Developer knowledge network · moderated exchange

Супольнасць UnreliableCode

Супольнасць распрацоўшчыкаў даследаванняў, зваротнага праектавання і кадавання

Knowledge indexжыць
4Categories
919Threads
2.8KПаведамленні
Tutorial

Physical Memory Page Mapping via MmMapIoSpace and PML4 translation

kernel_komrade
Driver Dev
MEMBER
прадстаўнік: 145
Дата далучэння: Feb 2019
Паведамленні: 26
Дзякуй: 45
1 месяцаў таму · Jul 9, 2026 7:47 AM
#1

To read physical RAM without relying on virtual page table CR3 contexts:

C
NTSTATUS ReadPhysicalAddress(PHYSICAL_ADDRESS physAddr, PVOID buffer, SIZE_T size) {
    PVOID pMapped = MmMapIoSpace(physAddr, size, MmNonCached);
    if (!pMapped) return STATUS_INSUFFICIENT_RESOURCES;
    RtlCopyMemory(buffer, pMapped, size);
    MmUnmapIoSpace(pMapped, size);
    return STATUS_SUCCESS;
}

Physical addresses are immutable across thread context switches, making physical memory mapping 100% immune to virtual CR3 directory base swapping.

dma_ghost
DMA Guru
MEMBER
прадстаўнік: 115
Дата далучэння: Jan 2020
Паведамленні: 12
Дзякуй: 83
1 месяцаў таму · Jul 9, 2026 9:49 AM
#2

This is identical to how PCIe DMA hardware reads memory. Physical RAM mapping is the cleanest kernel read technique.

hypervisor_hank
Kernel Wizard
MEMBER
прадстаўнік: 108
Дата далучэння: Feb 2020
Паведамленні: 17
Дзякуй: 44
1 месяцаў таму · Jul 9, 2026 5:44 PM
#3

Make sure you don't map non-existent physical addresses to avoid BugCheck 0x3B.