiBroadcastInvalidateEptAllContexts (Ordinal: 247, Address: 0x87a0)
- VmFuncNmiBroadcastInvalidateEptSingleContext (Ordinal: 248, Address: 0x87c0)
- VmFuncNmiBroadcastRequest (Ordinal: 249, Address: 0x87e0)
- VmFuncPerformRipIncrement (Ordinal: 250, Address: 0x8800)
- VmFuncQueryModeExecTrap (Ordinal: 251, Address: 0x8820)
- VmFuncReadExceptionBitmap (Ordinal: 252, Address: 0x8830)
- VmFuncRegisterMtfBreak (Ordinal: 253, Address: 0x8840)
- VmFuncSetExceptionBitmap (Ordinal: 254, Address: 0x8860)
- VmFuncSetExternalInterruptExiting (Ordinal: 255, Address: 0x8880)
- VmFuncSetInterruptWindowExiting (Ordinal: 256, Address: 0x88a0)
- VmFuncSetInterruptibilityState (Ordinal: 257, Address: 0x88b0)
- VmFuncSetLoadDebugControls (Ordinal: 258, Address: 0x88c0)
- VmFuncSetMonitorTrapFlag (Ordinal: 259, Address: 0x88d0)
- VmFuncSetMovControlRegsExiting (Ordinal: 260, Address: 0x88e0)
- VmFuncSetMovDebugRegsExiting (Ordinal: 261, Address: 0x88f0)
- VmFuncSetMovToCr3Vmexit (Ordinal: 262, Address: 0x8910)
- VmFuncSetNmiExiting (Ordinal: 263, Address: 0x8930)
- VmFuncSetNmiWindowExiting (Ordinal: 264, Address: 0x8940)
- VmFuncSetPmcVmexit (Ordinal: 265, Address: 0x8950)
- VmFuncSetRdtscExiting (Ordinal: 266, Address: 0x8960)
- VmFuncSetRflagTrapFlag (Ordinal: 267, Address: 0x8980)
- VmFuncSetRflags (Ordinal: 268, Address: 0x8990)
- VmFuncSetRip (Ordinal: 269, Address: 0x89a0)
- VmFuncSetSaveDebugControls (Ordinal: 270, Address: 0x89b0)
- VmFuncSetTriggerEventForCpuids (Ordinal: 271, Address: 0x89c0)
- VmFuncSetTriggerEventForVmcalls (Ordinal: 272, Address: 0x89d0)
- VmFuncSetTriggerEventForXsetbvs (Ordinal: 273, Address: 0x89e0)
- VmFuncSmmPerformSmiOperation (Ordinal: 274, Address: 0x89f0)
- VmFuncSuppressRipIncrement (Ordinal: 275, Address: 0x8a00)
- VmFuncUnRegisterMtfBreak (Ordinal: 276, Address: 0x8a20)
- VmFuncUninitVmm (Ordinal: 277, Address: 0x8a40)
- VmFuncUnsetExceptionBitmap (Ordinal: 278, Address: 0x8a50)
- VmFuncVmxBroadcastInitialize (Ordinal: 279, Address: 0x8a70)
- VmFuncVmxBroadcastUninitialize (Ordinal: 280, Address: 0x8a80)
- VmFuncVmxCompatibleMemcmp (Ordinal: 281, Address: 0x8a90)
- VmFuncVmxCompatibleMicroSleep (Ordinal: 282, Address: 0x8aa0)
- VmFuncVmxCompatibleStrcmp (Ordinal: 283, Address: 0x8ab0)
- VmFuncVmxCompatibleStrlen (Ordinal: 284, Address: 0x8ac0)
- VmFuncVmxCompatibleStrncmp (Ordinal: 285, Address: 0x8ad0)
- VmFuncVmxCompatibleWcscmp (Ordinal: 286, Address: 0x8ae0)
- VmFuncVmxCompatibleWcslen (Ordinal: 287, Address: 0x8af0)
- VmFuncVmxCompatibleWcsncmp (Ordinal: 288, Address: 0x8b00)
- VmFuncVmxGetCurrentExecutionMode (Ordinal: 289, Address: 0x8b10)
- VmFuncVmxVmcall (Ordinal: 290, Address: 0x8b20)
- VmFuncWriteExceptionBitmap (Ordinal: 291, Address: 0x8b30)
