Function ReadProcessMemory

Driver/core.cpp:167–197

    //
    NTSTATUS ReadProcessMemory(int pid, uint64_t Address, uint64_t AllocatedBuffer, SIZE_T size, SIZE_T* read)
    {
        PEPROCESS pProcess = NULL;
        if (pid == 0) return STATUS_UNSUCCESSFUL;

        NTSTATUS NtRet = PsLookupProcessByProcessId((HANDLE)pid, &pProcess);
        if (NtRet != STATUS_SUCCESS) return NtRet;

        ULONG_PTR process_dirbase = GetProcessCr3(pProcess);
        ObDereferenceObject(pProcess);

        SIZE_T CurOffset = 0;
        SIZE_T TotalSize = size;
        while (TotalSize)
        {

            uint64_t CurPhysAddr = TranslateLinearAddress(process_dirbase, (ULONG64)Address + CurOffset);
            if (!CurPhysAddr) return STATUS_UNSUCCESSFUL;

            ULONG64 ReadSize = min(PAGE_SIZE - (CurPhysAddr & 0xFFF), TotalSize);
            SIZE_T BytesRead = 0;
            NtRet = ReadPhysicalAddress(CurPhysAddr, (PVOID)((ULONG64)AllocatedBuffer + CurOffset), ReadSize, &BytesRead);
            TotalSize -= BytesRead;
            CurOffset += BytesRead;
            if (NtRet != STATUS_SUCCESS) break;
            if (BytesRead == 0) break;
        }

        *read = CurOffset;
        return NtRet;
    }

    NTSTATUS WriteProcessMemory(int pid, uint64_t Address, uint64_t AllocatedBuffer, SIZE_T size, SIZE_T* written)
    {