blocks|key|711451|text|简短的回答是:不|type|unstyled|depth|inlineStyleRanges|entityRanges|data|711452|长长的答案：|711453|C/C%2B%2B标准用非常简单术语定义了机器。没有虚拟内存(只是内存)的概念。这些概念更多地是硬件的领域，并且可以潜在地通过OS访问(如果它知道OS之类的事情)。|711454|关于您的操作系统/硬件提供的功能，我会再次提出问题。|711455|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

Short Answer: No

Long Answer:

The C/C++ standard define a machine in very simple terms. There is no concept of virtual memory (just memory). These concepts are more the domain of the hardware and may be potentially accessed via the OS (if it is aware OS such things).

I would re-ask the question in terms of the facilities provided by your OS/Hardware.

blocks|key|496086|text|我猜不可能直接访问物理地址。即使拥有管理特权也不能。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|496087|应用程序访问的每个地址都是虚拟地址，硬件MMU将虚拟地址转换为物理地址。|496088|一种方法是将MMU配置为一对一地将虚拟地址映射到物理地址。这通常是在没有操作系统的嵌入式系统中或在加载操作系统之前完成的。|496089|加载了窗口。我相信你的要求是不可能的。|496090|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

I guess its not possible to access the physical address directly. Not even with administrative privilege. 

Every address accessed by the the application is virtual address which is translated to physical address by hardware MMU. 

One way is to configure MMU for one to one mapping the virtual address to physical address. This is usually done in embedded systems with no OS or before loading the OS. 

With windows loaded. I believe your requirement is not possible.

blocks|key|711537|text|请查看此链接：Access+Physical+Memory,+Port+and+PCI+Configuration+Space|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|711538|但从Windows+Vista开始，即使是WinHex也无法打开物理ram。|711539|entityMap|0|LINK|mutability|MUTABLE|url|http://www.codeproject.com/KB/system/phymem.aspx^0|7|1K|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

Check this link: <a href="http://www.codeproject.com/KB/system/phymem.aspx" rel="noreferrer">Access Physical Memory, Port and PCI Configuration Space</a>

But start from Windows Vista, even WinHex cannot open the physical ram.

blocks|key|711605|text|我认为设备驱动程序必须允许物理内存访问，因为PCI卡等设备需要以这种方式访问。如果你可以从一个驱动程序中做到这一点，那么为你的“用户”(更像是管理员)模式程序编写一个自定义分配器，以便轻松地链接到C%2B%2B中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|711606|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I would think a device driver must allow physical memory access, since devices such as PCI cards need to be accessed that way. If you can do it from a driver, then write a custom allocator for your "user" ( more like administrator ) mode program to easily link into C++.

blocks|key|711694|text|您必须编写内核模式驱动程序，并使用内存管理器函数将物理内存范围映射到内核驱动程序的系统空间，然后将功能导出到用户API或驱动程序。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|711695|在Windows98之后，在大多数情况下不可能从用户模式访问物理内存。正如其他人所说，这是因为任何旧程序都不能只破坏人们的计算机。您必须编写内核驱动程序，只有在签名并首先加载到窗口的存储中时，才能安装内核驱动程序。仅此一项并不像链接DLL那样是一个简单的过程。|711696|总之，MmAllocateContiguousMemory()是一个windows内核模式函数，它将连续的物理内存映射到系统内存，是ntoskrnl.exe的一部分。|offset|length|style|CODE|711697|此外，您不能从用户模式应用程序中调用这些API。只有司机才能使用它们。如果没有驱动程序的帮助，用户模式应用程序就无法访问物理内存。驱动程序可以处理来自用户API的请求，也可以使用IOCTL并将其资源映射到API的虚拟内存。无论哪种方式，您都需要一个驱动程序的帮助，该驱动程序必须由即插即用管理器安装。PnP必须选择自己安装驱动程序，要么通过硬件激活，即热插拔，要么通过其他方法安装驱动程序，比如总线驱动程序始终处于打开状态。|711698|此外，windows随机分配虚拟地址，这样就不容易辨别任何模式或计算出它的物理位置。|711699|entityMap^0|0|0|3|S|1U|C|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@$F|S|G|T|H|I]|$F|U|G|V|H|I]]|9|@]|A|$]]|$1|J|3|K|5|6|7|W|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|X|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|O|$]]

You would have to write a kernel mode driver and use memory manager functions to map physical memory range to your kernel driver's system space then export functionality to a user API or driver. 

