Description: Intercept CR3 instructions to prevent read and write process memory. In KiSwapProcess and SwapContext, mov cr3,eax instructions are intercepted before. -The code intercepts CR3 to prevent read or write of process memory.
To Search:
File list (Check if you may need any files):
2-防止直接切换cr3读写进程空间\SimpleDriver.cpp
.............................\SimpleDriver.sys
2-防止直接切换cr3读写进程空间
Download