Simple BIOS save

Tweet

// biossave.cpp
//
#include "stdafx.h"
#include "biossave.h"
#define MAX_LOADSTRING 100

typedef struct _UNICODE_STRING {
  USHORT  Length;
  USHORT  MaximumLength;
  PWSTR  Buffer;
} UNICODE_STRING,*PUNICODE_STRING;


typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;// 18h
    HANDLE RootDirectory;//  00000000
    PUNICODE_STRING ObjectName;
    ULONG Attributes;//00000040h
    PVOID SecurityDescriptor;       //Points to type SECURITY_DESCRIPTOR
    PVOID SecurityQualityOfService; //Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;

typedef DWORD  (__stdcall *ZWOS)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
typedef DWORD  (__stdcall *ZWMV)(HANDLE,HANDLE,PVOID,ULONG,ULONG,PLARGE_INTEGER,
                                  PSIZE_T,DWORD,ULONG,ULONG);
typedef DWORD  (__stdcall *ZWUMV)(HANDLE,PVOID);


HINSTANCE hInst;
TCHAR szTitle[MAX_LOADSTRING];
TCHAR szWindowClass[MAX_LOADSTRING];


int APIENTRY _tWinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPTSTR    lpCmdLine,
                     int       nCmdShow)
{
 	MSG msg;
	HACCEL hAccelTable;
	UNICODE_STRING struniph;
	OBJECT_ATTRIBUTES obj_ar;
	ZWOS ZWopenS;
	ZWMV ZWmapV;
	ZWUMV ZWunmapV;
	HANDLE hSection;
	HMODULE hinstLib;
	DWORD ba;
	LARGE_INTEGER so;
	SIZE_T ssize;
	so.LowPart=0x000f0000;
	so.HighPart=0x00000000;
	ssize=0xffff;
	wchar_t strPH[30]=L"\\device\\physicalmemory";
	FILE *f1;


    	ba=0;
    	struniph.Buffer=strPH;
	struniph.Length=0x2c;
	struniph.MaximumLength =0x2e;
    	obj_ar.Attributes =64;
	obj_ar.Length =24;//OBJECT_ATTRIBUTES
	obj_ar.ObjectName=&struniph;
	obj_ar.RootDirectory=0;
	obj_ar.SecurityDescriptor=0;
    	obj_ar.SecurityQualityOfService =0;

    	hinstLib = LoadLibrary("ntdll.dll");
	ZWopenS=(ZWOS)GetProcAddress(hinstLib,"ZwOpenSection");
    	ZWmapV=(ZWMV)GetProcAddress(hinstLib,"ZwMapViewOfSection");
	ZWunmapV=(ZWUMV)GetProcAddress(hinstLib,"ZwUnmapViewOfSection");

    	ZWopenS(&hSection,4,&obj_ar);
	ZWmapV((HANDLE)hSection,(HANDLE)0xffffffff,&ba,0,0xffff,&so,
	        &ssize,1,0,2);
    	f1=fopen("bios.mem","wb+");
	fwrite((void*)ba,65536,1,f1);
	fclose(f1);
	MessageBox(NULL,"Bios saved to bios.mem!","Save OK",MB_OK);
	return 0;
}