BOOLEAN ProcMemoryDevice(void* p)
{
PMemoryDevice PMD= (PMemoryDevice)p;
DbgPrintEx(77, 0, "Size==%dMB %dGB\n", PMD->Size, PMD->Size/1024);
}
BOOLEAN DumpSMBIOSStruct(PVOID Addr, ULONG Len)
{
PUCHAR p = (PUCHAR)(Addr);
const PUCHAR lastAddress = p + Len;
PSMBIOSHEADER pHeader;
BOOLEAN result = FALSE;
while (1)
{
pHeader = (PSMBIOSHEADER)p;
if ((pHeader->Type == 127) && (pHeader->Length == 4))
{
break;
}
if (pHeader->Type == 17)
{
ProcMemoryDevice(pHeader);
result = TRUE;
break;
}
PUCHAR nt = p + pHeader->Length; // point to struct end
while (0 != (*nt | *(nt + 1))) nt++; // skip string area
nt += 2;
if (nt >= lastAddress)
break;
p = nt;
}
return result;
}
unsigned char GetSystemInfo()
{
DbgBreakPoint();
NTSTATUS Status = STATUS_SUCCESS;
Status=AuxKlibInitialize();//初始化
if (!NT_SUCCESS(Status))
{
return FALSE;
}
ULONG ReturnLength = 0;
Status=AuxKlibGetSystemFirmwareTable('RSMB',0,NULL,0, &ReturnLength);
if (Status != STATUS_BUFFER_TOO_SMALL)
{
return FALSE;
}
VOID* Mem=ExAllocatePool(PagedPool, ReturnLength);
if (Mem == NULL)
{
return FALSE;
}
Status = AuxKlibGetSystemFirmwareTable('RSMB', 0, Mem, ReturnLength,&ReturnLength);
if (!NT_SUCCESS(Status))
{
ExFreePool(Mem);
return FALSE;
}
p_RawSMBIOSData Psmbios = Mem;
if (DumpSMBIOSStruct(&(Psmbios->SMBIOSTableData), Psmbios->Length))
{
return FALSE;
}
else
{
return TRUE;
}
}
来源DumpSMBIOS/DumpSMBIOS/DumpSMBIOS.cpp at main · 10010100111000/DumpSMBIOS
不太懂这个结构,或许这样比较方便一点物理内存范围 (MmPhysicalMemoryBlock) |WLSGJD