lm (view loaded modules)

Description of 'lm' command in HyperDbg.
Command
lm
Syntax
lm [module name]
lm
Description
Shows the loaded modules' base address, size, name, full path.
Parameters
[module name] (optional)
          The name or a part of the name that will be searched through all the modules and only those which match will be showed.
Examples
The following command shows all the modules in the system.
HyperDbg> lm
start                   size    name            path
​
fffff80434200000        11235328        ntoskrnl.exe    \SystemRoot\system32\ntoskrnl.exe
fffff8043415c000        671744  hal.dll \SystemRoot\system32\hal.dll
fffff80437a00000        45056   kd.dll  \SystemRoot\system32\kd.dll
fffff80437a10000        2101248 mcupdate_GenuineIntel.dll       \SystemRoot\system32\mcupdate_GenuineIntel.dll
fffff80437c70000        393216  msrpc.sys       \SystemRoot\System32\drivers\msrpc.sys
fffff80437c40000        172032  ksecdd.sys      \SystemRoot\System32\drivers\ksecdd.sys
fffff80437c20000        69632   werkernel.sys   \SystemRoot\System32\drivers\werkernel.sys
fffff80437d10000        425984  CLFS.SYS        \SystemRoot\System32\drivers\CLFS.SYS
fffff80437ce0000        159744  tm.sys  \SystemRoot\System32\drivers\tm.sys
fffff80437d80000        106496  PSHED.dll       \SystemRoot\system32\PSHED.dll
fffff80437da0000        45056   BOOTVID.dll     \SystemRoot\system32\BOOTVID.dll
fffff80437ec0000        462848  FLTMGR.SYS      \SystemRoot\System32\drivers\FLTMGR.SYS
fffff80437db0000        1069056 clipsp.sys      \SystemRoot\System32\drivers\clipsp.sys
fffff80437f40000        57344   cmimcext.sys    \SystemRoot\System32\drivers\cmimcext.sys
fffff80437f50000        49152   ntosext.sys     \SystemRoot\System32\drivers\ntosext.sys
​
...
The following example shows the modules that contain "nt" in their path or name.
HyperDbg> lm nt
start                   size    name            path
​
fffff80434200000        11235328        ntoskrnl.exe    \SystemRoot\system32\ntoskrnl.exe
fffff80437a10000        2101248 mcupdate_GenuineIntel.dll       \SystemRoot\system32\mcupdate_GenuineIntel.dll
fffff80437f50000        49152   ntosext.sys     \SystemRoot\System32\drivers\ntosext.sys
fffff804382b0000        106496  SgrmAgent.sys   \SystemRoot\system32\drivers\SgrmAgent.sys
fffff804383c0000        372736  intelpep.sys    \SystemRoot\System32\drivers\intelpep.sys
​
...
IOCTL
This function work by calling NtQuerySystemInformation and does not gets the address from the kernel, so it doesn't have any IOCTL.
Remarks
This command will continue the debuggee for some time (in Debugger Mode). This means that you lose the current context (registers & memory) after executing this command.
Requirements
None
Related
None
test (test functionalities)
db, dc, dd, dq (read virtual memory)
Last updated 1 week ago