Device\PhysicalMemory Object In Windows Server 2003

What does \Device\PhysicalMemory Object do?
The\Device\PhysicalMemory section object is used by someapplications to access physical memory. Common examples of
this useare managementapplications thatattempt to read System Management BIOS (SMBIOS) or other BIOS data that is
stored in thelowest 1 MB of physical memory.
Who does this feature apply to?
This feature will be of interest to hardwareand hardware managementapplication developers.
What existing functionality is changing in Windows Server 2003 Service Pack 1?
Device\PhysicalMemory section object
Detailed description
In Windows Server 2003 SP1, user-modeaccess to the\Device\PhysicalMemory object is not permitted. All forms of access
(read, write) arerefused when the\Device\PhysicalMemory object is accessed from a user-modeapplication. Access to the
\Device\PhysicalMemory object is refused regardless of the user context (Administrators, Users,Local System,etc.) the
application is running in.
Kernel-mode(driver) access to the\Device\PhysicalMemory object is unchanged for Windows Server 2003 SP1.
Thereare no means to revert this changed behavior in Windows Server 2003 SP1.
Why is this change important? What threats does it help mitigate?
This change was madeto help prevent security exploits that might leveragethefunctionality of the\Device\PhysicalMemory
object from user-mode.
In previous versions of Windows,access to the\Device\PhsyicalMemory object was protected by an access control list (ACL).
However, the ACL may beinadvertently changed. Refusing all access to the\Device\PhysicalMemory object from user-mode
ensures this scenario cannot occur.
What works differently? Are there any dependencies?
Whilethe majority of applications do notattempt to access physical memory, some managementapplications that require
information from the BIOS may beaffected by this change. Many of these managementapplications may beattempting to
read SMBIOS data.
How do I fix these issues?
Managementapplication vendors areencouraged to review their applications for access to the\Device\PhysicalMemory object
and implement one of the workarounds proposed in this section.
Note
Thefollowing methods can be used to read low physical memory and firmwaretable data from an application in Windows
Server 2003 SP1. Applications that require writeaccess to low physical memory must do so from a kernel-mode driver.
Reading SMBIOS information
Windows Management Instrumentation (WMI) is the preferred method for reading SMBIOS information in Windows.WMI
supports reading individual SMBIOS properties (such as the BIOS version or thesystem manufacturer) from the Win32 classes
contained in theroot\cimv2 namespace.
WMIalso supports reading theentirecontents ofSMBIOS data in a single buffer using the MSSMBios_RawSMBiosTables class
inside of theroot\wmi namespace.TheSMBiosData property returns a buffer containing theentireSMBIOS data table,except
theSMBIOS StructureTableEntry Pointas defined in section 2.1.1 of theSMBIOS specification.
WMI supports both a COM and script API to access WMI information. Additionally,WMI is supported in the Windows XP SP2
and Windows Server 2003 SP1 versions of the Windows Preinstallation Environment (WinPE).
Do I need to change my code to work with Windows Server 2003 Service Pack 1?
If your application uses the\Device\PhysicalMemory objectyou will need to changeyour codefor your application to work
with Windows Server 2003 SP1.Therearetwo new user-mode APIs that can be used by applications to read various system
firmwaretables.These APIs can be used to read SMBIOS and ACPI data,as well as raw BIOS data from low physical memory.
The details of the API implementation areavailablein the Platform SDK at the MSDN Web site.Thefollowing arethetwo new
APIs:
EnumSystemFirmwareTables, described on the Microsoft Web siteat http://go.microsoft.com/fwlink/?LinkId=45562.
GetSystemFirmwareTable, described on the Microsoft Web siteat http://go.microsoft.com/fwlink/?LinkId=45563.
For more information
Thefollowing Web resources may also be of interest to you if you areaffected by this changein functionality:
The Windows Management Instrumentation (WMI) section of the Windows Platform SDK available on the Microsoft Web
siteat http://go.microsoft.com/fwlink/?LinkId=159.
TheSystem Management BIOS (SMBIOS) standard specification provide by the Distributed ManagementTask Force, Inc.
(DMTF) which is available on the DMTF Web siteat http://go.microsoft.com/fwlink/?LinkId=38721.
The Microsoft® Windows® Preinstallation Environment (Windows PE) tool, which is availablefor download on the
Microsoft Web siteat http://go.microsoft.com/fwlink/?LinkId=38722.