Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations IamaSherpa on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

How to read physical memory?

Status
Not open for further replies.

bkowlagi

Programmer
Apr 8, 2003
28
US
I want to get read access to physical memory to search for certain bytes. The memory address range is 0x000F0000 to 0x000FFFFF that is 64K bytes. I tried using the following code

NTSTATUS status;
HANDLE physmem;

status = NtOpenSection( &physmem, SECTION_MAP_READ, &attributes );

if( !NT_SUCCESS( status )) {

PrintError( "Could not open \\device\\physicalmemory", status );
return NULL;
}

return physmem;

I am able to get the handle (physmem) but when I try

_lseek(physmem, 0L, SEEK_SET);

perror() gives "Bad file descriptor"

Is there an alternate way to read this section of memory?
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top