e, ea, eb, ed, eD, ef, ep, eq, eu, ew, eza (Enter Values)

Article
03/06/2024

The *e* commands enter into memory the values that you specify.

This command should not be confused with the ~E (Thread-Specific Command) qualifier.

e{b|d|D|f|p|q|w} Address [Values] 
e{a|u|za|zu} Address "String" 
e Address [Values]

Kernel Mode only - physical address

/p {[c]|[uc]|[wc]}

For more information, see Kernel mode physical addresses later in this topic.

Parameters

Syntax

Address
Specifies the starting address where to enter values. The debugger replaces the value at Address and each subsequent memory location until all Values have been used.

Values
Specifies one or more values to enter into memory. Multiple numeric values should be separated with spaces. If you do not specify any values, the current address and the value at that address will be displayed, and you will be prompted for input.

String
Specifies a string to be entered into memory. The ea and eza commands will write this to memory as an ASCII string; the eu and ezu commands will write this to memory as a Unicode string. The eza and ezu commands write a terminal NULL; the ea and eu commands do not. String must be enclosed in quotation marks.

Environment

Item	Description
Modes	User mode, kernel mode
Targets	Live, crash dump
Platforms	All

Additional Information

For an overview of memory manipulation and a description of other memory-related commands, see Reading and Writing Memory.

Remarks

This command exists in the following forms. The second characters of the ed and eD commands are case-sensitive.

Command	Enter
e	This enters data in the same format as the most recent e command. (If the most recent e command was ea, eza, eu, or ezu, the final parameter will be String and may not be omitted.)
ea	ASCII string (not NULL-terminated).
eb	Byte values.
ed	Double-word values (4 bytes).
eD	Double-precision floating-point numbers (8 bytes).
ef	Single-precision floating-point numbers (4 bytes).
ep	Pointer-sized values. This command is equivalent to ed or eq, depending on whether the target computer's processor architecture is 32-bit or 64-bit, respectively.
eq	Quad-word values (8 bytes).
eu	Unicode string (not NULL-terminated).
ew	Word values (2 bytes).
eza	NULL-terminated ASCII string.
ezu	NULL-terminated Unicode string.

Numeric values will be interpreted as numbers in the current radix (16, 10, or 8). To change the default radix, use the n (Set Number Base) command. The default radix can be overridden by specifying the 0x prefix (hexadecimal), the 0n prefix (decimal), the 0t prefix (octal), or the 0y prefix (binary).

Note The default radix behaves differently when C++ expressions are being used. See Evaluating Expressions for details.

When entering byte values with the eb command, you can use single straight quotation marks to specify characters. If you want to include multiple characters, each must be surrounded with its own quotation marks. This allows you to enter a character string that is not terminated by a null character. For example:

eb 'h' 'e' 'l' 'l' 'o'

C-style escape characters (such as \\0 or \\n) may not be used with these commands.

If you omit the Values parameter, you will be prompted for input. The address and its current contents will be displayed, and an Input> prompt will appear. You can then do any of the following:

Enter a new value, by typing the value and pressing ENTER.
Preserve the current value in memory by pressing SPACE followed by ENTER.
Exit from the command by pressing ENTER.

Kernel mode physical addresses

In WinDbg version 1.2402.24001.0 and later, the e (Enter Memory) commands supports physical addresses just like d, da, db, dc, dd, dD, df, dp, dq, du, dw, dW, dyb, dyd (Display Memory). These options are only supported in kernel mode.

Option	Description
`/p`	Uses physical memory addresses for the display. The range specified by Range will be taken from physical memory rather than virtual memory.
`/p[c]`	Same as `/p`, except that cached memory will be read. The brackets around c must be included.
`/p[uc]`	Same as `/p`, except that uncached memory will be read. The brackets around uc must be included.
`/p[wc]`	Same as `/p`, except that write-combined memory will be read. The brackets around wc must be included.

Share via