Log in

View Full Version : Low-level (not necessarily process specific) memory editor for Windows XP?


Six Black Roses
December 31st, 2003, 07:41
I've searched a bit, but there are too many vague results on Google. This forum doesn't seem to have the thread I'd look for.

Basically I want to be able to view and edit physical memory. Maybe I'm asking the wrong question, but would Windows XP launch such program? Perhaps there's something a bit on a higher level.

I want to be able to view memory that's not specific to processes. As a matter of fact, if there's a utility that'd allow me to see the BIOS shadow (not sure of the proper term), I'd prefer that.

In other words, I want as low-level a memory editor as will run under Windows XP. SoftICE, even if applicable, is not an option. My USB keyboard doesn't work with it, no matter which settings I've tried, etc.

Thanks

dELTA
December 31st, 2003, 08:59
This would require some kind of ring 0 application (i.e. kernel driver), to break through the virtual memory layer.

Why do you want to read physical addresses instead of the virtual addresses that the applications use? Are you familiar with the virtual memory model of Windows?

For reading the virtual memory space of any process (which is still all the memory that any specific process can access), WinHex is pretty good anyway.

MaRKuS-DJM
December 31st, 2003, 09:26
very good decision, Delta i'm using winhex for years

disavowed
December 31st, 2003, 13:34
this should be exactly what you're looking for (along with source code):
http://www.sysinternals.com/ntw2k/info/tips.shtml#kmem

if you want a more detailed write-up on how it works, read
http://www.phrack.org/phrack/59/p59-0x10.txt

JMI
December 31st, 2003, 19:07
You just got to love this place. Ask a good and/or interesting question, and ye shall receive a relevant URL.
The whole darn page is filled with information that is useful.
http://www.sysinternals.com/ntw2k/info/tips.shtml

Regards,

UrgeOverKill
December 31st, 2003, 19:56
You might also consider Davory as well. You can sample this on Stephen site too.

dELTA
January 1st, 2004, 19:33
Cool, I wasn't aware of that "backdoor" to the physical memory.