After windows 98 it is not possible in most cases to access physical memory from user mode. As others have put it this is so any old program cant just destroy people's computers. You would have to write a kernel driver, which can only be installed if it is signed and first loaded into the window's store. This alone is not a simple process like linking a DLL. 

In summary <code>MmAllocateContiguousMemory()</code> is a windows kernel mode function which maps contiguous physical memory to system memory and is a part of <code>ntoskrnl.exe</code>.

Also you can not call these API's from user mode applications. Only driver's can use them. User mode applications CANNOT access physical memory with out the help of a driver. The driver can either handle request's from the user API or use IOCTLs and map it's resources to the API's virtual memory. Either way you will need the help of a driver which has to be installed by plug n play manager. PnP has to choose to install the driver on it's own either by hardware activation i.e. hot plug or some other method like a bus driver that is always on. 

Further windows randomly assign's virtual address so that it is not easily possible to discern any pattern or work out it's physical location.

blocks|key|496455|text|在Windows下，你应该使用NativeAPI调用NtOpenSection和NtMapViewOfSection|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|496456|Mark+Russinovich的例子|496457|static+BOOLEAN+MapPhysicalMemory(+HANDLE+PhysicalMemory,
++++++++++++++++++++++++++++PDWORD+Address,+PDWORD+Length,
++++++++++++++++++++++++++++PDWORD+VirtualAddress+)
{
++++NTSTATUS++++++++++++ntStatus;
++++PHYSICAL_ADDRESS++++viewBase;
++++char++++++++++++++++error[256];

++++*VirtualAddress+=+0;
++++viewBase.QuadPart+=+(ULONGLONG)+(*Address);
++++ntStatus+=+NtMapViewOfSection+(PhysicalMemory,
+++++++++++++++++++++++++++++++(HANDLE)+-1,
+++++++++++++++++++++++++++++++(PVOID)+VirtualAddress,
+++++++++++++++++++++++++++++++0L,
+++++++++++++++++++++++++++++++*Length,
+++++++++++++++++++++++++++++++&viewBase,
+++++++++++++++++++++++++++++++Length,
+++++++++++++++++++++++++++++++ViewShare,
+++++++++++++++++++++++++++++++0,
+++++++++++++++++++++++++++++++PAGE_READONLY+);

++++if(+!NT_SUCCESS(+ntStatus+))+{

++++++++sprintf_s(+error,+"Could+not+map+view+of+%25X+length+%25X",
++++++++++++++++*Address,+*Length+);
++++++++PrintError(+error,+ntStatus+);
++++++++return+FALSE;+++++++++++++++++++
++++}

++++*Address+=+viewBase.LowPart;
++++return+TRUE;
}

static+HANDLE+OpenPhysicalMemory()
{
++++NTSTATUS++++++++status;
++++HANDLE++++++++++physmem;
++++UNICODE_STRING++physmemString;
++++OBJECT_ATTRIBUTES+attributes;
++++WCHAR+++++++++++physmemName[]+=+L"\\device\\physicalmemory";

++++RtlInitUnicodeString(+&physmemString,+physmemName+);++++

++++InitializeObjectAttributes(+&attributes,+&physmemString,
++++++++++++++++++++++++++++++++OBJ_CASE_INSENSITIVE,+NULL,+NULL+);+++++++++
++++status+=+NtOpenSection(+&physmem,+SECTION_MAP_READ,+&attributes+);

++++if(+!NT_SUCCESS(+status+))+{

++++++++PrintError(+"Could+not+open+\\device\\physicalmemory",+status+);
++++++++return+NULL;
++++}

