Q180577 - PRB: Windows NT Kernel WinDbg Message "Unable to modify memory"

PRB: Windows NT Kernel WinDbg Message "Unable to modify memory"

Q180577

The information in this article applies to:

Microsoft Win32 Device Driver Kit (DDK) for Windows NT, versions 3.51, 4.0

SYMPTOMS

When you are using WinDbg to debug a kernel-mode device driver and trying to use the Enter Values (ED, EW, EB, and so on) command to modify memory using a symbolic name, the following error message may appear:

Unable to modify memory

This happens when the expression evaluator is set to the wrong type.

You can modify memory in several different ways. For example, to set the SCSI debug print level to 3, you can type:

ed scsiport!scsidebug 3

or its equivalent:

?scsiport!scsidebug=3

These commands change the global variable in Scsiport.sys. If the message "Unable to modify memory" appears, the expression evaluator settings may be incorrect.

CAUSE

The default Visual C or C++ expression evaluator evaluates expressions as C expressions. MASM expressions always set the value of a symbol to its address. When the value is set incorrectly, the "Unable to modify memory" message may appear.

RESOLUTION

To configure WinDbg to use MASM expressions, enter the following in the WinDbg command window:

.opt masmeval on

To check the current setting of the expression evaluator, use:

.opt masmeval

This command displays either "MasmEval off" or "MasmEval on", which indicates the state of MASM evaluation.

Save the WinDbg common workspace so that you can maintain this evaluation setting the next time you use WinDbg.

MORE INFORMATION

For the following discussion, type in the text after the KDx86 prompt in the WinDbg command window. The line immediately following the user input (if any) is the result of the command.

Debug Session 1

This WinDbg session demonstrates how you can modify the value of the Scsiport debug variable. In this session, the expression evaluator is set to Visual C or C++, so the attempt to modify memory using the symbolic name fails until the expression evaluator is changed.

Try to change the value of the Scsiport debug variable as follows:
KDx86> ed scsiport!scsidebug 3
Unable to modify memory

The Enter Memory command fails, so enable the MASM expression evaluator as follows:
KDx86> .opt masmeval on

Again, try to change the value of the Scsiport debug variable as follows:
KDx86> ed scsiport!scsidebug 3

The message did not appear, so the memory was changed. Confirm this by displaying the value of the variable, which should appear as follows:
```
      KDx86> dd scsiport!scsidebug l1
      0x80260C84  00000003                            .... 
```

Debug Session 2

This debug session demonstrates how the expression evaluator setting might display a peculiar value when you use symbolic names.

Turn on MASM expression evaluation as follows:
KDx86> .opt masmeval on

Change the value of the Scsiport debug variable to 0x3 as follows:
KDx86> ed scsiport!scsidebug 3

Display the current value of the Scsiport debug variable. Note that the expression "scsiport!scsidebug" is evaluated to address 0x80260C84 as follows:
```
      KDx86> dd scsiport!scsidebug l1
      0x80260C84  00000003                            .... 
```

Change the expression evaluator from MASM to default Visual C or C++ as follows:
KDx86> .opt masmeval off

Try to display the Scsiport variable. Note that now the expression "scsiport!scsidebug" is evaluated to 0x00000003. This is actually the value stored in location 0x80260C84 (scsiport!scsidebug). When you display the memory at address 0x00000003 it shows up as question marks because it is an invalid address.
```
      KDx86> dd scsiport!scsidebug l1
      0x00000003  ????????                            ???? 
```

REFERENCES

Windows NT DDK: WinDbg

Additional query words: debugprint SCSI debug

Keywords : kberrmsg kbDDK kbNTOS351 kbNTOS400 kbWinOS2000 kbDSupport NTDDKDebug NTDDKKMode
Issue type : kbinfo
Technology :