How do I change the embedded serial number?

If your data has one symbolic address in your source code, and it is not a local variable, its address will then appear in your map file generated by your linker. If it is the local variable initialized with one literal constant, then just data will exist in your static initialization data the location of which should even be identified in your map file. Another possibility is that the application image which is compressed and just start up code expands it into RAM at the run time. This will then be obvious in your map file if the data and code addresses are in RAM rather than the ROM. If this is your case then what you are not attempting will be very much difficult. You would just have to know the compression algorithm used, and which part of your image is the compressed part (part of it will be the decompression code which runs from ROM). You would then have to just decompress the image, modify the string, and then re-compress it. Further, if your decompression performs any kind of the check sum on your compressed or the decompressed data, you will then have to recalculate and modify that too.