我用ZwOpenSection打开\\Device\\PhysicalMemory,ZwMapViewOfSection映射物理内存地址到当前进程的虚地址空间,在应用层,和驱动层读写低端的物理内存都没有问题,但是读诸如F00000000这样的高端内存就会出错。
1.应用程序返回STATUS_INVALID_PARAMETER_6的错误,也就是地址错误
2.驱动程序返回STATUS_INVALID_VIEW_SIZE错误(An attempt was made to create a view for a section which is bigger than the section.)。 //打开内核对象\Device\PhysicalMemory,获得句柄
NTSTATUS status = ZwOpenSection(&hPhysicalMemory, SECTION_MAP_READ, &attributes );
status = ZwMapViewOfSection(
hPhysicalMemory,
(HANDLE) -1, //将要映射进程的句柄0xffffffff
(PVOID *) &vaddress,//映射的基址
0,
length,
&base,
&outlen,
ViewShare ,
0,//分配类型
PAGE_READONLY
);
1.应用程序返回STATUS_INVALID_PARAMETER_6的错误,也就是地址错误
2.驱动程序返回STATUS_INVALID_VIEW_SIZE错误(An attempt was made to create a view for a section which is bigger than the section.)。 //打开内核对象\Device\PhysicalMemory,获得句柄
NTSTATUS status = ZwOpenSection(&hPhysicalMemory, SECTION_MAP_READ, &attributes );
status = ZwMapViewOfSection(
hPhysicalMemory,
(HANDLE) -1, //将要映射进程的句柄0xffffffff
(PVOID *) &vaddress,//映射的基址
0,
length,
&base,
&outlen,
ViewShare ,
0,//分配类型
PAGE_READONLY
);
这个已经超过4G了 , 这个已经到60G的地址了
pStartPhysAddress.QuadPart = (ULONGLONG)0xF0000000;经过这一步,pStartPhysAddress居然等于0xFFFFFFFFF0000000.