Skip to content

Commit e68043d

Browse files
cocafecocafe
committed
readme: update
Signed-off-by: cocafe <[email protected]>
1 parent a4d0928 commit e68043d

File tree

1 file changed

+117
-115
lines changed

1 file changed

+117
-115
lines changed

‎readme.md‎

Lines changed: 117 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -1,115 +1,117 @@
1-
## physmem
2-
3-
A command line utility to read/write physical memory on Windows via **vulnerable** asmmap64 driver.
4-
5-
Run with **administrative privileges**.
6-
7-
Thanks @**[Hyatice](https://github.com/Hyatice)** and @**[ciphray](https://github.com/ciphray)** for helps.
8-
9-
10-
11-
### ⚠ Warning ⚠
12-
13-
- Reading or writing some locations of physical memory can cause data corruption, crash, or any unexpected behaviors.
14-
- If `asmmap64` driver is not removed from system, calling its ioctl may not require promoted privileges to read/write arbitrary memory location. Use with cautions!
15-
- Beware for endianness.
16-
17-
18-
19-
### Disclaimer
20-
21-
This power users program is written by a n00b. I have no responsibility for any damage caused by using this program. It has no warranty absolutely. Use on your on risk. 👻
22-
23-
24-
25-
### Usage
26-
27-
This program utilizes some IOCTL APIs provided by `asmmap64.sys` to implement related features.
28-
29-
Please make sure `asmmap64.sys` is in the same folder with `physmem.exe`.
30-
31-
```
32-
Usage:
33-
physmem.exe [options] read8 <addr>
34-
physmem.exe [options] read16 <addr>
35-
physmem.exe [options] read32 <addr>
36-
physmem.exe [options] read64 <addr>
37-
physmem.exe [options] readblk <addr> <bytes>
38-
physmem.exe [options] write8 <addr> <value>
39-
physmem.exe [options] write16 <addr> <value>
40-
physmem.exe [options] write32 <addr> <value>
41-
physmem.exe [options] write64 <addr> <value>
42-
physmem.exe [options] writeblk <addr> <bytes> <byte0> <byte1> ...
43-
physmem.exe [options] driver install
44-
physmem.exe [options] driver remove
45-
Options:
46-
-h this help text
47-
-v verbose print
48-
-s no readback after writing
49-
-m <bytes> mmap size, default: 8
50-
-x always remove asmmap64 driver on exit
51-
-f force remove driver for command "driver remove"
52-
-C hexdump style print
53-
54-
```
55-
56-
```shell
57-
# read 1 byte with hexdump format
58-
physmem.exe -C read8 0xfed159a0
59-
60-
# read 8 bytes
61-
physmem.exe read64 0xfed159a0
62-
63-
# read 8 bytes block and display in hexdump format
64-
physmem.exe readblk 0xfed159a0 8
65-
66-
# write 8 bytes
67-
physmem.exe write64 0xfed159a0 0x0042820000FE8200
68-
69-
# write 8 bytes silently
70-
physmem.exe -s write64 0xfed159a0 0x0042820000FE8200
71-
72-
# write 8 bytes block
73-
physmem.exe writeblk 0xfed159a0 8 00 82 FE 00 00 82 42 00
74-
```
75-
76-
77-
78-
### Build
79-
80-
Build with CMAKE on MinGW64.
81-
82-
83-
84-
### Issues
85-
86-
- `asmmap64` cannot remove from system for now until reboot
87-
88-
89-
90-
### License
91-
92-
```C
93-
/*
94-
* This program is free software: you can redistribute it and/or modify
95-
* it under the terms of the GNU General Public License as published by
96-
* the Free Software Foundation, version 3.
97-
*
98-
* This program is distributed in the hope that it will be useful, but
99-
* WITHOUT ANY WARRANTY; without even the implied warranty of
100-
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
101-
* General Public License for more details.
102-
*
103-
* You should have received a copy of the GNU General Public License
104-
* along with this program. If not, see <http://www.gnu.org/licenses/>.
105-
*/
106-
```
107-
108-
109-
110-
### References
111-
112-
- https://github.com/namazso/physmem_drivers
113-
