阅读:1282回复:0
求救,如何读写高端物理内存?例如F00000000
我用ZwOpenSection打开\\Device\\ PhysicalMemory,ZwMapViewOfSection映射物理内存地址到当前进程的虚地址空间,在应用层,和驱动层读写低端的物理内存都没有问题,但是读诸如F00000000这样的高端内存就会出错。
1.应用程序返回STATUS_INVALID_PARAMETER_6的错误,也就是地址错误 2. 驱动程序返回STATUS_INVALID_VIEW_SIZE错误(An attempt was made to create a view for a section which is bigger than the section.)。 //打开内核对象\Device\PhysicalMemory,获得句柄 NTSTATUS status = ZwOpenSection(&hPhysicalMemory, SECTION_MAP_READ, &attributes ); status = ZwMapViewOfSection( hPhysicalMemory, (HANDLE) -1, //将要映射进程的句柄0xffffffff (PVOID *) &vaddress,//映射的基址 0, length, &base, &outlen, ViewShare , 0,//分配类型 PAGE_READONLY ); |
|
|