Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Miscellaneous Utilities
  New Posts New Posts RSS Feed: Physmem with XP SP2
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Physmem with XP SP2
 Post Reply Post Reply
Author
Message
  Topic Search Topic Search  Topic Options Topic Options
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 296 		  Quote dirbase Quote  Post ReplyReply Direct Link To This Post Topic: Physmem with XP SP2
    Posted: 17 May 2008 at 5:06am
I don't seem to be able to run physmem from sysinternals on my laptop running XP SP2 (dual core). I got  the message:
"Could not open \\device\\physicalmemory"

from the call to NtOpenSection.
Apparently the problem was solved as mentionned in this site, AFAIUI, by coding 
Status:=NtOpenSection(THandle(physmem),SECTION_MAP_READ,@ATTRIBUTES);
instead of 
Status:=NtOpenSection(physmem,SECTION_MAP_READ,@ATTRIBUTES);

Would it be then possible to get an updated version of physmem which would run on XP SP2?
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Online Status: Offline
Posts: 5121 		  Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 17 May 2008 at 7:46am
Hello, dirbase.

According to my archives, PhysMem.exe was updated for the last time in September 1998.

PhysMem.exe has never been offered on the Sysinternals Utilities Index.

So the answer seems to be obvious: forget about running PhysMem.exe on any current Windows version. Do not expect the development of PhysMem.exe to be continued after 10 years.

Kind regards,
Karl
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 296 		  Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 17 May 2008 at 9:15am
Hello Karlchen,

Thanks for your reply.
Physmem.exe was still part of the Sysinternals Suite I downloaded from the official site 6 months ago. It is still well described here . It sounds like a useful tool...

Thanks in advance for any volunteer who could have a look at it Smile
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Online Status: Offline
Posts: 5121 		  Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 17 May 2008 at 9:35am
Hi, dirbase.

Oops, how embarassing. Even the Sysinternals Suite today still holds Physmem.exe, dated Nov-01, 2006, Physmem v1.0. No idea how and why it has been included.

I suspect that compared to the Sept. 1998 version the only change may have been that the EULA dialogue was added in November 2006.

Yet, I do not know. So I will simply shutup now and give those people who should know a chance of correcting any piece of incorrect information which I may have posted on PhysMem.

Kind regards,
Karl
--
PHYSMEM.EXE      36.352     15.09.1998 10:45     -a--
PHYSMEM.EXE     150.328     01.11.2006 14:05     -a--
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Online Status: Offline
Posts: 5121 		  Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 17 May 2008 at 9:57am
Hi, dirbase.

The answer to your question might be much more simple than expected:
In case I run physmem.exe under an administrator account, it will work.
Whenever I run it under my normal account, it will tell me
C>PHYSMEM.EXE

Physmem v1.0: physical memory viewer
By Mark Russinovich
Sysinternals - http://www.sysinternals.com

Could not open \device\physicalmemory: Access denied.

Note:
physmem.exe is a console application, but will show a graphical EULA dialogue when it is run for the very first time by a user.

HTH,
Karl


Edited by Karlchen - 17 May 2008 at 10:00am
Back to Top
dirbase View Drop Down
Senior Member
Senior Member
Avatar

Joined: 26 March 2008
Online Status: Offline
Posts: 296 		  Quote dirbase Quote  Post ReplyReply Direct Link To This Post Posted: 17 May 2008 at 10:20am
Hi Karl,

Thanks for your useful help!
Actually I did launch physmem.exe as an administrator but I now realized it was my firewall (Comodo 2.4) which, with no warning, was impeding the executable to proceed and I got this famous "Could not open \device\physicalmemory: Access denied.".
Once I disabled the firewall, it ran OK!

Thanks again for leading me on the right way!

(Reading the post I quoted above, I got wrongly convinced that physmem was not compatible with SP2! )

No more work needed then, congratulations to the original developper!
Back to Top
Karlchen View Drop Down
Senior Member
Senior Member
Avatar

Joined: 18 June 2005
Location: Germany
Online Status: Offline
Posts: 5121 		  Quote Karlchen Quote  Post ReplyReply Direct Link To This Post Posted: 17 May 2008 at 11:12am
Hi, dirbase.

Good to know that you got physmem up and running.
No more work needed then, congratulations to the original developper!
Rumours are he might be Mark Russinovich. Wink

Karl
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Privacy Statement