ERROR_NOT_LOCKED error on KbReadProcessMemory about kernel-bridge HOT 7 CLOSED

@klinyecviktor, you can find base addresses of all images of process in the PEB::Ldr field (it has PPEB_LDR_DATA type). And you can obtain a PEB address using ZwQueryInformationProcess with the ProcessBasicInformation class.

from kernel-bridge.

Just checked it
It works well with notepad.exe, but with the process I'm trying to work it does not.

Maybe related to this old issue?

from kernel-bridge.

How can I reproduce it in easy way? What type of memory are you want to read (what protection flags does it have - PAGE_***)? What type of process (x32/x64/maybe UWP...)?

from kernel-bridge.

Sorry, I'm not sure how to reproduce it without running that process.
The process is 64bit.

Regarding protection flags, is there a API to get protection flags?
Thanks in advance.

from kernel-bridge.

@klinyecviktor, for example, you can see these rights in ProcessHacker or by VirtualQuery API.
And whether this failure appears in other programs or in this exactly process only?

from kernel-bridge.

@HoShiMin Sorry, seems like the issue was caused by wrong Address
Driver works well

Is there an API method to get process Base Address?

from kernel-bridge.

Thanks a lot!

from kernel-bridge.