How can I know the memory address range?
The most important thing is to have a two physical computers connected by the firewire cable.Do not use kernel debugger on vm machine because video card and chipset are emulated the chipset is iirc Intel815.
Have you ever worked with the kernel debugger?
I warn you that you are going to deal with a lot of data presented to you as a rawhex values be it raster bitmaps , fonts vertex data and etc..
You can also read ports this is used for text out and colour palletes.
Pleasefollow this link:
http://forums.create.msdn.com/forums/t/58638.aspxPort range 3D0-3Dfh was used by the vga can be read with the help of windbg command "ib"
You can also break-on access here is the command:
bai43D0 // breakpoint on access
ib 3D0 // read from the port
ob 3D0 // write to the port
To find your video card memory-mappedI/O range.Go to Device Manager choose Display Device and click on Resources tab.You will see I/O port rtange and memory-mapped I/O.
From within kernel debugger you can use db,dw or dd to read the memory or eb,ew and ed command to modify the memory.
Regarding your 30 fps capture when you break-in the target everything freezes so you can freely inspect the memory.By consecutively issueingbreak-in you can obtain various images of the memory-mapped I/O.
Be careful you will be in kernel space so any mistake and you can render your machine unbootable.
