A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #10987  by lorddoskias
 Thu Jan 12, 2012 9:09 pm
I want to change a value in windbg. So here is what I've got:

0043ef2c a150e94800 mov eax,dword ptr [bootmgr!BdDebuggerNotPresent (0048e950)] ds:0030:0048e950=00000000


So i want to change the value at address 0030:0048e950. So here is what I do:

kd> dd 0030:0048e950
0030:0048e950 00000000 00000000 00000000 00000000
0030:0048e960 00000000 00000000 00000000 00000000
0030:0048e970 00000000 00000000 00000000 00000000
0030:0048e980 00000000 00000000 00000000 00000000
0030:0048e990 00000000 00000000 00000000 00000000
0030:0048e9a0 00000000 00000000 00000000 00000000
0030:0048e9b0 00000000 00000000 00000000 00000000
0030:0048e9c0 00000000 00000000 00000000 00000000

So I have 0 and I want to make it to 1, so I do:

kd> ed 0030:0048e950 1

But I still get:

kd> dd 0030:0048e950
0030:0048e950 00000000 00000000 00000000 00000000
0030:0048e960 00000000 00000000 00000000 00000000
0030:0048e970 00000000 00000000 00000000 00000000
0030:0048e980 00000000 00000000 00000000 00000000
0030:0048e990 00000000 00000000 00000000 00000000
0030:0048e9a0 00000000 00000000 00000000 00000000
0030:0048e9b0 00000000 00000000 00000000 00000000
0030:0048e9c0 00000000 00000000 00000000 00000000


What am I doing wrong?
 #10993  by everdox
 Fri Jan 13, 2012 6:23 am
open the memory window -> enter the address range. from there you can just type in bytes over the existing ones.

:lol: