I want to modify the data segment in the x64_DBG, however, I don't know how to access it.

lea r8,qword ptr ds:[7FEF0CA6AD8]

In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I want to access the content of 7FEF0CA6AD8 memory address and modify it. The problem is each time I modify the address and test in the program something writes to 7FEF0CA6AD8 memory address. How can make it read only or find a the thing which writes to this address and try to modify that in the same way? My purpose is changing the value of this data segment register or find the logic behind the method which writes to it.
Hardware breakpoint might be a solution but when I do so the program crashes immediately

  • 1
    You can put a hardware breakpoint on that address (just like Jason explained on your other question), and run the program. It'll break when it's written and it'll take you to the instruction that's modifying the data.
    – rev
    Aug 29 '15 at 12:53
  • @AcidShout But the program crashes when I do so.
    – FreeMind
    Aug 29 '15 at 12:54
  • Then try a "Memory, on access" breakpoint instead, as can be seen in the screenshot in the answer to which @AcidShout linked above. Aug 29 '15 at 21:46
  • @JasonGeffner When I put memory breakpoint it again crashes.
    – FreeMind
    Aug 29 '15 at 22:08
  • 1
    Then you'll need to reverse engineer it to find out what's detecting both hardware breakpoints and memory breakpoints and disable that code. Aug 29 '15 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.