MmIsAddressValid

ULONG readmemory(IN ULONG windowh,IN ULONG BaseAdd,IN ULONG BufferSize)
{
  //参数一：窗口句柄 参数二：要读取的地址 参数三：读取的大小
  HANDLE ProcessId=0;
  ProcessId =(HANDLE) RealNtUserQueryWindow(windowh, 0);//窗口句柄转化为进程句柄
  if (!ProcessId)return NULL;
  PEPROCESS EProcess=NULL;
  KAPC_STATE ApcState;
  PVOID BaseAddress=(PVOID)BaseAdd;
  ULONG status=NULL;
  status=PsLookupProcessByProcessId(ProcessId,&EProcess);
  if (status != STATUS_SUCCESS)
  {
    //ObDereferenceObject(EProcess);
    KdPrint(("PsLookupProcessByProcessId函数失败\n"));
    status = NULL;
    return status;
  }
  KeStackAttachProcess ((PRKPROCESS)EProcess, &ApcState);

  __try
  {
      if (MmIsAddressValid(BaseAddress))//检测地址是否有效
      {
          ULONG readbuffer=0;
          ProbeForRead ((CONST PVOID)BaseAddress, BufferSize, sizeof(CHAR));//内存读测试
          RtlCopyMemory (&readbuffer, BaseAddress, BufferSize);//读内存
          //status=*(ULONG*)readbuffer;
          status=readbuffer;
          //KdPrint(("读到的内存=%i",(*(ULONG*)readbuffer)));
      }
      else
      {
        //KdPrint(("MmIsAddressValid返回失败\n"));
        status = NULL;
      }
  }
  __except(1)
  {
    //KdPrint(("内存不可读\n"));
    status = NULL;
  }
    KeUnstackDetachProcess (&ApcState);
    ObDereferenceObject(EProcess);
    return status;
}