Modifying permissions on usermode data buffer

I am debugging an issue in a usermode process and it would be really helpful to be able to modify the contents of a data buffer. Unfortunately the buffer has it’s permissions set to read only so all attempts to set the contents of the buffer through windbg commands (e, eb, ea, etc) fail. How would I go about changing the permissions so that that I can modify the contents and then changing back as they were before?

0:054:x86> !address 0x0d1e0000

Mapping file section regions…
Mapping module regions…
Mapping PEB regions…
Mapping TEB and stack regions…
Mapping heap regions…
Mapping page heap regions…
Mapping other regions…
Mapping stack trace database regions…
Mapping activation context regions…

Usage: MappedFile
Base Address: 0d1e0000
End Address: 0d260000
Region Size: 00080000
State: 00001000 MEM_COMMIT
Protect: 00000002 PAGE_READONLY
Type: 00040000 MEM_MAPPED
Allocation Base: 0d1e0000
Allocation Protect: 00000002 PAGE_READONLY
Mapped file name: PageFile

the address points to a memory mapped file region of PageFile i dont
think you can make it writeable legitimately

On 3/10/15, xxxxx@gmail.com wrote:
> I am debugging an issue in a usermode process and it would be really helpful
> to be able to modify the contents of a data buffer. Unfortunately the buffer
> has it’s permissions set to read only so all attempts to set the contents of
> the buffer through windbg commands (e, eb, ea, etc) fail. How would I go
> about changing the permissions so that that I can modify the contents and
> then changing back as they were before?
>
> 0:054:x86> !address 0x0d1e0000
>
>
> Mapping file section regions…
> Mapping module regions…
> Mapping PEB regions…
> Mapping TEB and stack regions…
> Mapping heap regions…
> Mapping page heap regions…
> Mapping other regions…
> Mapping stack trace database regions…
> Mapping activation context regions…
>
>
> Usage: MappedFile
> Base Address: 0d1e0000
> End Address: 0d260000
> Region Size: 00080000
> State: 00001000 MEM_COMMIT
> Protect: 00000002 PAGE_READONLY
> Type: 00040000 MEM_MAPPED
> Allocation Base: 0d1e0000
> Allocation Protect: 00000002 PAGE_READONLY
> Mapped file name: PageFile
>
>
> —
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

the address points to a memory mapped file region of PageFile i dont
think you can make it writeable legitimately.

this is a hack and as such DO NOT use it except in throwaway
configurations for whetting curiosity only (also absolutely untested
in newer os so may not even work )

open a kernel debugging session

convert the virtual address to physical address using !vtop 0

now open the memory window alt+5 change the properties of displayed
bytes to physical memory and enter the physical address you just got
translated

write your data to physical memory

this should now reflect in the user mode debugging session

writing to physical memory (cached . uncached , and write cached can
yield disastorous results so be warned and writing to physical memory
can also fail)

0:000> |;!address -F:FileMap,PAGE_READONLY -c:“db %1 l10”
. 0 id: 580 create name: calc.exe
Executing: db 0x80000 l10
00080000 41 63 74 78 20 45 00 00-01 00 00 00 9c 24 00 00 Actx E…$…

0:000> eb 90000 ‘E’
^ Memory access error in ‘eb 90000 ‘E’’

start a local kernel debuggging session and write to physical pages

lkd> !process 0 0 calc.exe
PROCESS 86a99020 SessionId: 0 Cid: 0580 Peb: 7ffd7000 ParentCid: 025c
DirBase: 11cc04e0 ObjectTable: e59a0778 HandleCount: 5.
Image: calc.exe

lkd> .process /p /r 11cc04e0

lkd> !vtop 0 80000
X86VtoP: Virt 00080000, pagedir 11cc0760
X86VtoP: PAE PDPE 11cc0760 - 000000002c8a5001
X86VtoP: PAE PDE 2c8a5000 - 00000000314fc067
X86VtoP: PAE PTE 314fc400 - 8000000028aac025
X86VtoP: PAE Mapped phys 28aac000
Virtual address 80000 translates to physical address 28aac000.

hit alt+5 and write Hac to 28aac005

chack the user mode debugging session again and see the mod

0:000> |;!address -F:FileMap,PAGE_READONLY -c:“db %1 l10”<br>. 0 id: 580 create name: calc.exe
Executing: db 0x80000 l10
00080000 41 63 74 78 20 48 61 63-01 00 00 00 9c 24 00 00 Actx Hac…$…

On 3/10/15, xxxxx@gmail.com wrote:
> I am debugging an issue in a usermode process and it would be really helpful
> to be able to modify the contents of a data buffer. Unfortunately the buffer
> has it’s permissions set to read only so all attempts to set the contents of
> the buffer through windbg commands (e, eb, ea, etc) fail. How would I go
> about changing the permissions so that that I can modify the contents and
> then changing back as they were before?
>
> 0:054:x86> !address 0x0d1e0000
>
>
> Mapping file section regions…
> Mapping module regions…
> Mapping PEB regions…
> Mapping TEB and stack regions…
> Mapping heap regions…
> Mapping page heap regions…
> Mapping other regions…
> Mapping stack trace database regions…
> Mapping activation context regions…
>
>
> Usage: MappedFile
> Base Address: 0d1e0000
> End Address: 0d260000
> Region Size: 00080000
> State: 00001000 MEM_COMMIT
> Protect: 00000002 PAGE_READONLY
> Type: 00040000 MEM_MAPPED
> Allocation Base: 0d1e0000
> Allocation Protect: 00000002 PAGE_READONLY
> Mapped file name: PageFile
>
>
> —
> WINDBG is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

This worked like a charm, thanks for the suggestion Raj!