Click here to Skip to main content
13,668,546 members
Click here to Skip to main content
Add your own
alternative version


40 bookmarked
Posted 26 Apr 2010
Licenced CPOL

A Simple Demo for WDF Driver Development

, 26 Apr 2010
Rate this:
Please Sign up or sign in to vote.
Access physical memory, I/O port in user mode


WINFO, a well known tool on the internet, can directly access I/O and memory. It applied Microsoft undocumented function (NATIVE API) to fetch I/O data. The design structure of PCI View is based on WDF as to simulate the function of WINFO to access I/O and memory.


Knowledge of Win32 SDK is required.

Program Structure

PCI View can access I/O port and memory via IOMEM.DLL or the functions of DeviceIoControl or ReadFile/WriteFile.

Introduction of Application

The API functions of READ_PORT_UCHAR(USHORT/ULONG) or WRITE_PORT_UCHAR(USHORT/ULONG) can be applied to access I/O port in Windows NT environment. The usages of API functions are similar to the functions provided by Runtime Library of C language, such as _outp and _inp.

case 1: //UCHAR 
   if (pvInputBuffer->Command == 0) //decide to write or read 
        WRITE_PORT_UCHAR((PUCHAR)pvInputBuffer->PortBase, (UCHAR)pvInputBuffer->Data); 
        *(PUCHAR)pvOutputBuffer = READ_PORT_UCHAR((PUCHAR)pvInputBuffer->PortBase); 

case 2: // USHORT 
   if (pvInputBuffer->Command == 0) 
       WRITE_PORT_USHORT((PUSHORT)pvInputBuffer->PortBase, (USHORT)pvInputBuffer->Data); 
       *(PUSHORT)pvOutputBuffer = READ_PORT_USHORT((PUSHORT)pvInputBuffer->PortBase); 

case 4: //ULONG 
   if (pvInputBuffer->Command == 0) 
       WRITE_PORT_ULONG((PULONG)pvInputBuffer->PortBase, (ULONG)pvInputBuffer->Data); 
       *(PULONG)pvOutputBuffer = READ_PORT_ULONG((PULONG)pvInputBuffer->PortBase); 

The processing of memory is more complicated than the process of I/O which can be easily done by the API function.

  1. First of all, we need to get address and length where user would like to access in memory. Then, MmMapIoSpace function can map the address and length into a non-paged system space.
  2. If the previous process is success, the allocations of IoAllocateMdland MmBuildMdlForNonPagedPool will be enough to be buffered to mapping the real memory.
  3. MmMapLockedPagesSpecifyCache function can map the virtual memory to the caller. Therefore, the applications of RING 3 can directly fetch memory.
//Step 1.
memReq.MapIo = MmMapIoSpace(Address, memReq.Length, MmNonCached);
if (memReq.MapIo == NULL)

// Step 2.
memReq.Mdl = IoAllocateMdl(memReq.MapIo, memReq.Length, FALSE, FALSE, NULL);
if (memReq.Mdl == NULL)

// Step 3.
memReq.Buffer = (PUCHAR)MmMapLockedPagesSpecifyCache(memReq.Mdl,
                      UserMode, //set value as UserMode
if (memReq.Buffer == NULL)

The dynamic functions in real mode provide outp, _outpw, _outpd, _inp, _inpw and _inpd to access I/O port. There are 4 functions, such as MapMemory, UnmapMemory, ReadPhyicalMemory and WritePhyicalMemory, that can be used to fetch memory.

Function: designed to access the address and length of memory:

PUCHAR MapMemory(__in ULONG Address, __in ULONG Length);
Address : To access the beginning address of memory.
Length : To get the length of memory

The function will return the beginning address mapping in memory 
when executed successfully. 
Function: Release the assigned memory.
BOOLEAN UnmapMemory(VOID);

Sample Program

The application presents a sample to access IO-MEM. Without including DLL package, the application shows the information of the assigned memory or I/O port when directly calling IOMEM.DLL. The source code can be downloaded from



  • 26th April, 2010: Initial post


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Chuan-Liang Teng
Software Developer (Senior) Shan Hon Co., Ltd.
Taiwan Taiwan
No Biography provided

You may also be interested in...


Comments and Discussions

QuestionInstall Driver iomem.sys Pin
BEAT25-Apr-14 0:06
memberBEAT25-Apr-14 0:06 
QuestionDriver iomem.sys Pin
BEAT25-Apr-14 0:04
memberBEAT25-Apr-14 0:04 
GeneralMissing file Pin
King6418-Feb-11 1:16
memberKing6418-Feb-11 1:16 
GeneralPCI access Pin
Pdaus28-Apr-10 5:32
memberPdaus28-Apr-10 5:32 
GeneralRe: PCI access Pin
Chuan-Liang Teng29-Apr-10 1:20
memberChuan-Liang Teng29-Apr-10 1:20 
GeneralRe: PCI access Pin
Pdaus30-Apr-10 6:01
memberPdaus30-Apr-10 6:01 
GeneralRe: PCI access Pin
Chuan-Liang Teng6-May-10 21:44
memberChuan-Liang Teng6-May-10 21:44 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Cookies | Terms of Use | Mobile
Web01-2016 | 2.8.180820.1 | Last Updated 26 Apr 2010
Article Copyright 2010 by Chuan-Liang Teng
Everything else Copyright © CodeProject, 1999-2018
Layout: fixed | fluid