Code:
fd = open("/dev/mem", O_RDWR);
/* do stuff with fd */
Alternately:
Code:
char *ptr = malloc(however_much_you_need);
/* do stuff with ptr */
since
all memory is "protected" as far as the Intel docs go. :p
But to be less pedantic, there's no other way to do it that I know of. Because while you do know where the paging tables are held in physical memory (you can get this from the PDBR, which is register CR3 on x86, IIRC, which user-mode code does have read access to), you don't know where in linear memory this physical address is mapped.
If you did know that piece of information, you have access to the entire 4GB linear address space, so you could maybe write to those addresses. (The page table must be mapped in, otherwise the processor wouldn't be able to do paging. So it's available somewhere, you just don't know where.) But those pages may also be marked supervisor-only (the U/S bit in the page table), which would mean writing to them would cause a segfault.