关于MmMapIoSpace函数（高手们进来帮帮忙，在线等）

digi01

关于MmMapIoSpace函数（高手们进来帮帮忙，在线等） [复制链接]

[code]
        ULONG SIZE = 16;
        //ULONG ADDRESS = 0x00000413;
        PHYSICAL_ADDRESS ioPhysicalBase = {0x0000050F,0x00000500};
        SECTOR_KEY =  (PUCHAR)MmMapIoSpace(ioPhysicalBase,SIZE,FALSE);
        DbgPrint("SECORT_KEY_007:\n");

        if(SECTOR_KEY==NULL)
        {
                DbgPrint("This is NULL!\n");
        }else{
                DbgPrint("%x\n",SECTOR_KEY);
                DbgPrint("%X\n",*SECTOR_KEY);
                DbgPrint("not null end\n");
        }
我在0x00000500这个位置写了三个字符"aut",但是用DbgPrint打印出来的消息并不时"aut",而是"FF"。不知道是不是我这个函数是否用对了，还望懂这个东西的高手们帮下忙。
小弟在这先谢过了

wlnjrn

小弟就是想在驱动程序中以字符串指针的方式读内存物理地址为0x00000500下的16个字符，或者有其它的方法。希望知道的高手们不吝赐教，最好能详细解释下或给段代码给我。
再谢过啦！！！

lightofficer

MmMapIoSpace
The MmMapIoSpace routine maps the given physical address range to nonpaged system space.

PVOID
  MmMapIoSpace(
    IN PHYSICAL_ADDRESS  PhysicalAddress,
    IN ULONG  NumberOfBytes,
    IN MEMORY_CACHING_TYPE  CacheType
    );


Parameters
PhysicalAddress
Specifies the starting physical address of the I/O range to be mapped.
NumberOfBytes
Specifies a value greater than zero, indicating the number of bytes to be mapped.
CacheType
Specifies a MEMORY_CACHING_TYPE value, which indicates the permitted caching behavior when mapping the physical address range.

Return Value
MmMapIoSpace returns the base virtual address that maps the base physical address for the range. If space for mapping the range is insufficient, it returns NULL.

houcs01

0x00000500是实际的物理地址吧？

mj20002008

已经弄出来了！发个大家共享下！

1. 
   
2. #include
   
3. #include
   
4. //#include
   
5. #include
   
6. 
   
7. #define BYTESPERLINE 16
   
8. #define LINESPERSCREEN 25
   
9. #define OBJ_CASE_INSENSITIVE 0x00000040L
   
10. #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
    
11. #define InitializeObjectAttributes( p, n, a, r, s ) { \
    
12.         (p)->Length = sizeof( OBJECT_ATTRIBUTES ); \
    
13.         (p)->RootDirectory = r; \
    
14.         (p)->Attributes = a; \
    
15.         (p)->ObjectName = n; \
    
16.         (p)->SecurityDescriptor = s; \
    
17.         (p)->SecurityQualityOfService = NULL; \
    
18. }
    
19. 
    
20. typedef struct _UNICODE_STRING
    
21. {
    
22.     USHORT Length;
    
23.     USHORT MaximumLength;
    
24. #ifdef MIDL_PASS
    
25.     [size_is(MaximumLength / 2), length_is((Length) / 2) ] USHORT * Buffer;
    
26. #else // MIDL_PASS
    
27.     PWSTR Buffer;
    
28. #endif // MIDL_PASS
    
29. } UNICODE_STRING;
    
30. 
    
31. typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS; // windbgkd
    
32. typedef LONG NTSTATUS;
    
33. typedef UNICODE_STRING *PUNICODE_STRING;
    
34. typedef enum _SECTION_INHERIT{ ViewShare = 1 , ViewUnmap = 2 } SECTION_INHERIT;
    
35. 
    
36. //*************************************************************************************************
    
37. typedef struct _OBJECT_ATTRIBUTES
    
38. {
    
39.     ULONG Length;
    
40.     HANDLE RootDirectory;
    
41.     PUNICODE_STRING ObjectName;
    
42.     ULONG Attributes;
    
43.     PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR
    
44.     PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE
    
45. } OBJECT_ATTRIBUTES;
    
46. typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;
    
47. 
    