- WritePhysicalMemoryUsingMapIoSpace (Ordinal: 292, Address: 0x9410)
Imported DLLs & Functions
HAL.dll
- KeQueryPerformanceCounter (Address: 0x18001d000)
hyperevade.dll
- TransparentCheckAndModifyCpuid (Address: 0x18001d028)
- TransparentCheckAndModifyMsrRead (Address: 0x18001d030)
- TransparentCheckAndModifyMsrWrite (Address: 0x18001d038)
- TransparentHandleSystemCallHook (Address: 0x18001d018)
- TransparentHideDebugger (Address: 0x18001d010)
- TransparentUnhideDebugger (Address: 0x18001d020)
ntoskrnl.exe
- __C_specific_handler (Address: 0x18001d168)
- __chkstk (Address: 0x18001d088)
- ExAllocatePoolWithTag (Address: 0x18001d1b8)
- ExFreePoolWithTag (Address: 0x18001d1a8)
- IoAllocateMdl (Address: 0x18001d140)
- IoFreeMdl (Address: 0x18001d148)
- IoGetCurrentProcess (Address: 0x18001d0a0)
- KeBugCheckEx (Address: 0x18001d108)
- KeDelayExecutionThread (Address: 0x18001d110)
- KeGenericCallDpc (Address: 0x18001d198)
- KeGetCurrentIrql (Address: 0x18001d170)
- KeGetCurrentProcessorNumberEx (Address: 0x18001d0b8)
- KeInitializeDpc (Address: 0x18001d190)
- KeInsertQueueDpc (Address: 0x18001d188)
- KeQueryActiveProcessorCount (Address: 0x18001d178)
- KeSetTargetProcessorDpc (Address: 0x18001d180)
- KeSignalCallDpcDone (Address: 0x18001d048)
- KeSignalCallDpcSynchronize (Address: 0x18001d050)
- KeStackAttachProcess (Address: 0x18001d0d0)
- KeUnstackDetachProcess (Address: 0x18001d0d8)
- KfRaiseIrql (Address: 0x18001d058)
- MmAllocateContiguousMemory (Address: 0x18001d1a0)
- MmAllocateMappingAddress (Address: 0x18001d0e0)
- MmCopyMemory (Address: 0x18001d0c8)
- MmFreeContiguousMemory (Address: 0x18001d100)
- MmFreeMappingAddress (Address: 0x18001d0e8)
- MmGetPhysicalAddress (Address: 0x18001d090)
- MmGetVirtualForPhysical (Address: 0x18001d098)
- MmMapIoSpace (Address: 0x18001d068)
- MmMapIoSpaceEx (Address: 0x18001d0c0)
- MmMapLockedPagesSpecifyCache (Address: 0x18001d128)
- MmProbeAndLockPages (Address: 0x18001d118)
- MmUnlockPages (Address: 0x18001d120)
- MmUnmapIoSpace (Address: 0x18001d070)
- MmUnmapLockedPages (Address: 0x18001d130)
- ObfDereferenceObject (Address: 0x18001d0a8)
- PsAcquireProcessExitSynchronization (Address: 0x18001d158)
- PsGetCurrentProcessId (Address: 0x18001d078)
- PsGetCurrentThreadId (Address: 0x18001d080)
- PsGetProcessImageFileName (Address: 0x18001d060)
- PsInitialSystemProcess (Address: 0x18001d1b0)
- PsLookupProcessByProcessId (Address: 0x18001d0b0)
- PsReleaseProcessExitSynchronization (Address: 0x18001d160)
- PsSetCreateProcessNotifyRoutine (Address: 0x18001d150)
- PsTerminateSystemThread (Address: 0x18001d138)
- ZwAllocateVirtualMemory (Address: 0x18001d0f0)
- ZwFreeVirtualMemory (Address: 0x18001d0f8)