Tag: eprocess

• Decrypting CR3 via MMPFN: Reading the Real Directory Base on Windows 7, 10, and 11

  2025-07-27

  Decrypting CR3 via MMPFN to read the real directory base on Windows 7, 10, and 11, resolving the kernel page table pointer across versions, with the setup and commands all covered.

• Reading EPROCESS and CR3 from MmPfnDatabase

  2025-04-23

  Reading EPROCESS and CR3 from MmPfnDatabase, a kernel technique to resolve process structures and page tables from a known physical address, with every step broken down clearly.