Win7 x64切换CR3读写内存

NTSTATUS ReadProcessMemory(HANDLE pid,LONG_PTR buff,LONG_PTR address,SIZE_T len)
{
PEPROCESS pEPROCESS;
NTSTATUS status;
ULONG64 OldCr3;
ULONG64 NewCr3;


status = PsLookupProcessByProcessId(pid, &pEPROCESS);
if (!NT_SUCCESS(status))
{
return status;
}

NewCr3 = *(PULONG64)((ULONG64)pEPROCESS + 0x28);


OldCr3 = __readcr3();


_disable();
__writecr3(NewCr3);
_enable();


if (MmIsAddressValid(address))
{
RtlCopyMemory(buff, address, len);
}
else
{
_disable();
__writecr3(OldCr3);
_enable();


ObDereferenceObject(pEPROCESS);
return STATUS_UNSUCCESSFUL;
}




_disable();
__writecr3(OldCr3);
_enable();


ObDereferenceObject(pEPROCESS);
return STATUS_SUCCESS;
}

NTSTATUS WriteProcessMemory(HANDLE pid, LONG_PTR buff, LONG_PTR address, SIZE_T len)
{
PEPROCESS pEPROCESS;
NTSTATUS status;
ULONG64 OldCr3;
ULONG64 NewCr3;

ULONG64  OldCr0;

status = PsLookupProcessByProcessId(pid, &pEPROCESS);
if (!NT_SUCCESS(status))
{
return status;
}

NewCr3 = *(PULONG64)((ULONG64)pEPROCESS + 0x28);

OldCr3 = __readcr3();
OldCr0 = __readcr0();

_disable();
__writecr3(NewCr3);
__writecr0(OldCr0 & 0xfffffffffffeffff);
_enable();


if (MmIsAddressValid(address))
{
RtlCopyMemory(address, buff, len);
}
else
{
_disable();
__writecr3(OldCr3);
__writecr0(OldCr0);
_enable();


ObDereferenceObject(pEPROCESS);
return STATUS_UNSUCCESSFUL;
}


_disable();
__writecr3(OldCr3);
__writecr0(OldCr0);
_enable();

ObDereferenceObject(pEPROCESS);
return STATUS_SUCCESS;
}