Device\PhysicalMemory Object In Windows Server 2003

IT Support Forum Forums Windows Windows Server 2003 R2 General Discussion Device\PhysicalMemory Object In Windows Server 2003

Viewing 0 reply threads
  • Author
    • #2193

      What does \Device\PhysicalMemory Object do?
      The\Device\PhysicalMemory section object is used by someapplications to access physical memory. Common examples of
      this useare managementapplications thatattempt to read System Management BIOS (SMBIOS) or other BIOS data that is
      stored in thelowest 1 MB of physical memory.
      Who does this feature apply to?
      This feature will be of interest to hardwareand hardware managementapplication developers.
      What existing functionality is changing in Windows Server 2003 Service Pack 1?
      Device\PhysicalMemory section object
      Detailed description
      In Windows Server 2003 SP1, user-modeaccess to the\Device\PhysicalMemory object is not permitted. All forms of access
      (read, write) arerefused when the\Device\PhysicalMemory object is accessed from a user-modeapplication. Access to the
      \Device\PhysicalMemory object is refused regardless of the user context (Administrators, Users,Local System,etc.) the
      application is running in.
      Kernel-mode(driver) access to the\Device\PhysicalMemory object is unchanged for Windows Server 2003 SP1.
      Thereare no means to revert this changed behavior in Windows Server 2003 SP1.
      Why is this change important? What threats does it help mitigate?
      This change was madeto help prevent security exploits that might leveragethefunctionality of the\Device\PhysicalMemory
      object from user-mode.
      In previous versions of Windows,access to the\Device\PhsyicalMemory object was protected by an access control list (ACL).
      However, the ACL may beinadvertently changed. Refusing all access to the\Device\PhysicalMemory object from user-mode
      ensures this scenario cannot occur.
      What works differently? Are there any dependencies?
      Whilethe majority of applications do notattempt to access physical memory, some managementapplications that require
      information from the BIOS may beaffected by this change. Many of these managementapplications may beattempting to
      read SMBIOS data.
      How do I fix these issues?
      Managementapplication vendors areencouraged to review their applications for access to the\Device\PhysicalMemory object
      and implement one of the workarounds proposed in this section.
      Thefollowing methods can be used to read low physical memory and firmwaretable data from an application in Windows
      Server 2003 SP1. Applications that require writeaccess to low physical memory must do so from a kernel-mode driver.
      Reading SMBIOS information
      Windows Management Instrumentation (WMI) is the preferred method for reading SMBIOS information in Windows.WMI
      supports reading individual SMBIOS properties (such as the BIOS version or thesystem manufacturer) from the Win32 classes
      contained in theroot\cimv2 namespace.
      WMIalso supports reading theentirecontents ofSMBIOS data in a single buffer using the MSSMBios_RawSMBiosTables class
      inside of theroot\wmi namespace.TheSMBiosData property returns a buffer containing theentireSMBIOS data table,except
      theSMBIOS StructureTableEntry Pointas defined in section 2.1.1 of theSMBIOS specification.
      WMI supports both a COM and script API to access WMI information. Additionally,WMI is supported in the Windows XP SP2
      and Windows Server 2003 SP1 versions of the Windows Preinstallation Environment (WinPE).
      Do I need to change my code to work with Windows Server 2003 Service Pack 1?
      If your application uses the\Device\PhysicalMemory objectyou will need to changeyour codefor your application to work
      with Windows Server 2003 SP1.Therearetwo new user-mode APIs that can be used by applications to read various system
      firmwaretables.These APIs can be used to read SMBIOS and ACPI data,as well as raw BIOS data from low physical memory.
      The details of the API implementation areavailablein the Platform SDK at the MSDN Web site.Thefollowing arethetwo new
      EnumSystemFirmwareTables, described on the Microsoft Web siteat
      GetSystemFirmwareTable, described on the Microsoft Web siteat
      For more information
      Thefollowing Web resources may also be of interest to you if you areaffected by this changein functionality:
      The Windows Management Instrumentation (WMI) section of the Windows Platform SDK available on the Microsoft Web
      TheSystem Management BIOS (SMBIOS) standard specification provide by the Distributed ManagementTask Force, Inc.
      (DMTF) which is available on the DMTF Web siteat
      The Microsoft® Windows® Preinstallation Environment (Windows PE) tool, which is availablefor download on the
      Microsoft Web siteat

Viewing 0 reply threads
  • You must be logged in to reply to this topic.