Windows 10读取固定物理内存地址的可行性及C/C++实现问询

可行性说明 #

Windows 10中可以实现读取固定物理内存地址，但用户态程序（包括托管C#）无法直接访问物理内存——系统采用虚拟内存机制，用户态进程仅能访问分配给自己的虚拟地址空间。必须通过以下两种方式实现：

1. 利用系统提供的\\.\PhysicalMemory设备（用户态，存在访问限制）；
2. 编写内核态驱动（更可靠，无过多访问限制）。

方案一：基于\\.\PhysicalMemory的用户态DLL实现（受限） #

这种方式无需编写内核驱动，但需要管理员权限，且仅能访问系统允许的物理内存页（部分硬件占用的内存可能无法读取）。

1. C/C++ DLL编写（导出读取函数） #

#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "advapi32.lib")

// 启用内存锁定权限
BOOL EnablePrivilege() {
    HANDLE hToken;
    TOKEN_PRIVILEGES tp;
    LUID luid;

    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
        return FALSE;
    }

    if (!LookupPrivilegeValue(NULL, SE_LOCK_MEMORY_NAME, &luid)) {
        CloseHandle(hToken);
        return FALSE;
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
        CloseHandle(hToken);
        return FALSE;
    }

    CloseHandle(hToken);
    return TRUE;
}

// 导出函数：读取指定物理地址的内容
extern "C" __declspec(dllexport) BOOL ReadPhysicalMemory(ULONG64 physicalAddr, PVOID buffer, SIZE_T size) {
    if (!EnablePrivilege()) {
        return FALSE;
    }

    HANDLE hPhysicalMemory = CreateFile(L"\\\\.\\PhysicalMemory", GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL);
    if (hPhysicalMemory == INVALID_HANDLE_VALUE) {
        return FALSE;
    }

    // 计算物理页的起始地址和偏移
    ULONG64 pageAddr = physicalAddr & ~(PAGE_SIZE - 1);
    SIZE_T offset = physicalAddr - pageAddr;

    // 映射物理页到虚拟地址
    PVOID pVirtualAddr = MapViewOfFile(hPhysicalMemory, FILE_MAP_READ, 0, (DWORD)(pageAddr >> 32), (DWORD)pageAddr, PAGE_SIZE);
    if (pVirtualAddr == NULL) {
        CloseHandle(hPhysicalMemory);
        return FALSE;
    }

    // 读取内容到缓冲区
    memcpy(buffer, (PBYTE)pVirtualAddr + offset, size);

    // 清理资源
    UnmapViewOfFile(pVirtualAddr);
    CloseHandle(hPhysicalMemory);
    return TRUE;
}

编译时需选择与C#程序一致的架构（x64/x86），生成DLL文件。

2. C#调用DLL #

使用DllImport导入DLL函数，注意以管理员身份运行程序：

using System;
using System.Runtime.InteropServices;

class PhysicalMemoryReader
{
    [DllImport("PhysicalMemoryReader.dll", CallingConvention = CallingConvention.Cdecl)]
    private static extern bool ReadPhysicalMemory(ulong physicalAddr, IntPtr buffer, int size);

    public static bool ReadPhysicalAddress(ulong physicalAddr, byte[] buffer)
    {
        GCHandle handle = GCHandle.Alloc(buffer, GCHandleType.Pinned);
        try
        {
            IntPtr ptr = handle.AddrOfPinnedObject();
            return ReadPhysicalMemory(physicalAddr, ptr, buffer.Length);
        }
        finally
        {
            handle.Free();
        }
    }

    // 示例调用
    static void Main()
    {
        ulong targetAddr = 0x12345678; // 替换为你的固定物理地址
        byte[] buffer = new byte[4]; // 读取4字节数据
        if (ReadPhysicalAddress(targetAddr, buffer))
        {
            Console.WriteLine($"读取成功：0x{BitConverter.ToUInt32(buffer, 0):X8}");
        }
        else
        {
            Console.WriteLine("读取失败");
        }
    }
}

方案二：基于内核驱动的实现（可靠） #

如果\\.\PhysicalMemory无法读取目标硬件的内存，必须编写内核驱动。以下是简化流程：

1. 内核驱动编写（实现物理内存读取） #

驱动中通过MmMapIoSpace映射物理内存到内核虚拟地址，然后通过IOCTL接口将数据返回给用户态：

#include <ntddk.h>

#define IOCTL_READ_PHYSICAL_MEM CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)

typedef struct _READ_PHYSICAL_MEM_REQUEST {
    ULONG64 PhysicalAddress;
    SIZE_T Size;
} READ_PHYSICAL_MEM_REQUEST, *PREAD_PHYSICAL_MEM_REQUEST;