- https://github.com/branw/DonkeyKom
114-
- https://github.com/waryas/EUPMAccess
115-
1+
## physmem
2+
3+
A command line utility to read/write physical memory on Windows via **vulnerable** asmmap64 driver.
4+
5+
Run with **administrative privileges**.
6+
7+
Thanks @**[Hyatice](https://github.com/Hyatice)** and @**[ciphray](https://github.com/ciphray)** for helps.
8+
9+
10+
11+
### ⚠ Warning ⚠
12+
13+
- Reading or writing some locations of physical memory can cause data corruption, crash, or any unexpected behaviors.
14+
- If `asmmap64` driver is not removed from system, calling its ioctl may not require promoted privileges to read/write arbitrary memory location. Use with cautions!
15+
- Beware for endianness.
16+
17+
18+
19+
### Disclaimer
20+
21+
This power users program is written by a n00b. I have no responsibility for any damage caused by using this program. It has no warranty absolutely. Use on your on risk. 👻
22+
23+
24+
25+
### Usage
26+
27+
This program utilizes some IOCTL APIs provided by `asmmap64.sys` to implement related features.
28+
29+
Please make sure `asmmap64.sys` is in the same folder with `physmem.exe`.
30+
31+
```
32+
Usage:
33+
physmem.exe [options] read8 <addr>
34+
physmem.exe [options] read16 <addr>
35+
physmem.exe [options] read32 <addr>
36+
physmem.exe [options] read64 <addr>
37+
physmem.exe [options] readblk <addr> <bytes>
38+
physmem.exe [options] write8 <addr> <value>
39+
physmem.exe [options] write16 <addr> <value>
40+
physmem.exe [options] write32 <addr> <value>
41+
physmem.exe [options] write64 <addr> <value>
42+
physmem.exe [options] writeblk <addr> <bytes> <byte0> <byte1> ...
43+
physmem.exe [options] driver install
44+
physmem.exe [options] driver remove
45+
Options:
46+
-h this help text
47+
-v verbose print
48+
-s no readback after writing
49+
-m <bytes> mmap size, default: 8
50+
-x always remove asmmap64 driver on exit
51+
-f force remove driver for command "driver remove"
52+
-C hexdump style print
53+
54+
```
55+
56+
```shell
57+
# read 1 byte with hexdump format
58+
physmem.exe -C read8 0xfed159a0
59+
60+
# read 8 bytes
61+
physmem.exe read64 0xfed159a0
62+
63+
# read 8 bytes block and display in hexdump format
64+
physmem.exe readblk 0xfed159a0 8
65+
66+
# write 8 bytes
67+
physmem.exe write64 0xfed159a0 0x0042820000FE8200
68+
69+
# write 8 bytes silently
70+
physmem.exe -s write64 0xfed159a0 0x0042820000FE8200
71+
72+
# write 8 bytes block
73+
physmem.exe writeblk 0xfed159a0 8 00 82 FE 00 00 82 42 00
74+
```
75+
76+
77+
78+
### Build
79+
80+
Build with CMAKE on MinGW64.
81+
82+
83+
84+
### Issues
85+
86+
- `asmmap64` cannot remove from system via `driver remove` for now until reboot
87+
- for security, use command "[ntdrvldr](https://github.com/iceboy233/ntdrvldr) **-u -n asmmap64 1**" to stop and remove driver from runtime **instantly**
88+
89+
90+
91+
92+
### License
93+
94+
```C
95+
/*
96+
* This program is free software: you can redistribute it and/or modify
97+
* it under the terms of the GNU General Public License as published by
98+
* the Free Software Foundation, version 3.
99+
*
100+
* This program is distributed in the hope that it will be useful, but
101+
* WITHOUT ANY WARRANTY; without even the implied warranty of
102+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
103+
* General Public License for more details.
104+
*
105+
* You should have received a copy of the GNU General Public License
106+
* along with this program. If not, see <http://www.gnu.org/licenses/>.
107+
*/
108+
```
109+
110+
111+
112+
### References
113+
114+
- https://github.com/namazso/physmem_drivers
115+
- https://github.com/branw/DonkeyKom
116+
- https://github.com/waryas/EUPMAccess
117+

0 commit comments

Comments
 (0)