// biossave.cpp
//
#include "stdafx.h"
#include "biossave.h"
#define MAX_LOADSTRING 100
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING,*PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;// 18h
HANDLE RootDirectory;// 00000000
PUNICODE_STRING ObjectName;
ULONG Attributes;//00000040h
PVOID SecurityDescriptor; //Points to type SECURITY_DESCRIPTOR
PVOID SecurityQualityOfService; //Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;
typedef DWORD (__stdcall *ZWOS)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
typedef DWORD (__stdcall *ZWMV)(HANDLE,HANDLE,PVOID,ULONG,ULONG,PLARGE_INTEGER,
PSIZE_T,DWORD,ULONG,ULONG);
typedef DWORD (__stdcall *ZWUMV)(HANDLE,PVOID);
HINSTANCE hInst;
TCHAR szTitle[MAX_LOADSTRING];
TCHAR szWindowClass[MAX_LOADSTRING];
int APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int nCmdShow)
{
MSG msg;
HACCEL hAccelTable;
UNICODE_STRING struniph;
OBJECT_ATTRIBUTES obj_ar;
ZWOS ZWopenS;
ZWMV ZWmapV;
ZWUMV ZWunmapV;
HANDLE hSection;
HMODULE hinstLib;
DWORD ba;
LARGE_INTEGER so;
SIZE_T ssize;
so.LowPart=0x000f0000;
so.HighPart=0x00000000;
ssize=0xffff;
wchar_t strPH[30]=L"\\device\\physicalmemory";
FILE *f1;
ba=0;
struniph.Buffer=strPH;
struniph.Length=0x2c;
struniph.MaximumLength =0x2e;
obj_ar.Attributes =64;
obj_ar.Length =24;//OBJECT_ATTRIBUTES
obj_ar.ObjectName=&struniph;
obj_ar.RootDirectory=0;
obj_ar.SecurityDescriptor=0;
obj_ar.SecurityQualityOfService =0;
hinstLib = LoadLibrary("ntdll.dll");
ZWopenS=(ZWOS)GetProcAddress(hinstLib,"ZwOpenSection");
ZWmapV=(ZWMV)GetProcAddress(hinstLib,"ZwMapViewOfSection");
ZWunmapV=(ZWUMV)GetProcAddress(hinstLib,"ZwUnmapViewOfSection");
ZWopenS(&hSection,4,&obj_ar);
ZWmapV((HANDLE)hSection,(HANDLE)0xffffffff,&ba,0,0xffff,&so,
&ssize,1,0,2);
f1=fopen("bios.mem","wb+");
fwrite((void*)ba,65536,1,f1);
fclose(f1);
MessageBox(NULL,"Bios saved to bios.mem!","Save OK",MB_OK);
return 0;
}