Editing CPU Registers in WinDbg

Access the registers using the “r” command.

‘r’ command not only display the register value but also to modify them.

0:009> r
eax=03087000 ebx=98346721 ecx=45763498 edx=01008802 esi=77949bc0 edi=77949bc0
eip=77911430 esp=0478f910 ebp=0478f93c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77911430 cc              int     3

0:009>  r ecx
ecx=45763498

Modify the ECX with “r ecx=”

0:009> **r ecx=41414141**

0:009> r
eax=03087000 ebx=98346721 **ecx=41414141** edx=01008802 esi=77949bc0 edi=77949bc0
eip=77911430 esp=0478f910 ebp=0478f93c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77911430 cc              int     3

We can also modify the rest of the registers using same commands

0:009> r ebx=41414141
0:009> r eax=41414141
0:009> r edx=41414141
0:009> r
eax=41414141 ebx=41414141 ecx=41414141 edx=41414141 esi=77949bc0 edi=77949bc0
eip=77911430 esp=0478f910 ebp=0478f93c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77911430 cc              int     3