How can I read low physical memory using Masm32 under W9x/NT? I need to scan low memory (BIOS area) for particular strings... TIA Mike
Posted on 2000-12-29 11:54:00 by Mike
You can use the WinIO dll & driver for that (works under 9x & NT) at http://www.internals.com/ I've made a new import lib and include file for WinIO to make it work with masm, you can download it at http://www.exagone.f2s.com/tempdata/AsmIO.zip Thomas http://exagone.cjb.net
Posted on 2000-12-29 15:06:00 by Thomas
>I need to scan low memory (BIOS area) for particular strings... Hi ! You might use selector 40h for that purpose , it references the BIOS area at absolute 400h ( length 2FFh bytes, DPL 3 so any app can use it ) : for instance , mov ax,40h mov gs,ax ; and use gs:[offset) to access BIOS data
Posted on 2000-12-31 13:46:00 by //imbus
>>I need to scan low memory (BIOS area) for particular strings... >Hi ! You might use selector 40h for that purpose , ... I wish to comment further on my own comment , sorry ;) Maybe it will help to elaborate a bit on 2 or 3 points : 1. The memory referenced by that delector : 40h ( as well as that referenced by the "flat" DS: which Windows gives you by default, as far as low memory is concerned )is indeed mapped to physical mem at the same address,that is , the BIOS data area. Of course my proposition would be useless if it weren't... 2. Then why use 40h:offset instead of DS: ? Well , here is what nobody has told us : the default data selectors provided for us by Windows 9x are read-only for the first few ten kilobytes of memory ! ( Technically , they are R/W , but if you look at the corresponding descriptor in the LDT , you'll see that it is marked "expand-down" with a non-null low-limit ; presumably this is done in order to (try and) prevent us from fumbling the system structures in low mem ... ) The BIOSDATA selector at 0040h is read/write accessible ..; 3. All I said is aimed at Wind*ws 9x/ ME ... I never had an occasion to peek at NT / 2000 , but from what I read I would not suppose the preceding to hold true for it in any way, beware ! /\/
Posted on 2001-01-01 12:48:00 by //imbus