How can I read from memory? 1

[Rogg]

I want to know what is contained in my RAM at address &h000F0000.

What's the easiest way to read from an address?

 

[jmarler]

Is the address the logical mapped address in the virtual process space, or is it the physical memory address? And either way, is this something you want to do from VB? - Jeff Marler B-)

 

[Rogg]

Sure, I want to use VB, and I want to read from physical memory.

 

[jmarler]

To do that, you are going to have to map the pysical memory into your virtual process space using the Native APIs stored in NTDLL.DLL. Here are the API that you will need to use . . .

RtlInitUnicodeString
NtUnmapViewOfSection
NtOpenSection
NtMapViewOfSection
RtlNtStatusToDosError

and you will need to use this device name . . .

\device\physicalmemory


I have never tried to do this from VB, but I have called the APIs from C++. Here is a link to some source code from

http://www.Sysinternals.com

(an excellent site if you want to know how Windows works behind the scenes) that shows how to use the APIs from C++ . . .

http://www.sysinternals.com/files/physmem.zip

You should be able to convert the code to VB and run it from there or you could just put the c++ code into a DLL and call it from VB.
- Jeff Marler B-)

 

[strongm]

>Sure, I want to use VB, and I want to read from physical memory.

You may discover that actually you don't....

 

[jmarler]

I have to agree with stongm on this . . . as I said before, you should be able to convert the API calls into VB, but typically, you do not want to be running any low level code in VB . . . these function are generally best left to C++ or Assembly. I guess it just comes down to the right tool for the right job. Whatever language you decide on, the APIs that I listed are the ones that you are going to need to use. - Jeff Marler B-)