Another method use Native Api ,like He4 rootkit 
In the 32bit translate function:
ULONG LinearAddressToPhysicalAddress(ULONG lAddress)
{
unsigned int *pAddr;
unsigned int *PageDirectoryEntry = (unsigned int *) 0xC0300000;
unsigned int *PageTableEntry = (unsigned int *) 0xC0000000;
if((!(PageDirectoryEntry[lAddress >> 22] & 0xFFFFF000))
&& (!(PageDirectoryEntry[lAddress >> 22] & 0x00000001)))
{
return 0;
}
pAddr = (unsigned int *) ((int)PageTableEntry + ((lAddress & 0xFFFFF000) >>
10));
if((*pAddr) & 1)
{
return ((*pAddr) & 0xFFFFF000) | (lAddress & 0x00000FFF);
}
return 0;
}
void PhysicalAddressToLinearAddress(ULONG pAddress)
{
int i,j;
unsigned int *pAddr;
unsigned int *PageDirectoryEntry = (unsigned int *) 0xC0300000;
unsigned int *PageTableEntry = (unsigned int *) 0xC0000000;
for(i = 0;i < 1024;i++)
{
if((PageDirectoryEntry[i] & 0xFFFFF000) && (PageDirectoryEntry[i] &
0x00000001))
{
for(j = 0;j < 1024;j++)
{
pAddr = (unsigned int *)((int)PageTableEntry + i*4096 + j*4);
if((*pAddr) & 0x00000001)
{
if(((*pAddr) & 0xFFFFF000) == (pAddress & 0xFFFFF000))
{
DbgPrint(“%08X\n”,((i*4*1024*1024 + j*4*1024) & 0xFFFFF000) |
(pAddress & 0x00000FFF));
}
}
}
}
}
}
“Else Kluger” ??? news:xxxxx@ntdev…
> “What do you gain by having credentials entered before the GINA
> has control”
>
> You cannot boot - a desired effect of sector based Disk Encryption.
> If you can (because your preboot credentials are ok), the SSO is
> just a “side-effect” then.
>
> Else
>
>
> |---------±-------------------------------->
> | | “Bill McKenzie” |
> | | > | | net> |
> | | Sent by: |
> | | bounce-235093-16691@li|
> | | sts.osr.com |
> | | |
> | | |
> | | 01/17/2006 03:25 PM |
> | | Please respond to |
> | | “Windows System |
> | | Software Devs Interest|
> | | List” |
> |---------±-------------------------------->
>
>---------------------------------------------------------------------------
--------------------------------|
> |
|
> | To: “Windows System Software Devs Interest List”
|
> | cc:
|
> | Subject: Re:[ntdev] How to access memory using the physical
address (Unsigned Mail) |
>
>---------------------------------------------------------------------------
--------------------------------|
>
>
>
>
> To what end? What do you gain by having credentials entered before the
> GINA
> has control? Through a custom GINA it is possible to establish secure
> network connections before Windows login, there is support for dealing
with
>
> Smart cards and such, and you can even customize the Windows login UI if
> more info is needed at login. Essentially, Winlogon is up and running
> about
> as early in the OS load process as you could ever want a network
> connection,
> so I am curious as to the need for any pre-OS handoff.
>
> Bill M.
>
> “ZG” wrote in message news:xxxxx@ntdev…
> > As I know, SafeBoot and SecureDoc have done this. I think there are some
> > people who want this feature otherwise these companies will not survive.
> >
> > –
> >
> > Regards,
> > ZG [@ Sydney]
> > Windows Driver Developer
> >
> >
> > “Bill McKenzie” wrote in message
> > news:xxxxx@ntdev…
> > This is not the way to implement single sign-on. You need to read up on
> > the Microsoft Gina DLL and Gina-stub DLLs. The user does have to
> > successfully login to the WIndows platform 1 time, but that is the only
> > requirement. From that point on, the user’s credentials can be cached
for
>
> > pre-Windows login network verification. If you have more restrictive
> > requirements, it might be interesting to explain those further.
However,
>
> > the GINA method has worked for the biggest names in PC platform
> > production, so I can’t imagine the customer for whom this is not
> > sufficient. Playing hand-off from a boot loader or some such to the OS,
> > is not a great idea.
> >
> > Bill M.
> > “GrepAll” wrote in message news:xxxxx@ntdev…
> > Hi,
> >
> > It’s not a platform, either a device.
> >
> > I want implement pre-boot verification function. That is, user should
> > enter his password before Windows starts, and by sharing the buffer, the
> > driver could get the password to implement single-sign-on (in fact it’s
> > useless for password verification, but it’s useful for other
> verification,
> > SmartCard verification for example.).
> >
> > In my research, there is about 32kb size space which Windows won’t
> > rewrite, and it’s enough as my buffer. Or we just forget the “won’t be
> > rewritten” suppose, I’m interested in how to access memory by physical
> > address.
> >
> > I check the DDK document, u r right, MmMapIoSpace is not obsolete. But
> the
> > HalTranslateBusAddress is obsolete. Could you please tell me how to
> > initialize the PHYSICAL_ADDRESS with a linear physical address? I’m not
> so
> > familar with driver development. Thanks!
> >
> > GrepAll
> >
> >
> >
> >
> >
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
> > Sent: Tuesday, January 17, 2006 12:02 PM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] How to access memory using the physical address
> >
> >
> > Massively small font there.
> >
> > MmMapIoSpace is not obsolete, but that is the least of your problems.
> That
> > “suppose the buffer won’t be rewritten” part, for physical memory owned
> by
> > the OS, is a huge problem. How do you suppose that is going to happen?
> You
> > initialize the PHYSICAL_ADDRESS with the linear physical address of the
> > buffer that you suppose won’t be rewritten. What exactly are you
> > bootstrapping? A platform? A device?
> > =====================
> > Mark Roddy DDK MVP
> > Windows 2003/XP/2000 Consulting
> > Hollis Technology Solutions 603-321-1032
> > www.hollistech.com
> >
> >
> >
> >
> >
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of GrepAll
> > Sent: Monday, January 16, 2006 8:56 PM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] How to access memory using the physical address
> >
> >
> > Hi, all
> >
> > I’m trying to access memory by the physical address in my driver. The
> > reason why I do this is I need to get data from my bootstrap code. In
the
>
> > bootstrap code, I first enter the 386 Protected Mode and then write some
> > important data to a buffer (identified by the physical address), at last
> > jump back to the original bootstrap code. Suppose the buffer won’t be
> > re-written, how can I read the content of the buffer in my WinXP driver
> > module?
> >
> > I’ve read about MmMapIoSpace function, but I don’t know how to
initialize
>
> > the PHYSICAL_ADDRESS parameter, and it seems this function is obsolete.
> >
> > Any suggestion is welcome. Thanks,
> > GrepAll
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown lmsubst tag argument:
> ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown lmsubst tag argument:
> ‘’
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@utimaco.de
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>