Python CreateFile Cannot Find PhysicalMemory
Question: I am trying to access the Physical Memory of a Windows 2000 system (trying to
do this without a memory dumping tool). My understanding is that I need to do
this using the CreateFile function to create a handle. I have used an older
version of [win32dd](http://www.msuiche.net/2008/06/14/capture-memory-under-
win2k3-or-vista-with-win32dd/) to help me through this. Other documentation on
the web points me to using either "\Device\PhysicalMemory" or
"\\\\.\PhysicalMemory". Unfortunately, I get the same error for each.

    
    
    Traceback (most recent call last):
       File "testHandles.py", line 101, in (module)
       File "testHandles.py", line 72, in createFileHandle
    pywintypes.error: (3, 'CreateFile', 'The system cannot find the path specified.')
    

Actually, the error number returned is different for each run
\\\\.\PhysicalMemory == 3 and \Device\PhysicalMemory == 2. Review of pywin32,
win32file, createfile, pyhandle, and pywintypes did not produce information as
to the different return values.

Here is my code. I am using py2exe to get this working on Windows 2000 (and
yes it compiles successfully). I realize that I might also have a problem with
DeviceIoControl but right now I am concentrating on CreateFile.

    
    
    # testHandles.py
    
    import ctypes
    import socket
    import struct
    import sys
    import win32file
    import pywintypes
    
    def createFileHandle():
    
        outLoc = pywintypes.Unicode("C:\\Documents and Settings\\Administrator\\My Documents\\pymemdump_dotPM.dd")
        handleLoc = pywintypes.Unicode("\\\\.\\PhysicalMemory")
        #handleLoc = pywintypes.Unicode("\\Device\\PhysicalMemory")
        placeHolder = 0
        BytesReturned = 0
    
    
        # Device =                                              CreateFile(L"\\\\.\\win32dd", GENERIC_ALL, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
        #                                                           CreateFile(fileName,                        desiredAccess ,          shareMode ,    attributes , creationDisposition ,      flagsAndAttributes ,                    hTemplateFile )
        #hMemHandle = win32file.CreateFile(handleLoc, GENERIC_ALL, SHARE_READ, None, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, None)
        hMemHandle = win32file.CreateFile(handleLoc, win32file.GENERIC_READ, win32file.FILE_SHARE_READ, None, win32file.OPEN_EXISTING, win32file.FILE_ATTRIBUTE_NORMAL, None)
        print "hMemHandle: %s" % hMemHandle
        if (hMemHandle == NO_ERROR):
            print "Could not build hMemHandle"
            sys.exit()
    
        # We send destination path to the driver.
        #if (!DeviceIoControl(hMemHandle, 0x19880922, outLoc, (ULONG)(wcslen(outLoc) + 1) * sizeof(TCHAR), NULL, 0, &BytesReturned, NULL))
        if (ctypes.windll.Kernel32.DeviceIoControl(hMemHandle, 0x19880922, outLoc, 5, NULL, 0, BytesReturned, NULL)):
            print "Error: DeviceIoControl(), Cannot send IOCTL.\n"
        else:
            print "[win32dd] Physical memory dumped. You can now check %s.\n" % outLoc
    
    # Dump memory
    createFileHandle()
    

Thank you, Cutaway


Answer: I don't believe it's possible to access the physical memory object from user
mode land in Windows. As your [win32dd
link](http://www.msuiche.net/2008/06/14/capture-memory-under-win2k3-or-vista-
with-win32dd/) suggests, you will need to do it from kernel mode.

