Function GetProcessCr3

Driver/core.cpp:57–68

check normal dirbase if 0 then get from UserDirectoryTableBas

    //check normal dirbase if 0 then get from UserDirectoryTableBas
    ULONG_PTR GetProcessCr3(PEPROCESS pProcess)
    {
        PUCHAR process = (PUCHAR)pProcess;
        ULONG_PTR process_dirbase = *(PULONG_PTR)(process + 0x28); //dirbase x64, 32bit is 0x18
        if (process_dirbase == 0)
        {
            DWORD UserDirOffset = GetUserDirectoryTableBaseOffset();
            ULONG_PTR process_userdirbase = *(PULONG_PTR)(process + UserDirOffset);
            return process_userdirbase;
        }
        return process_dirbase;
    }
    ULONG_PTR GetKernelDirBase()
    {
        PUCHAR process = (PUCHAR)PsGetCurrentProcess();