++++return+physmem;
}|code-block|syntax|javascript|496458|\device\physicalmemory类似于Linux下的/dev/mem，您还可以直接访问物理内存。顺便说一下，对Windows不太确定，但在Linux下只有1Mb的物理地址空间可用，因为它可能包含一些服务低级数据，如BIOS表。访问其他物理内存可能会损坏由操作系统管理的虚拟内存，这就是不允许访问的原因|style|CODE|496459|更新:提供的代码从Windows+Vista开始不能在用户模式下工作。相反，您可以调用GetSystemFirmwareTable()来从1MB的原始内存中获取有用的信息，而无需查找它。|496460|奖励:在Linux+(Debian+9)下使用Boost+IO内存映射文件读取物理内存，这是类的一部分：|496461|NativePhysicalMemory::NativePhysicalMemory(size_t+base,+size_t+length)
++++:+physical_memory_map_(std::make_unique<boost::iostreams::mapped_file_source>())
{
++++map_physical_memory(base,+length);
}

//+...

void+NativePhysicalMemory::map_physical_memory(size_t+base,+size_t+length)
{
#ifdef+_SC_PAGESIZE
++++size_t+mempry_page_offset+=+base+%25+sysconf(_SC_PAGESIZE);
#else
++++size_t+mempry_page_offset+=+base+%25+getpagesize();
#endif+/*+_SC_PAGESIZE+*/

++++boost_io::mapped_file_params+params+=+{};
++++params.path+=+"/dev/mem";
++++params.flags+=+boost_io::mapped_file::mapmode::readonly;
++++params.length+=+length+%2B+mempry_page_offset;
++++params.offset+=+base+-+mempry_page_offset;
++++params.hint+=+nullptr;
++++physical_memory_map_->open(params);
}|496462|entityMap|0|LINK|mutability|MUTABLE|url|https://msdn.microsoft.com/en-us/library/windows/hardware/ff556580(v=vs.85).aspx|1|https://msdn.microsoft.com/en-us/library/ff556551(v=vs.85).aspx^0|Q|D|0|14|I|1|0|0|0|0|M|W|8|0|0|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]|$A|18|B|19|1|1A]]|C|$]]|$1|D|3|E|5|6|7|1B|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1C|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|1D|8|@$A|1E|B|1F|M|N]|$A|1G|B|1H|M|N]]|9|@]|C|$]]|$1|O|3|P|5|6|7|1I|8|@]|9|@]|C|$]]|$1|Q|3|R|5|6|7|1J|8|@]|9|@]|C|$]]|$1|S|3|T|5|H|7|1K|8|@]|9|@]|C|$I|J]]|$1|U|3|-4|5|6|7|1L|8|@]|9|@]|C|$]]]|V|$W|$5|X|Y|Z|C|$10|11]]|12|$5|X|Y|Z|C|$10|13]]]]

Under Windows you should use NativeAPI calls <a href="https://msdn.microsoft.com/en-us/library/windows/hardware/ff556580(v=vs.85).aspx" rel="nofollow noreferrer">NtOpenSection</a> and <a href="https://msdn.microsoft.com/en-us/library/ff556551(v=vs.85).aspx" rel="nofollow noreferrer">NtMapViewOfSection</a>

Example from Mark Russinovich

<pre><code>static BOOLEAN MapPhysicalMemory( HANDLE PhysicalMemory,
 PDWORD Address, PDWORD Length,
 PDWORD VirtualAddress )
{
 NTSTATUS ntStatus;
 PHYSICAL_ADDRESS viewBase;
 char error[256];

 *VirtualAddress = 0;
 viewBase.QuadPart = (ULONGLONG) (*Address);
 ntStatus = NtMapViewOfSection (PhysicalMemory,
 (HANDLE) -1,
 (PVOID) VirtualAddress,
 0L,
 *Length,
 &amp;viewBase,
 Length,
 ViewShare,
 0,
 PAGE_READONLY );

 if( !NT_SUCCESS( ntStatus )) {

 sprintf_s( error, "Could not map view of %X length %X",
 *Address, *Length );
 PrintError( error, ntStatus );
 return FALSE; 
 }

