Thread: Is there anyone who can help me with ReadProcessMemory() ?

You definitely have to refer to Russinovich's Windows Internals , where you can find those sacral page tables and CR3 registers... Funny thing, I recommend this reading second time this week. BTW, I do not understand your confusing about context switching. Are you as well confused about dispatcher being able to switch between scheduled and preempted thread contexts? It definitely manipulates with CR3 content but never loses the control......

Thank you guys ! I feel very thanksful to your replys! and I think I have to read Windows Internals as you guys recommended thanks again have a good time ! P.S I have one more question.. As I asked, Is there any kernel mode method or command to access physical memory directly ? Igor asked if I'm confused of context switching but It's not that I'm confused of that.. Losing control over the thread meant that it may happen when it...

No idea how it does it, but does the OS need to do something similar when it reads/writes to/from the page file?

Hi, A quick summary of what happens when you call ReadProcessMemory(): 1.) ReadProcessMemory Calls NtReadVirtualMemory in NTDLL.DLL 2.) NtReadVirtualMemory passes through the SYSENTER/2Eh callgate and KeServiceDescriptorTable handler. 3.) ntoskrnl.exe calls ZwReadVirtualMemory for your application. 4.) ZwReadVirtualMemory reads the process memory and writes it into the buffer you supplied. I don't know how ZwReadVirtualMemory is...