My task is to disassemble entrypoint using WinDbg. Via the lm (list modules) command I found a random driver, I got it HTTP.sys. Then using !dh HTTP found his image base and entry point. After folding them, I inserted the address into the disassembly tab.And windbg did not find such an address in memory. If anything, WinDbg downloaded the pdb file for this driver.

And yes, if anything, WinDbg is able to use the + operator for addresses.

After a while, I tried to disassemble the address with the u command and I made sure that the address really points to the Entrypoint of the driver:

After Googling a bit, I found solutions like .reload and !process and .process /P, but nothing helped me. Then I wanted to change the memory protect. I tried to implement this in my driver, but from the functions I found ZwProtectVirtualMemory, which eventually did not work (apparently because the address is not virtual):

ULONGLONG address = 0xFFFFF8033435E010;
SIZE_T size = 100;
ULONG oldProtect;
ZwProtectVirtualMemory(ZwCurrentProcess(), reinterpret_cast<PVOID*>(&address), &size, PAGE_EXECUTE_READWRITE, &oldProtect);

And memcpy also doesn’t work.