大家都知道,windows接管了对物理内存的直接存取,而bios信息存在物理内存
的f000:0000处,关键就是如何读取物理内存。
查阅了msdn的文章后,发现以下有几个函数和物理内存访问有关:
NTSTATUS ZwOpenSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes);
NTSTATUS ZwMapViewOfSection(IN HANDLE SectionHandle,
IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG ZeroBits,
IN ULONG CommitSize,
IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,
IN OUT PSIZE_T ViewSize,
IN SECTION_INHERIT InheritDisposition,
IN ULONG AllocationType,
IN ULONG Protect
);
NTSTATUS ZwUnmapViewOfSection(IN HANDLE ProcessHandle,IN PVOID BaseAddress);
//相信也可以兼容今后版本
//Phymem.C
//========================================================
//
// Physmem
//
//
// This program demonstrates how you can open and
// map physical memory. This is essentially the NT
// equivalent of the \dev\kmem device in UNIX.
//
//========================================================
#include <windows.h>
#include <stdio.h>
#include "ntmem.h"
//
// Number of bytes to print per line
//
#define BYTESPERLINE 16
//
// Lines to print before pause
//
#define LINESPERSCREEN 25
//
// Functions in NTDLL that we dynamically locate
//