do you have Win98 DDK and Win NT/2000/XP DDK?
hi there and first i want to wish you a happy new year !
so here goes my problem...
i'm developing a program , and i need to read some data from adress 0xfe000 for a protection scheme...
in win 98 is ok, but in nt/2000/xp that is not so good...
i know what you will say : build a driver, etc etc...
but the biggest problem is that i don't have ddk !
i have already wrote that driver (hope it works) but i can't compile it...
so...i know that is kind of stupid question...but can anyone compile it for me ? and for win98 ALSO, because it makes my protection scheme harder to break...
thanx anyway, at least for reading this post...
Dani
[686 byte] By [
iq0] at [2007-11-18 0:39:30]
# 1 Re: do you have Win98 DDK and Win NT/2000/XP DDK?
You can solve your biggest problem by going here to order the DDK on CD. Total cost ?? 0.00$ ( + shipping and handling ).
http://www.microsoft.com/ddk/orderxpsp1ddk.asp
mdmd at 2007-11-9 13:02:26 >
# 2 Re: do you have Win98 DDK and Win NT/2000/XP DDK?
You can also download them but they are HUGE. Win2k is 42Mb. Win ME is 27Mb. OK for those who have ADSL links.
The DDK for Win98 seems to have been withdrawn. Maybe you can get it on CD.
You will also need to make sure your copy of Visual Studio has all the latest patches.
cup at 2007-11-9 13:03:27 >
# 4 Re: do you have Win98 DDK and Win NT/2000/XP DDK?
You don't need to write an NT driver in order to access physical memory. You can use NT native API. Here are some samples:
http://www.sysinternals.com/ntw2k/info/tips.shtml#KMem
http://groups.google.com/groups?q=How+to+read+physical+memory&hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=01bdc5f2%24e2ec33d0%241eadf6a8%40caopi2&rnum=3
Dan
DanM at 2007-11-9 13:05:31 >
# 5 Re: do you have Win98 DDK and Win NT/2000/XP DDK?
thank you DanM !
I think that this is the easyest way to read phisycal memory indeed, without the need of DDK!
i didn't get to test it because i'm not home right now, but i'm 99.9 % sure it works...
now, another question : that memory cannot be overwritten, right ? cause it woldn't make any sense..
thanx to all that posted replyes to my question...
silly me ! :)
see ya
(excuse my english...i know)
iq0 at 2007-11-9 13:06:38 >
# 6 Re: do you have Win98 DDK and Win NT/2000/XP DDK?
I haven't tried but I think it depends on the flags that are being passed to NtOpenSection : SECTION_MAP_READ & SECTION_MAP_WRITE. PhysMem uses only SECTION_MAP_READ.
You can try using a combination of SECTION_MAP_READ & SECTION_MAP_WRITE. Just be carefull with the physical address where you want to write something :)
Dan
DanM at 2007-11-9 13:07:36 >
# 7 Re: do you have Win98 DDK and Win NT/2000/XP DDK?
hey DanM i sure do hope that i cannot write to ALL physical memory...at least not at 0x000fe000 because that address contains the ROM-bootstrap, and if i can write to that code than something is not quite allright...
i will try to test it and tell you...
bye !
PS : by the way, the code works (with small modifications - that void* crap)
iq0 at 2007-11-9 13:08:31 >
# 8 Re: do you have Win98 DDK and Win NT/2000/XP DDK?
If it is ROM, then the H/W won't allow you to write at that location (most probably you won't get an error while writing but then you can do a read again and see the contetnts have not been modified).
Anyway, I think it is your responsibility to choose where to write the memory :)
Dan
DanM at 2007-11-9 13:09:34 >