 *Address = viewBase.LowPart;
 return TRUE;
}

static HANDLE OpenPhysicalMemory()
{
 NTSTATUS status;
 HANDLE physmem;
 UNICODE_STRING physmemString;
 OBJECT_ATTRIBUTES attributes;
 WCHAR physmemName[] = L"\\device\\physicalmemory";

 RtlInitUnicodeString( &amp;physmemString, physmemName ); 

 InitializeObjectAttributes( &amp;attributes, &amp;physmemString,
 OBJ_CASE_INSENSITIVE, NULL, NULL ); 
 status = NtOpenSection( &amp;physmem, SECTION_MAP_READ, &amp;attributes );

 if( !NT_SUCCESS( status )) {

 PrintError( "Could not open \\device\\physicalmemory", status );
 return NULL;
 }

 return physmem;
}
</code></pre>

<code>\device\physicalmemory</code> is an analog of <code>/dev/mem</code> under Linux, where you also have possibility to access physical memory directly. By the way, not sure about Windows, but under Linux only 1 Mb of physical address space is available, because it may contain some service low-level data like BIOS tables. Access to other physical memory may corrupt virtual memory, managed by the OS, and that's why it's not allowed

UPDATE: Provided code does not work under user-mode starting from Windows Vista. Instead you can call GetSystemFirmwareTable() to get useful information from 1st MB of raw memory without looking for it.

Bonus: reading physical memory under Linux (Debian 9) using Boost IO memory-mapped file, part of the class:

<pre><code>NativePhysicalMemory::NativePhysicalMemory(size_t base, size_t length)
 : physical_memory_map_(std::make_unique&lt;boost::iostreams::mapped_file_source&gt;())
{
 map_physical_memory(base, length);
}

// ...

void NativePhysicalMemory::map_physical_memory(size_t base, size_t length)
{
#ifdef _SC_PAGESIZE
 size_t mempry_page_offset = base % sysconf(_SC_PAGESIZE);
#else
 size_t mempry_page_offset = base % getpagesize();
#endif /* _SC_PAGESIZE */

 boost_io::mapped_file_params params = {};
 params.path = "/dev/mem";
 params.flags = boost_io::mapped_file::mapmode::readonly;
 params.length = length + mempry_page_offset;
 params.offset = base - mempry_page_offset;
 params.hint = nullptr;
 physical_memory_map_-&gt;open(params);
}
</code></pre>

In C or C++ (windows), how do you read RAM by giving a physical (not virtual) address?
That means without going trough virtual memory system (mmu tables), and being specific to one process.

I already know the API <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms680553.aspx" rel="noreferrer"><code>ReadProcessMemory</code></a>, which reads from ram (used by most trainers) but it is only for a specific process.

I searched on MSDN and found that <a href="http://technet.microsoft.com/en-us/library/cc787565.aspx" rel="noreferrer">Device\PhysicalMemory</a> seems to give such possibility, but I found no practical example and this feature seems to have been turned off by Windows service packs (to fix some vulnerability).

I know it is possible to do because WinHex does it (if you choose "tools" > "open ram" > "physical memory"). It will then display RAM content from 0x00000000 to your_ram_size just like when you open a traditional file. It requires administrator rights, but there is no driver to install (which means WinHex does it from user mode).

EDIT : added information about os.

How do you read directly from physical memory?

设备驱动程序

嵌入式系统

内存管理

内存映射

Windows

Debian

Linux

在C或C++ (windows)中，如何通过给出物理(而非虚拟)地址来读取内存？这意味着不需要通过虚拟内存系统(mmu表)，并且特定于一个进程。我已经知道API ，它从ram读取(大多数训练者使用)，但它只用于特定的过程。我在MSDN上搜索，发现似乎提供了这样的可能性，但我没有找到实际的例子，而且这个功能似乎已经被Wi...

问如何直接从物理内存中读取数据？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何直接从物理内存中读取数据？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何直接从物理内存中读取数据？
EN