📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Retrieving Windows Kernel Memory Maps

Topic created on: May 12, 2008 13:46 CDT by FILEOBJECT .

Currently trying to write a windows kernel driver that reads kernel memory and dumps it to a userland application.  I've been looking through all the windows driver reference material for the last couple of days looking for a simple way to retrieve process memory maps similar to how its done on the userland side (aka.  VirtualQuery), but cant seem to find anything for kernel land development.  Anyone have any ideas on how to do this?

thanks.

  spender     May 12, 2008 14:02.59 CDT
http://www.windowsitlibrary.com/Content/356/04/4.html

  itsme     May 12, 2008 14:56.36 CDT
i wrote a commandline tool to dump either process memory, or kernel memory, it is part of my windows ce toolset, which also includes some normal windows tools.

description: http://www.xs4all.nl/~itsme/projects/xda/tools.html
download: itsutilsbin-20080313.zip
source: http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/
* see pmemdump.cpp and sysint-physmem.cpp

it uses code from sysinternals which shows how to read physical memory.

how to use:

memdump -p -4 0x39000
* will dump 256 dwords ( the -4 switch ) starting at physical ( the -p switch ) address 0x39000

memdump -n cmd.exe -s 0x1000 0 0x40000
* will dump 16 bytes every 4k from the first 256k of cmd.exe memory.

combining '-m' with '-p' will dump memory according to the virtual memory translation table at phys mem 0x39000

willem

  FILEOBJECT     May 13, 2008 19:38.31 CDT
Thanks for the replies.  I think VADs are really what im looking for here, as they include all paged data instead of just physical memory.  However, as a follow up question, is there a simple way to get the size of physical memory from inside a windows device driver.

Something that would return a value signifying how much ram is available on the system so i could have a limit when dumping \\device\physicalmemory.

This was the closest i found on MSDN:
http://msdn.microsoft.com/en-us/library/ms802006.aspx

Thanks.

  FILEOBJECT     May 13, 2008 20:56.09 CDT
Actually, i think i figured it out myself.  MmGetPhysicalMemoryRanges() seems to be the winner.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit