lm
lm [module name]
lm
Shows the loaded modules' base address, size, name, full path.
[module name] (optional)
The name or a part of the name that will be searched through all the modules and only those which match will be showed.
The following command shows all the modules in the system.
HyperDbg> lmstart size name path​fffff80434200000 11235328 ntoskrnl.exe \SystemRoot\system32\ntoskrnl.exefffff8043415c000 671744 hal.dll \SystemRoot\system32\hal.dllfffff80437a00000 45056 kd.dll \SystemRoot\system32\kd.dllfffff80437a10000 2101248 mcupdate_GenuineIntel.dll \SystemRoot\system32\mcupdate_GenuineIntel.dllfffff80437c70000 393216 msrpc.sys \SystemRoot\System32\drivers\msrpc.sysfffff80437c40000 172032 ksecdd.sys \SystemRoot\System32\drivers\ksecdd.sysfffff80437c20000 69632 werkernel.sys \SystemRoot\System32\drivers\werkernel.sysfffff80437d10000 425984 CLFS.SYS \SystemRoot\System32\drivers\CLFS.SYSfffff80437ce0000 159744 tm.sys \SystemRoot\System32\drivers\tm.sysfffff80437d80000 106496 PSHED.dll \SystemRoot\system32\PSHED.dllfffff80437da0000 45056 BOOTVID.dll \SystemRoot\system32\BOOTVID.dllfffff80437ec0000 462848 FLTMGR.SYS \SystemRoot\System32\drivers\FLTMGR.SYSfffff80437db0000 1069056 clipsp.sys \SystemRoot\System32\drivers\clipsp.sysfffff80437f40000 57344 cmimcext.sys \SystemRoot\System32\drivers\cmimcext.sysfffff80437f50000 49152 ntosext.sys \SystemRoot\System32\drivers\ntosext.sys​...
The following example shows the modules that contain "nt" in their path or name.
HyperDbg> lm ntstart size name path​fffff80434200000 11235328 ntoskrnl.exe \SystemRoot\system32\ntoskrnl.exefffff80437a10000 2101248 mcupdate_GenuineIntel.dll \SystemRoot\system32\mcupdate_GenuineIntel.dllfffff80437f50000 49152 ntosext.sys \SystemRoot\System32\drivers\ntosext.sysfffff804382b0000 106496 SgrmAgent.sys \SystemRoot\system32\drivers\SgrmAgent.sysfffff804383c0000 372736 intelpep.sys \SystemRoot\System32\drivers\intelpep.sys​...
This function work by calling NtQuerySystemInformation and does not gets the address from the kernel, so it doesn't have any IOCTL.
This command will continue the debuggee for some time (in Debugger Mode). This means that you lose the current context (registers & memory) after executing this command.
None
None