Function WriteProcessMemory

Driver/core.cpp:199–228

    }

    NTSTATUS WriteProcessMemory(int pid, uint64_t Address, uint64_t AllocatedBuffer, SIZE_T size, SIZE_T* written)
    {
        PEPROCESS pProcess = NULL;
        if (pid == 0) return STATUS_UNSUCCESSFUL;

        NTSTATUS NtRet = PsLookupProcessByProcessId((HANDLE)pid, &pProcess);
        if (NtRet != STATUS_SUCCESS) return NtRet;

        ULONG_PTR process_dirbase = GetProcessCr3(pProcess);
        ObDereferenceObject(pProcess);

        SIZE_T CurOffset = 0;
        SIZE_T TotalSize = size;
        while (TotalSize)
        {
            uint64_t CurPhysAddr = TranslateLinearAddress(process_dirbase, (ULONG64)Address + CurOffset);
            if (!CurPhysAddr) return STATUS_UNSUCCESSFUL;

            ULONG64 WriteSize = min(PAGE_SIZE - (CurPhysAddr & 0xFFF), TotalSize);
            SIZE_T BytesWritten = 0;
            NtRet = WritePhysicalAddress(CurPhysAddr, (PVOID)((ULONG64)AllocatedBuffer + CurOffset), WriteSize, &BytesWritten);
            TotalSize -= BytesWritten;
            CurOffset += BytesWritten;
            if (NtRet != STATUS_SUCCESS) break;
            if (BytesWritten == 0) break;
        }

        *written = CurOffset;
        return NtRet;
    }

    //NTSTATUS GetModuleBaseAddress(int processId, const char* moduleName, uint64_t* baseAddress)
    //{