2024年3月29日发(作者：)

return;

}

//Record old cr3 and set new cr3

_disable();

OldCr3=__readcr3();

__writecr3(pDTB);

_enable();

//Read process memory

if(MmIsAddressValid(Address))

{

RtlCopyMemory(Buffer,Address,Length);

DbgPrint("[x64Drv] Date read: %ld", *(PDWORD)Buffer);

}

//Restore old cr3

_disable();

__writecr3(OldCr3);

_enable();

}

void KWriteProcessMemory(IN PEPROCESS Process, IN PVOID Address, IN UINT32 Length, IN PVOID Buffer)

{

ULONG64 pDTB=0,OldCr3=0,vAddr=0;

//Get DTB

pDTB=Get64bitValue((UCHAR*)Process + DIRECTORY_TABLE_BASE);

if(pDTB==0)

{

DbgPrint("[x64Drv] Can not get PDT");

return;

}

//Record old cr3 and set new cr3

_disable();

OldCr3=__readcr3();

__writecr3(pDTB);

_enable();

//Read process memory

if(MmIsAddressValid(Address))

{

RtlCopyMemory(Address,Buffer,Length);

DbgPrint("[x64Drv] Date wrote.");

}

//Restore old cr3

_disable();

__writecr3(OldCr3);

_enable();

}