Memory access functions read from or write data to mapped device memory (for example, 0xCC000). Data is stored in a caller-supplied buffer. The return code for each function indicates whether the operation was completed successfully.
A detection DLL must verify the accessiblity of such a memory range by calling DetectCheckMemoryUsage before using either of these functions, declared as follows:
NTSTATUS DetectReadMappedMemory(
IN INTERFACE_TYPE InterfaceType,
IN ULONG BusNumber,
IN ULONG BaseAddress,
IN ULONG Length,
OUT PVOID Data
);
NTSTATUS DetectWriteMappedMemory(
IN INTERFACE_TYPE InterfaceType,
IN ULONG BaseAddress,
IN ULONG Length,
IN PVOID Data
);