www.pudn.com > PhysicalMemory.rar > PhysicalMemory.h

#include "windows.h" 
 
//定义相应的变量类型，见ntddk.h 
typedef LONG    NTSTATUS; 
 
#define NT_SUCCESS(Status)((NTSTATUS)(Status) >= 0) 
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L) 
 
typedef struct _UNICODE_STRING 
{ 
    USHORT Length; 
    USHORT MaximumLength; 
    PWSTR Buffer; 
} UNICODE_STRING, *PUNICODE_STRING; 
  
typedef enum _SECTION_INHERIT 
{ 
    ViewShare = 1, 
    ViewUnmap = 2 
} SECTION_INHERIT, *PSECTION_INHERIT; 
  
typedef struct _OBJECT_ATTRIBUTES 
{ 
    ULONG Length; 
    HANDLE RootDirectory; 
    PUNICODE_STRING ObjectName; 
    ULONG Attributes; 
    PVOID SecurityDescriptor; 
    PVOID SecurityQualityOfService; 
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; 
  
  
// Interesting functions in NTDLL 
typedef NTSTATUS (WINAPI *ZwOpenSectionProc) 
( 
    PHANDLE SectionHandle, 
    DWORD DesiredAccess, 
    POBJECT_ATTRIBUTES ObjectAttributes 
); 
typedef NTSTATUS (WINAPI *ZwMapViewOfSectionProc) 
( 
    HANDLE SectionHandle, 
    HANDLE ProcessHandle, 
    PVOID *BaseAddress, 
    ULONG ZeroBits, 
    ULONG CommitSize, 
    PLARGE_INTEGER SectionOffset, 
    PULONG ViewSize, 
    SECTION_INHERIT InheritDisposition, 
    ULONG AllocationType, 
    ULONG Protect 
); 
typedef NTSTATUS (WINAPI *ZwUnmapViewOfSectionProc) 
( 
    HANDLE ProcessHandle, 
    PVOID BaseAddress 
); 
typedef VOID (WINAPI *RtlInitUnicodeStringProc) 
( 
    IN OUT PUNICODE_STRING DestinationString, 
    IN PCWSTR SourceString 
); 
 
class PhysicalMemory 
{ 
public: 
	PhysicalMemory(DWORD dwDesiredAccess = SECTION_MAP_READ); 
	~PhysicalMemory(); 
	HANDLE OpenPhysicalMemory(DWORD dwDesiredAccess = SECTION_MAP_READ); 
	VOID SetPhyscialMemoryAccess(HANDLE hPhysicalMemory,//由ZwOpenSection/NtOpenSection返回的物理内存句柄 
								 DWORD dwDesiredAccess//访问权限 
								 ); 
	BOOL ReadPhysicalMemory(OUT PVOID pvDataBuffer, //用于保存读取数据的缓冲区首地址 
							IN DWORD dwAddress, //要读取的数据的首地址，要求4KB对齐 
							IN DWORD dwLength //读取的长度 
							); 
	BOOL WritePhysicalMemory(IN PVOID pvDataBuffer, //用于保存要写入的数据的缓冲区首地址 
							 IN DWORD dwAddress, //要目标地址，要求4KB对齐 
							 IN DWORD dwLength //写入的长度 
							 ); 
 
 
private: 
	static BOOL InitPhysicalMemory() ; 
	static void ExitPhysicalMemory() ; 
 
private: 
	HANDLE m_hPhysicalMemory ; 
	static HMODULE sm_hNtdllModule ; 
	static ZwOpenSectionProc ZwOpenSection; 
	static ZwMapViewOfSectionProc ZwMapViewOfSection; 
	static ZwUnmapViewOfSectionProc ZwUnmapViewOfSection; 
	static RtlInitUnicodeStringProc RtlInitUnicodeString; 
	static PhysicalMemory * sm_pFirstObject; 
	PhysicalMemory * m_pNextObject; 
};