Description: we all know, took over the windows of the direct physical memory access, bios information exists and physical memory of f000 : 0000, the key is how to read physical memory. Note function ZwOpenSection a function used to open the section, the first parameter is a variable HANDLE at the target, and the second was to visit the parameters, the third point is the target OBJECT_ATTRIBUTES second function ZwMapView OfSection used for physical memory and the current process of physical memory for the links, many parameters, in a routine Lane elaborate on the third function to disconnect ZwUnmapViewOfSection physical memory and the current process of mapping links disconnected, a parameter is the process handle, must swap with the second function the same, the second is the process of mapping the s
File list (Check if you may need any files):
Download