views:

754

answers:

3

Can I, using an address found in a map file, use windbg to alter a variable in memory while the app is running?

I'm really interested in turning on/off functionality in run-time maybe with a variable.

How would you do this? Does it require breaking the app through the debugger?

+3  A: 

If you have the address, you can use the any of the e* (Enter Value) commands.

You can attach to any running process if you know the process id, or you can launch the exe directly with cdb. You do have to break the process to make any modifications. In CDB, you can use Ctrl+C, and the it will inject a DebugBreak into the process, you can then look at the stack, threads, and memory.

Lee Baldwin
You can't do it while program running...
Ilya
Yes, you can, you can attach to the process with cdb if you know the processID. And if you have the mapfile, you can peek at any address range and poke at any the memory locations.
Lee Baldwin
But correct me if i wrong you can't executed any command while application is running (at least with drivers) you must break and only after program stops you can do something.
Ilya
A: 

I'm not sure what exactly you trying to achieve, but debugger should be activated on some event (exception, break point or something), after it's activated, for example you can have a thread that create an exception and after get control back check the variable.
In debugger you can set a break point with command, see this guide, what will change the parameter.
I hope that this answer your question, if not please clarify the question.

In case of break point with command the application will be break and will continue execution without human intervention, i don't know any way how debugger can do something without application stops execution.

Just a thought, are you sure you need debugger for this? Can't you just use registry for that and use this to get notification about registry change.

Ilya
A: 

You can definately do that. Either break on a function and edit it in the locals window. Or use e commands to edit values. Check out the windbg help for more on it.

Tom