Win7 x64切换CR3读写内存

NTSTATUS ReadProcessMemory(HANDLE pid,LONG_PTR buff,LONG_PTR address,SIZE_T len)
{
PEPROCESS pEPROCESS;
NTSTATUS status;
ULONG64 OldCr3;
ULONG64 NewCr3;


status = PsLookupProcessByProcessId(pid, &pEPROCESS);
if (!NT_SUCCESS(status))
{
return status;
}

NewCr3 = *(PULONG64)((ULONG64)pEPROCESS + 0x28);


OldCr3 = __readcr3();