Device\PhysicalMemory Object In Windows Server 2003

IT Support Forum Forums Windows Windows Server 2003 R2 General Discussion Device\PhysicalMemory Object In Windows Server 2003

This topic contains 0 replies, has 1 voice, and was last updated by  Webmaster 2 weeks, 1 day ago.

  • Author
    Posts
  • #2193

    Webmaster
    Keymaster

    What does \Device\PhysicalMemory Object do?
    The\Device\PhysicalMemory section object is used by someapplications to access physical memory. Common examples of
    this useare managementapplications thatattempt to read System Management BIOS (SMBIOS) or other BIOS data that is
    stored in thelowest 1 MB of physical memory.
    Who does this feature apply to?
    This feature will be of interest to hardwareand hardware managementapplication developers.
    What existing functionality is changing in Windows Server 2003 Service Pack 1?
    Device\PhysicalMemory section object
    Detailed description
    In Windows Server 2003 SP1, user-modeaccess to the\Device\PhysicalMemory object is not permitted. All forms of access
    (read, write) arerefused when the\Device\PhysicalMemory object is accessed from a user-modeapplication. Access to the
    \Device\PhysicalMemory object is refused regardless of the user context (Administrators, Users,Local System,etc.) the
    application is running in.
    Kernel-mode(driver) access to the\Device\PhysicalMemory object is unchanged for Windows Server 2003 SP1.
    Thereare no means to revert this changed behavior in Windows Server 2003 SP1.
    Why is this change important? What threats does it help mitigate?
    This change was madeto help prevent security exploits that might leveragethefunctionality of the\Device\PhysicalMemory
    object from user-mode.
    In previous versions of Windows,access to the\Device\PhsyicalMemory object was protected by an access control list (ACL).
    However, the ACL may beinadvertently changed. Refusing all access to the\Device\PhysicalMemory object from user-mode
    ensures this scenario cannot occur.
    What works differently? Are there any dependencies?
    Whilethe majority of applications do notattempt to access physical memory, some managementapplications that require
    information from the BIOS may beaffected by this change. Many of these managementapplications may beattempting to
    read SMBIOS data.
    How do I fix these issues?
    Managementapplication vendors areencouraged to review their applications for access to the\Device\PhysicalMemory object
    and implement one of the workarounds proposed in this section.
    Note
    Thefollowing methods can be used to read low physical memory and firmwaretable data from an application in Windows
    Server 2003 SP1. Applications that require writeaccess to low physical memory must do so from a kernel-mode driver.
    Reading SMBIOS information
    Windows Management Instrumentation (WMI) is the preferred method for reading SMBIOS information in Windows.WMI
    supports reading individual SMBIOS properties (such as the BIOS version or thesystem manufacturer) from the Win32 classes
    contained in theroot\cimv2 namespace.
    WMIalso supports reading theentirecontents ofSMBIOS data in a single buffer using the MSSMBios_RawSMBiosTables class
    inside of theroot\wmi namespace.TheSMBiosData property returns a buffer containing theentireSMBIOS data table,except
    theSMBIOS StructureTableEntry Pointas defined in section 2.1.1 of theSMBIOS specification.
    WMI supports both a COM and script API to access WMI information. Additionally,WMI is supported in the Windows XP SP2
    and Windows Server 2003 SP1 versions of the Windows Preinstallation Environment (WinPE).
    Do I need to change my code to work with Windows Server 2003 Service Pack 1?
    If your application uses the\Device\PhysicalMemory objectyou will need to changeyour codefor your application to work
    with Windows Server 2003 SP1.Therearetwo new user-mode APIs that can be used by applications to read various system
    firmwaretables.These APIs can be used to read SMBIOS and ACPI data,as well as raw BIOS data from low physical memory.
    The details of the API implementation areavailablein the Platform SDK at the MSDN Web site.Thefollowing arethetwo new
    APIs:
    EnumSystemFirmwareTables, described on the Microsoft Web siteat http://go.microsoft.com/fwlink/?LinkId=45562.
    GetSystemFirmwareTable, described on the Microsoft Web siteat http://go.microsoft.com/fwlink/?LinkId=45563.
    For more information
    Thefollowing Web resources may also be of interest to you if you areaffected by this changein functionality:
    The Windows Management Instrumentation (WMI) section of the Windows Platform SDK available on the Microsoft Web
    siteat http://go.microsoft.com/fwlink/?LinkId=159.
    TheSystem Management BIOS (SMBIOS) standard specification provide by the Distributed ManagementTask Force, Inc.
    (DMTF) which is available on the DMTF Web siteat http://go.microsoft.com/fwlink/?LinkId=38721.
    The Microsoft® Windows® Preinstallation Environment (Windows PE) tool, which is availablefor download on the
    Microsoft Web siteat http://go.microsoft.com/fwlink/?LinkId=38722.

You must be logged in to reply to this topic.