flat assembler
Message board for the users of flat assembler.

Index > Windows > Access to all memory

Author
Thread Post new topic Reply to topic
CandyMan



Joined: 04 Sep 2009
Posts: 405
Location: film "CandyMan" directed through Bernard Rose OR Candy Shop
CandyMan 12 Jun 2015, 17:05
How to gain access to the entire memory and to the memory of other programs in windows? Is there some function which enables it?

_________________
smaller is better
Post 12 Jun 2015, 17:05
View user's profile Send private message Reply with quote
Foxxy



Joined: 14 Jul 2014
Posts: 42
Location: Somewhere over the rainbow...
Foxxy 12 Jun 2015, 19:28
Post 12 Jun 2015, 19:28
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 19869
Location: In your JS exploiting you and your system
revolution 13 Jun 2015, 06:24
Also note the need to respect the paging table and segment selectors. Even for a kernel mode driver many pages won't be mapped into its current address space. To reliably read all memory you will have to modify those structures accordingly before acessing, and restore them afterwards to avoid the OS crashing.
Post 13 Jun 2015, 06:24
View user's profile Send private message Visit poster's website Reply with quote
CandyMan



Joined: 04 Sep 2009
Posts: 405
Location: film "CandyMan" directed through Bernard Rose OR Candy Shop
CandyMan 13 Jun 2015, 15:30
Thanks.
PS. How the anti-virus is looking the memory through?

_________________
smaller is better
Post 13 Jun 2015, 15:30
View user's profile Send private message Reply with quote
Feryno



Joined: 23 Mar 2005
Posts: 503
Location: Czech republic, Slovak republic
Feryno 15 Jun 2015, 05:01
from ring3 you may be sometimes allowed to access virtual memory of different process via
ReadProcessMemory
https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx

from ring0 there is
KeStackAttachProcess
https://msdn.microsoft.com/en-us/library/windows/hardware/ff549659%28v=vs.85%29.aspx
after attaching you may use various ring0 procedures beginning at Mm..., you may obtain modules info, you may also parse paging tables from CR3 to last level
You may also register some ring0 callbacks which are hit at CreatProcess, loading module and so on.

To scan physical memory there are some undocumented things like
MmGetPhysicalMemoryRanges
https://msdn.microsoft.com/en-us/library/windows/hardware/ff554435%28v=vs.85%29.aspx
then you may map physical memory pages via MmMapIoSpace to access them by returned virtual memory
Post 15 Jun 2015, 05:01
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
l_inc



Joined: 23 Oct 2009
Posts: 881
l_inc 17 Jun 2015, 21:06
CandyMan
\Device\PhysicalMemory is still accessible in the kernel (and even was accessible from user mode in the early XP with no SP). No need to manipulate any hardware dependent structures directly or do anything undocumented. On the other hand it's for very specific purposes, and in most cases one would prefer to look in virtual address spaces.

_________________
Faith is a superposition of knowledge and fallacy
Post 17 Jun 2015, 21:06
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2023, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.