文件名称:windowsbios
介绍说明--下载内容均来自于网络,请自行研究使用
大家都知道,windows接管了对物理内存的直接存取,而bios信息存在物理内存
的f000:0000处,关键就是如何读取物理内存。
函数说明
第一个函数ZwOpenSection用来打开section,第一个参数是指向HANDLE变量的指针,第二个是访问参数,第三个是指向OBJECT_ATTRIBUTES的指针
第二个函数ZwMapViewOfSection用来建立物理内存和当前进程的一段物理内存的联系,参数很多,一会在例程里再详细解释
第三个函数ZwUnmapViewOfSection用来断开物理内存和当前进程中的映射断开联系,第一个参数是进程句柄,必须掉用第二个函数时一样,第二
个是当前进程中映射的基址,由ZwMapViewOfSection返回-we all know, took over the windows of the direct physical memory access, bios information exists and physical memory of f000 : 0000, the key is how to read physical memory. Note function ZwOpenSection a function used to open the section, the first parameter is a variable HANDLE at the target, and the second was to visit the parameters, the third point is the target OBJECT_ATTRIBUTES second function ZwMapView OfSection used for physical memory and the current process of physical memory for the links, many parameters, in a routine Lane elaborate on the third function to disconnect ZwUnmapViewOfSection physical memory and the current process of mapping links disconnected, a parameter is the process handle, must swap with the second function the same, the second is the process of mapping the s
的f000:0000处,关键就是如何读取物理内存。
函数说明
第一个函数ZwOpenSection用来打开section,第一个参数是指向HANDLE变量的指针,第二个是访问参数,第三个是指向OBJECT_ATTRIBUTES的指针
第二个函数ZwMapViewOfSection用来建立物理内存和当前进程的一段物理内存的联系,参数很多,一会在例程里再详细解释
第三个函数ZwUnmapViewOfSection用来断开物理内存和当前进程中的映射断开联系,第一个参数是进程句柄,必须掉用第二个函数时一样,第二
个是当前进程中映射的基址,由ZwMapViewOfSection返回-we all know, took over the windows of the direct physical memory access, bios information exists and physical memory of f000 : 0000, the key is how to read physical memory. Note function ZwOpenSection a function used to open the section, the first parameter is a variable HANDLE at the target, and the second was to visit the parameters, the third point is the target OBJECT_ATTRIBUTES second function ZwMapView OfSection used for physical memory and the current process of physical memory for the links, many parameters, in a routine Lane elaborate on the third function to disconnect ZwUnmapViewOfSection physical memory and the current process of mapping links disconnected, a parameter is the process handle, must swap with the second function the same, the second is the process of mapping the s
(系统自动生成,下载前可以参看下载内容)
下载文件列表
bios.mem
biossave.cpp
biossave.exe
biossave.h
biossave.rc
biossave.sln
biossave.vcproj
Resource.h
stdafx.cpp
stdafx.h
biossave.cpp
biossave.exe
biossave.h
biossave.rc
biossave.sln
biossave.vcproj
Resource.h
stdafx.cpp
stdafx.h