flat assembler
Message board for the users of flat assembler.
![]() |
Author |
|
Foxxy 12 Jun 2015, 19:28
You'd need to make a driver: http://stackoverflow.com/questions/23683707/read-physical-memory-under-windows-8
|
|||
![]() |
|
revolution 13 Jun 2015, 06:24
Also note the need to respect the paging table and segment selectors. Even for a kernel mode driver many pages won't be mapped into its current address space. To reliably read all memory you will have to modify those structures accordingly before acessing, and restore them afterwards to avoid the OS crashing.
|
|||
![]() |
|
CandyMan 13 Jun 2015, 15:30
Thanks.
PS. How the anti-virus is looking the memory through? _________________ smaller is better |
|||
![]() |
|
Feryno 15 Jun 2015, 05:01
from ring3 you may be sometimes allowed to access virtual memory of different process via
ReadProcessMemory https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx from ring0 there is KeStackAttachProcess https://msdn.microsoft.com/en-us/library/windows/hardware/ff549659%28v=vs.85%29.aspx after attaching you may use various ring0 procedures beginning at Mm..., you may obtain modules info, you may also parse paging tables from CR3 to last level You may also register some ring0 callbacks which are hit at CreatProcess, loading module and so on. To scan physical memory there are some undocumented things like MmGetPhysicalMemoryRanges https://msdn.microsoft.com/en-us/library/windows/hardware/ff554435%28v=vs.85%29.aspx then you may map physical memory pages via MmMapIoSpace to access them by returned virtual memory |
|||
![]() |
|
l_inc 17 Jun 2015, 21:06
CandyMan
\Device\PhysicalMemory is still accessible in the kernel (and even was accessible from user mode in the early XP with no SP). No need to manipulate any hardware dependent structures directly or do anything undocumented. On the other hand it's for very specific purposes, and in most cases one would prefer to look in virtual address spaces. _________________ Faith is a superposition of knowledge and fallacy |
|||
![]() |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2023, Tomasz Grysztar. Also on GitHub, YouTube.
Website powered by rwasa.