How do you read directly from physical memory on Windows?

by

You would have to write a kernel mode driver and use memory manager functions to map physical memory range to your kernel driver’s system space then export functionality to a user API or driver.

After windows 98 it is not possible in most cases to access physical memory from user mode. As others have put it this is so any old program can’t just destroy people’s computers. You would have to write a kernel driver, which can only be installed if it is signed and first loaded into the window’s store. This alone is not a simple process like linking a DLL.

In summary MmAllocateContiguousMemory() is a windows kernel mode function which maps contiguous physical memory to system memory and is a part of ntoskrnl.exe.

Also you can not call these API’s from user mode applications. Only drivers can use them. User mode applications CANNOT access physical memory without the help of a driver. The driver can either handle reques’s from the user API or use IOCTLs and map its resources to the user program virtual memory. Either way you will need the help of a driver which has to be installed by the plug n play manager. PnP has to choose to install the driver on its own either by hardware activation (i.e. hot plug) or some other method like a bus driver that is always on.

Further windows randomly assign’s virtual address so that it is not easily possible to discern any pattern or work out it’s physical location.

More Related Contents:

  1. Read process memory of a process does not return everything
  2. Can the “Application Error” dialog box be disabled?
  3. How to solve Memory Fragmentation
  4. Heap corruption under Win32; how to locate?
  5. How to get the starting/base address of a process in C++?
  6. How does the Import Library work? Details?
  7. boost_1_60_0 .zip installation in windows
  8. How to read a value from the Windows registry
  9. LPCSTR, LPCTSTR and LPTSTR
  10. How to properly replace global new & delete operators
  11. Porting clock_gettime to windows
  12. How do I open an .exe from another C++ .exe?
  13. How to read file content into istringstream?
  14. Prevent user process from being killed with “End Process” from Process Explorer
  15. How to get screenshot of a window as bitmap object in C++?
  16. What happens when a computer program runs?
  17. How to read output from cmd.exe using CreateProcess() and CreatePipe()
  18. How do I get the window handle of the desktop?
  19. Clang C++ Cross Compiler – Generating Windows Executable from Mac OS X
  20. changing the directory from inside a c program under windows using system command
  21. Get base address of process
  22. How can CString be passed to format string %s?
  23. EnumDisplayDevices vs WMI Win32_DesktopMonitor, how to detect active monitors?
  24. Sorry, unimplemented: 64 bit mode not compiled in
  25. Creating OpenGL context without window
  26. Differences between running an executable with Visual Studio debugger vs without debugger
  27. How to ignore false positive memory leaks from _CrtDumpMemoryLeaks?
  28. Possible problems with NOMINMAX on Visual C++
  29. reading an application’s manifest file?
  30. How can I find the size of all files located inside a folder?

Leave a Comment