title: How do you read directly from physical memory on Windows?
body: <p>In C or C++ (windows), how do you read RAM by giving a physical (not virtual) address?
  That means without going trough virtual memory system (mmu tables), and being specific to one process.</p>
  
  <p>I already know the API <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms680553.aspx" rel="noreferrer"><code>ReadProcessMemory</code></a>, which reads from ram (used by most trainers) but it is only for a specific process.</p>
  
  <p>I searched on MSDN and found that <a href="http://technet.microsoft.com/en-us/library/cc787565.aspx" rel="noreferrer">Device\PhysicalMemory</a> seems to give such possibility, but I found no practical example and this feature seems to have been turned off by Windows service packs (to fix some vulnerability).</p>
  
  <p>I know it is possible to do because WinHex does it (if you choose "tools" > "open ram" > "physical memory"). It will then display RAM content from 0x00000000 to your_ram_size just like when you open a traditional file. It requires administrator rights, but there is no driver to install (which means WinHex does it from user mode).</p>
  
  <p>EDIT : added information about os.</p>