NTSTATUS DispatchIOCTL(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    NTSTATUS status = STATUS_SUCCESS;
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    PVOID buffer = Irp->AssociatedIrp.SystemBuffer;

    if (stack->Parameters.DeviceIoControl.IoControlCode == IOCTL_READ_PHYSICAL_MEM) {
        PREAD_PHYSICAL_MEM_REQUEST req = (PREAD_PHYSICAL_MEM_REQUEST)buffer;
        if (req->Size > Irp->IoStatus.Information) {
            status = STATUS_BUFFER_TOO_SMALL;
            goto exit;
        }

        // 映射物理内存到内核虚拟地址
        PVOID virtualAddr = MmMapIoSpace((PHYSICAL_ADDRESS){req->PhysicalAddress}, req->Size, MmNonCached);
        if (!virtualAddr) {
            status = STATUS_INSUFFICIENT_RESOURCES;
            goto exit;
        }

        // 复制数据到用户缓冲区
        RtlCopyMemory(buffer + sizeof(READ_PHYSICAL_MEM_REQUEST), virtualAddr, req->Size);
        Irp->IoStatus.Information = sizeof(READ_PHYSICAL_MEM_REQUEST) + req->Size;

        MmUnmapIoSpace(virtualAddr, req->Size);
    } else {
        status = STATUS_INVALID_DEVICE_REQUEST;
    }

exit:
    Irp->IoStatus.Status = status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

// 驱动入口和其他必要函数（简化）
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    UNICODE_STRING devName = RTL_CONSTANT_STRING(L"\\Device\\PhysicalMemDriver");
    UNICODE_STRING symName = RTL_CONSTANT_STRING(L"\\??\\PhysicalMemDriver");
    PDEVICE_OBJECT devObj;

    NTSTATUS status = IoCreateDevice(DriverObject, 0, &devName, FILE_DEVICE_UNKNOWN, 0, FALSE, &devObj);
    if (!NT_SUCCESS(status)) return status;

    status = IoCreateSymbolicLink(&symName, &devName);
    if (!NT_SUCCESS(status)) {
        IoDeleteDevice(devObj);
        return status;
    }

    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIOCTL;
    DriverObject->DriverUnload = [](PDRIVER_OBJECT DriverObject) {
        UNICODE_STRING symName = RTL_CONSTANT_STRING(L"\\??\\PhysicalMemDriver");
        IoDeleteSymbolicLink(&symName);
        IoDeleteDevice(DriverObject->DeviceObject);
    };

    devObj->Flags |= DO_BUFFERED_IO;
    devObj->Flags &= ~DO_DEVICE_INITIALIZING;
    return STATUS_SUCCESS;
}

2. 用户态C/C++ DLL封装（与驱动通信） #

编写DLL封装驱动的打开和IOCTL调用：

#include <windows.h>

extern "C" __declspec(dllexport) BOOL ReadPhysicalMemoryViaDriver(ULONG64 physicalAddr, PVOID buffer, SIZE_T size) {
    HANDLE hDriver = CreateFile(L"\\\\.\\PhysicalMemDriver", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hDriver == INVALID_HANDLE_VALUE) {
        return FALSE;
    }

    typedef struct {
        ULONG64 PhysicalAddress;
        SIZE_T Size;
        BYTE Data[1024]; // 根据实际需求调整大小
    } READ_REQUEST;

    READ_REQUEST req = { physicalAddr, size };
    DWORD bytesReturned;
    BOOL result = DeviceIoControl(hDriver, IOCTL_READ_PHYSICAL_MEM, &req, sizeof(req), &req, sizeof(req), &bytesReturned, NULL);
    if (result) {
        memcpy(buffer, req.Data, size);
    }

    CloseHandle(hDriver);
    return result;
}

3. C#调用用户态DLL #

与方案一的C#代码类似，只需替换DLL名称和函数名：

using System;
using System.Runtime.InteropServices;

class PhysicalMemoryReader
{
    [DllImport("PhysicalMemDriverWrapper.dll", CallingConvention = CallingConvention.Cdecl)]
    private static extern bool ReadPhysicalMemoryViaDriver(ulong physicalAddr, IntPtr buffer, int size);

    // 调用逻辑与方案一一致，此处省略重复代码
}

注意事项 #

• 所有操作必须以管理员身份运行程序。
• 内核驱动需要数字签名：Windows 10默认禁止加载未签名驱动，可开启测试模式（bcdedit /set testsigning on）或使用企业级代码签名证书。
• 错误的物理地址可能导致系统崩溃，务必确认地址的正确性。

内容的提问来源于stack exchange，提问作者No Dev