Quote:
|
Originally Posted by souz
but is it possible to emulate read attempts to that addresses???
Which tools can be useful to determine, which API used to read this memory area?
API SPY does not show it... in code there called ntMapOfView...
|
I'm not too good in kernel stuff but here are two theoretical ideas (may be wrong):
- use hardware breakpoint to catch read attempt at some address and handle it
- if you know how exactly (by means of which function) video BIOS is mapped in address space of calling process, intercept that function and return pointer to some other region containing any data.