C++强制读写进程内存 R0与R3法

void KWriteProcessMemory(IN PEPROCESS Process, IN PVOID Address, IN UINT32 Length, IN PVOID Buffer)
{
PKAPC_STATE pKs = (PKAPC_STATE)ExAllocatePool(NonPagedPool, sizeof(PKAPC_STATE));
KeStackAttachProcess(Process, pKs);//Attach进程虚拟空间
if (MmIsAddressValid(Address))
{
RtlCopyMemory(Address, Buffer, Length);
DbgPrint("[x64Drv] Date wrote.");
}
KeUnstackDetachProcess(pKs);
}      

#define DIRECTORY_TABLE_BASE    0x028
 
UINT32 idTarget=0;
PEPROCESS epTarget=NULL;
UINT32 idGame=0;
PEPROCESS epGame=NULL;
UINT32 rw_len=0;
UINT64 base_addr=0;
 
ULONG64 Get64bitValue(PVOID p)
{
if(MmIsAddressValid(p)==FALSE) 
return 0;
return *(PULONG64)p;
}
 
ULONG32 Get32bitValue(PVOID p)
{
if(MmIsAddressValid(p)==FALSE) 
return 0;
return *(PULONG32)p;
}
 
void KReadProcessMemory(IN PEPROCESS Process, IN PVOID Address, IN UINT32 Length, OUT PVOID Buffer)
{
ULONG64 pDTB=0,OldCr3=0,vAddr=0;
//Get DTB
pDTB=Get64bitValue((UCHAR*)Process + DIRECTORY_TABLE_BASE);
if(pDTB==0)
{
DbgPrint("[x64Drv] Can not get PDT");
return;
}
//Record old cr3 and set new cr3
_disable();
OldCr3=__readcr3();
__writecr3(pDTB);
_enable();
//Read process memory
if(MmIsAddressValid(Address))
{
RtlCopyMemory(Buffer,Address,Length);
DbgPrint("[x64Drv] Date read: %ld", *(PDWORD)Buffer);
}
//Restore old cr3
_disable();
__writecr3(OldCr3);
_enable();
}
 
void KWriteProcessMemory(IN PEPROCESS Process, IN PVOID Address, IN UINT32 Length, IN PVOID Buffer)
{
ULONG64 pDTB=0,OldCr3=0,vAddr=0;
//Get DTB
pDTB=Get64bitValue((UCHAR*)Process + DIRECTORY_TABLE_BASE);
if(pDTB==0)
{
DbgPrint("[x64Drv] Can not get PDT");
return;
}
//Record old cr3 and set new cr3
_disable();
OldCr3=__readcr3();
__writecr3(pDTB);
_enable();
//Read process memory
if(MmIsAddressValid(Address))
{
RtlCopyMemory(Address,Buffer,Length);
DbgPrint("[x64Drv] Date wrote.");
}
//Restore old cr3
_disable();
__writecr3(OldCr3);
_enable();
}