СергейСВ
Гость
|
|
« Ответ #1 : 25-06-2004 08:24 » |
|
След. код исполняется в любом ядрёном драйвере и даёт юзеру тот самый указатель Avirtual по физическому адресу Lphysical. Проверялось на видеопамяти под W2K.
NTSTATUS MapIntoUserSpace( ULONG length, ULONG Lphysical, ULONG* Avirtual) { NTSTATUS ntStatus; UNICODE_STRING physicalMemoryUnicodeString; OBJECT_ATTRIBUTES objectAttributes; PHYSICAL_ADDRESS mappedLength; PHYSICAL_ADDRESS viewBase; PHYSICAL_ADDRESS physicalAddressBase; PVOID virtualAddress; HANDLE physicalMemoryHandle = NULL; PVOID PhysicalMemorySection = NULL;
RtlInitUnicodeString (&physicalMemoryUnicodeString, L"\\Device\\PhysicalMemory"); InitializeObjectAttributes (&objectAttributes, &physicalMemoryUnicodeString, OBJ_CASE_INSENSITIVE, (HANDLE) NULL, (PSECURITY_DESCRIPTOR) NULL); ntStatus = ZwOpenSection (&physicalMemoryHandle, SECTION_ALL_ACCESS, &objectAttributes); ntStatus = ObReferenceObjectByHandle (physicalMemoryHandle, SECTION_ALL_ACCESS, (POBJECT_TYPE) NULL, KernelMode, &PhysicalMemorySection, (POBJECT_HANDLE_INFORMATION) NULL);
mappedLength=RtlConvertUlongToLargeInteger(length); viewBase = RtlConvertUlongToLargeInteger(Lphysical); physicalAddressBase=viewBase; virtualAddress = NULL;
ntStatus = ZwMapViewOfSection (physicalMemoryHandle, (HANDLE) -1, &virtualAddress, 0L, length, &viewBase, &length, ViewShare, 0, PAGE_READWRITE | PAGE_NOCACHE); #if DBG DbgPrint("MAP: status=%8X\n",ntStatus); DbgPrint("MAP: virtual=%08X\n",(ULONG)virtualAddress); #endif
*Avirtual=(ULONG)virtualAddress; return ntStatus; } // MapIntoUserSpace
|