0

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. 

lea r8,qword ptr ds:[7FEF0CA6AD8]

In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I want to access the content of 7FEF0CA6AD8 memory address and modify it. The problem is each time I modify the address and test in the program something writes to 7FEF0CA6AD8 memory address. How can make it read only or find a the thing which writes to this address and try to modify that in the same way? My purpose is changing the value of this data segment register or find the logic behind the method which writes to it.
Hardware breakpoint might be a solution but when I do so the program crashes immediately

Improve this question
7
  • 1
    You can put a hardware breakpoint on that address (just like Jason explained on your other question), and run the program. It'll break when it's written and it'll take you to the instruction that's modifying the data.
    – rev
    Commented Aug 29, 2015 at 12:53
  • @AcidShout But the program crashes when I do so.
    – FreeMind
    Commented Aug 29, 2015 at 12:54
  • Then try a "Memory, on access" breakpoint instead, as can be seen in the screenshot in the answer to which @AcidShout linked above.
    – Jason Geffner
    Commented Aug 29, 2015 at 21:46
  • @JasonGeffner When I put memory breakpoint it again crashes.
    – FreeMind
    Commented Aug 29, 2015 at 22:08
  • 1
    Then you'll need to reverse engineer it to find out what's detecting both hardware breakpoints and memory breakpoints and disable that code.
    – Jason Geffner
    Commented Aug 29, 2015 at 22:15

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.