In Windows Server 2003 SP1, user-mode access to the \Device\PhysicalMemory object is not permitted. All forms of access (read, write) are refused when the \Device\PhysicalMemory object is accessed from a user-mode application. Access to the \Device\PhysicalMemory object is refused regardless of the user context (Administrators, Users, Local System, etc.) the application is running in.
Kernel-mode (driver) access to the \Device\PhysicalMemory object is unchanged for Windows Server 2003 SP1.
好像现代的windows在user-mode确实不能访问\Device\PhysicalMemory。不知道有没有其它方法访问整个内存。不能访问物理内存,用户态驱动很难实现。
[
本帖最后由 wfoo 于 2015-7-9 21:45 编辑 ]