48. //************************************************************************
    
49. NTSTATUS (__stdcall *NtUnmapViewOfSection)
    
50. (
    
51. IN HANDLE ProcessHandle,
    
52. IN PVOID BaseAddress
    
53. );
    
54. NTSTATUS (__stdcall *NtOpenSection)
    
55. (
    
56. OUT PHANDLE SectionHandle,
    
57. IN ACCESS_MASK DesiredAccess,
    
58. IN POBJECT_ATTRIBUTES ObjectAttributes
    
59. );
    
60. NTSTATUS (__stdcall *NtMapViewOfSection)
    
61. (
    
62. IN HANDLE SectionHandle,
    
63. IN HANDLE ProcessHandle,
    
64. IN OUT PVOID *BaseAddress,
    
65. IN ULONG ZeroBits,
    
66. IN ULONG CommitSize,
    
67. IN OUT PLARGE_INTEGER SectionOffset, /* optional */
    
68. IN OUT PULONG ViewSize,
    
69. IN SECTION_INHERIT InheritDisposition,
    
70. IN ULONG AllocationType,
    
71. IN ULONG Protect
    
72. );
    
73. VOID (__stdcall *RtlInitUnicodeString)
    
74. (
    
75. IN OUT PUNICODE_STRING DestinationString,
    
76. IN PCWSTR SourceString
    
77. );
    
78. ULONG (__stdcall *RtlNtStatusToDosError)
    
79. (
    
80. IN NTSTATUS Status
    
81. );
    
82. VOID UnmapPhysicalMemory( DWORD Address )
    
83. {
    
84.         NTSTATUS status;
    
85.         status = NtUnmapViewOfSection( (HANDLE) -1, (PVOID) Address );
    
86. }
    
87. //************************************************************************
    
88. //--------------------------------------------------------
    
89. //
    
90. // MapPhysicalMemory
    
91. //
    
92. // Maps a view of a section.
    
93. //
    
94. //--------------------------------------------------------
    
95. BOOLEAN MapPhysicalMemory(        HANDLE PhysicalMemory,
    
96.                                                         PDWORD Address,
    
97.                                                         PDWORD Length,
    
98.                                                         PDWORD VirtualAddress )
    
99. {
    
100.     NTSTATUS ntStatus;
     
101.     PHYSICAL_ADDRESS viewBase;
     
102.     //char error[256];
     
103.     *VirtualAddress = 0;
     
104.     viewBase.QuadPart = (ULONGLONG) (*Address);
     
105.     ntStatus = NtMapViewOfSection (PhysicalMemory,
     
106.         (HANDLE) -1,
     
107.         (PVOID *) VirtualAddress,
     
108.         0L,
     
109.         *Length,
     
110.         &viewBase,
     
111.         Length,
     
112.         ViewShare,
     
113.         0,
     
114.         PAGE_READONLY );
     
115.     *Address = viewBase.LowPart;
     
116.     return TRUE;
     
117. }
     
118. //--------------------------------------------------------
     
119. //
     
120. // OpensPhysicalMemory
     
121. //
     
122. // This function opens the physical memory device. It
     
123. // uses the native API since
     
124. //
     
125. //--------------------------------------------------------
     
126. HANDLE OpenPhysicalMemory()
     
127. {
     
128.     NTSTATUS status;
     
129.     HANDLE physmem;
     
130.     UNICODE_STRING physmemString;
     
131.     OBJECT_ATTRIBUTES attributes;
     
132.     WCHAR physmemName[] = L"\\device\\physicalmemory";
     
133.     RtlInitUnicodeString( &physmemString, physmemName );
     
134.     InitializeObjectAttributes( &attributes, &physmemString,
     
135.     OBJ_CASE_INSENSITIVE, NULL, NULL );
     
136.     status = NtOpenSection( &physmem, SECTION_MAP_READ, &attributes );
     
137.     return physmem;
     
138. }
     
139. //--------------------------------------------------------
     
140. //
     
141. // LocateNtdllEntryPoints
     
142. //
     
143. // Finds the entry points for all the functions we
     
144. // need within NTDLL.DLL.
     
145. //
     
146. //--------------------------------------------------------
     
147. BOOLEAN LocateNtdllEntryPoints()
     
148. {
     
149.     if( !(RtlInitUnicodeString = (void (__stdcall *)(PUNICODE_STRING,PCWSTR)) GetProcAddress( GetModuleHandle("ntdll.dll"),"RtlInitUnicodeString" )) )
     
150.     {
     
151.         return FALSE;
     
152.     }
     
153.     if( !(NtUnmapViewOfSection = (NTSTATUS (__stdcall *)(HANDLE,PVOID)) GetProcAddress( GetModuleHandle("ntdll.dll"),"NtUnmapViewOfSection" )) )
     
154.     {
     
155.         return FALSE;
     
156.     }
     
157.     if( !(NtOpenSection = (NTSTATUS (__stdcall *)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES)) GetProcAddress( GetModuleHandle("ntdll.dll"),"NtOpenSection" )) )
     
158.     {
     
159.         return FALSE;
     
160.     }
     
161.     if( !(NtMapViewOfSection = (NTSTATUS (__stdcall *)(IN HANDLE,
     
162.                                                        IN HANDLE,
     
163.                                                        IN OUT PVOID *,
     
164.                                                        IN ULONG ,
     
165.                                                        IN ULONG ,
     
166.                                                        IN OUT PLARGE_INTEGER ,
     
167.                                                        IN OUT PULONG,
     
168.                                                        IN SECTION_INHERIT,
     
169.                                                        IN ULONG ,
     
170.                                                        IN ULONG )) GetProcAddress( GetModuleHandle("ntdll.dll"),"NtMapViewOfSection" )) )
     
171.     {
     
172.         return FALSE;
     
173.     }
     
174.     if( !(RtlNtStatusToDosError = (ULONG (__stdcall *)(NTSTATUS)) GetProcAddress( GetModuleHandle("ntdll.dll"),"RtlNtStatusToDosError" )) )
     
175.     {
     
176.         return FALSE;
     
177.     }
     
178.     return TRUE;
     
179. }
     
180. 
     
181. //--------------------------------------------------------
     
182. //
     
183. //Memory_Call
     
184. //
     
185. //
     
186. //--------------------------------------------------------
     
187. void Memory_Call()
     
188. {
     
189.         HANDLE physmem;
     
190.         DWORD vaddress, paddress, length;
     
191.         char key[16];
     
192.         char input[256];
     
193.         char mk[] = "12";
     
194.         char jk[] = "12";
     
195. 
     
196.         //
     
197.         // Load NTDLL entry points
     
198.         LocateNtdllEntryPoints();
     
199.         physmem = OpenPhysicalMemory();
     
200.        
     
201.         paddress = 0x00;
     
202.         length = 0x00;
     
203.         while(1)
     
204.         {
     
205.                 memcpy(input,mk,3);
     
206.                 sscanf( input, "%x", &paddress );
     
207.                 memcpy(input,jk,3);
     
208.                 sscanf( input, "%x", &length );
     
209.                 if( !MapPhysicalMemory( physmem, &paddress, &length,&vaddress ))
     
210.                         continue;
     
211.                 memcpy(key,(char *)vaddress+1280,16);
     
212.                 printf(key);
     
213.                 printf("\n");
     
214.                 break;
     
215.                 UnmapPhysicalMemory( vaddress );
     
216.         }
     
217.        
     
218. 
     
219.         CloseHandle( physmem );
     
220. }
     
221. //--------------------------------------------------------
     
222. //
     
223. // Main
     
224. //
     
225. // This program drives the command loop
     
226. //
     
227. //--------------------------------------------------------
     
228. int main( int argc, char *argv[] )
     
229. {
     
230.         Memory_Call();
     
231.         _getch();
     
232.         return 0;
     
233. }
     
234. 
     

复制代码

mz6605

贴出来的代码没有注释，不好理解，感觉和读取0x00000500下的16个字符无关。

MmMapIoSpace函数调用错在这里：
PHYSICAL_ADDRESS ioPhysicalBase = {0x0000050F,0x00000500};
物理地址是64位的地址，这样写的意思是访问0x5000000050F,而不是从0x00000500到0x0000050F。
修改如下：
PHYSICAL_ADDRESS ioPhysicalBase = {0x0000050F,0};

windows_01

标记下