| description |
|---|
Description of 'eb_pa', 'ed_pa', and 'eq_pa' functions in HyperDbg Scripts |
eb_pa
ed_pa
eq_pa
eb_pa( PhysicalAddress, Value );
ed_pa( PhysicalAddress, Value );
eq_pa( PhysicalAddress, Value );
[Expression (PhysicalAddress)]
The physical address of the target memory that needs to be modified.
[Expression (Value)]
The value that needs to be replaced on the target physical address.
eb_pa modifies a single byte.
ed_pa modifies a dwrod.
eq_pa modifies a qword value.
If the address is valid, then the above functions return 1. Otherwise, 0 is returned.
The following code edits memory (quad-word) at 1d44fde0 and change it to 0x12345678deadbeef.
IsEditApplied = eq_pa(1d44fde0, 0x12345678deadbeef);
The following code changes a byte to 0x90 at the location that the rcx register is pointing to, then adds 0x8 to it.
IsEditApplied = eb_pa(poi(@rcx)+8, 0x90);
You can also use these functions without checking for the return value.
eq_pa(1d44fde0, 0x12345678deadbeef);
It's possible to use these functions with an if statement.
if (eq_pa(@r11, 0x12345678deadbeef) == 1)
{
printf("changes are applied.\n");
}
else
{
printf("changes are NOT applied.\n");
}The support for these functions is added from v0.13.