From a59eedfb65a01c85fe596db1c842d2489a6c58cf Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Wed, 1 Apr 2009 10:27:41 +0000
Subject: [PATCH] implemented KphReadVirtualMemory!

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@987 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 trunk/KProcessHacker/i386/kprocesshacker.sys  | Bin 13824 -> 13824 bytes
 trunk/KProcessHacker/kph_nt.c                 |  38 ++++++++++++++++++
 trunk/KProcessHacker/kph_nt.h                 |  22 +++++++++-
 trunk/KProcessHacker/kprocesshacker.c         |  37 +++++------------
 trunk/KProcessHacker/kprocesshacker.h         |   2 +-
 trunk/ProcessHacker/Forms/ThreadWindow.cs     |   4 +-
 trunk/ProcessHacker/KProcessHacker.cs         |  33 ++++++++-------
 .../Win32/Handles/ProcessHandle.cs            |  11 ++++-
 8 files changed, 100 insertions(+), 47 deletions(-)

diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys
index d164edc817a95040e5973b976ccc71579b450e85..4c012daf2fb96fd61e793b1c46c1822567fd7915 100644
GIT binary patch
delta 3495
zcmcImeQZ<L6~FJrPF{$e*uf#r2iQrR4@dwTvet3Z#DP4PwixUX1AzbuB*={d35m0Y
zE>?_8I?Tf>^v>JbZW`UDs;IQ;NW~)BZh=D6LTJ6g3K~eGEJ(K8O|W@W(89cP-pd#3
zru{W5=e_&R@0@eb{hf2~jknX=c|4SGwdUH1Yc_VQhvqYHFn^<;GR4ek`heNUJV|TW
zV#Z3JgXgm06YLR&J)Tc<WQN3+e1?R7PkGrH^?euy_^>^mp)fMU1qPgaKO5Rc`{nDB
zLTI;LNiWG`>;c8_`-x97Y+VYCB~>!_sgcXfx?^BSq@E!pvKAhPJRGNg<(0m)kx|+L
z=(~t&5nU*uDhWMFk8_#XUPQwL&_BWhe6<qVVxZ@_McGz_M-U#CV7&zE4fFxGXpkU$
z1Yw^9mmr)xa;JbH(cb6*h*u_QMp4rm-31z>q&bP2jZqtD$|a2#HBUt=L1UIQ-KZ&z
zE(J}Mq_LwWE1C%!t6n8eW<*s|R6e3Fpx;maO4kV#3aoFm+%DJ@jzG{FkH;GVL;dgq
zf?f3W1$*_94H&2#;h!WE;vX^t90;OOLp-B}7N?Z3Tau|GWziE>h$rE`57CNvw1EH`
zI=~R;5`9Gm0?t^&QC@2ol%4d)DY=zfXI*FK7d>o~@r-)Fe4Z)dP8Mua(q~jN7nsIU
zmNDn4PVp+^qURJn>KBtR%_>aO=@oN)N?Dj)H>-_i2KXshkw$RH0Pdy(N-fhugGy78
zl*T+)%zAcGb%6H*F)j2f<#Og@nw?sq>qi65cfQ;qI2FJhQfQye%|&}sH>gAkIY$Q(
zoE*%zo`zC$_DFo-Owj{^Z4wxABL(~vd`N4Yqez@Y-Oxd%xxr!x&MAmBFW;H6NwgtP
zbVFLfg8d1E2={he&=6XhTA~~HANgKL`w#i*RXM;<m8wP~l_Ey^H1j&(CDmePfWEED
zT>M|tiD5clstTA}RIaYlt{0a&>GMnyk6hp<qY8;++N5@@lfc_P&utOB9UT<-384Kj
zrhY%3Q3CJE`+X|GHX#u;GDyg1v}ugL30n)wH34KEruWqa)17mh4CG*S1pW?$@zRoX
z9laq}4JyX?7<!EHllby^G{n6fNQUNsS}Db{A?pIqfuEFC%;$-TX~m+o0Vvy1XD-Cm
zi2Ea+aST$kOH)nR!$~akAs?IVAD>4{+?-(33eHKtT1Wy23Ztd9>0Pv0mO_7-zCyhX
z8ba8h5Y}-CpRZP!!_Uyar`ItPv~uC{wKx7LVVgzF5+1{Eesb5&?GWdq=~YBOg}oep
z9}X~qS5$0OxYJ$4%8)I>HQ|%+ujpF~b9eUtTO5}dCnnT$!i|UnJkNn5Ua?8xK057t
zCA<%h#YRw%i@$hbGc0vx+%|7~gl1{<Y)c-k)C8G5^fwwWo0LyCWwZ{DX0$LF&vv^S
z+FRQ;KiA{#YwfhP@9XM0NQS?WS<1egUAM1!Hz6;8ybSUV$OVuuK>iG(*h5G@h#6!9
z$WD+KK)wg^CdhjrmqBiW`~`$-BV-XsImpZpE}y4y%z`x0Uu17A?KUyuSHq^dO%Jae
zJ=?4+-uUV<+n4FS)2WAG&25(E?w+oW_C4-inx9jxosMMJ5z>-J2oi;=Fg=h{O3$#3
zXL1W!?aA$M55+!<$9)$$7lGs0)s33F^r<DL#1IbOqV6RIO+QTTvg;Vq_BsZ!AG*lJ
z>FFiT#SsqsSRptRerL$%36VbN)$x1K=8?}hx<psD`A#!L`TQzQp%9!C{@^4QaR{Gs
za%b;ezc}=Lhze`kcbYI@06)^sp73sCNZb%K!wWW<tQTV!VC-k<Nu7>;{wh7ME7L!M
z^Ky)z0+)E?0gN9v{X-H}>I+%fRa&lJuJ_N`{v$FV8FO=SJLn<(6U=HlqSu!;LazwU
z58&*|g%R$y_r%?1N4>hi1w42KegrohJ&>niuO-r~yke%F*5+xoClU#`2+C<=+?wx#
zWgS{F?exVweU@}WjgtY50MuRJ8eAuls@5y?*Lj8WQCrA&o^!Zb5G}YuALSLXV{%%U
zzk>MzZOmVzY?R~rZ^|H{NIm^oel?R!@8)kSd<Qf$`k%rWc;R{yeV*&{h&)PL3u=_l
z%(JYfZx>{)ECLOrC9wXX^}uT&V27te2;v7YVg(NT{J76E4o6JnVFLYYL7pBL1oJ^J
zlE~!*aX$GRwId0%+^{t5anC{8X)tTiF;Xje%qzx9`hmfuc?4VF@rp)S$`mdh9RC_{
z4m5%-B&hvCBjhOz;nN=e-KBUOl8wA3Ied)+-<(?+y73{QUgi%Na10cz;rv5-97AMi
z^I!>#I~ZX(AF>Mp`~X@IZxDvi1(X=Y5q{}oaaySYG`A?LNa9lqs2EG;59Z={2%q4F
zfFpdJZZ9${lT1~hfyN7H5P=@bsKVZ3u?+)=!S%78o+>hwf%y;`2}i8382^H(8Z)0(
zm53@qjDok@!=n5_DZT<-0{Dz)m?3n)b`!4a>u^ut+E5QOlmP(r&De>>x(hXayeJ{i
zOgD@S{4i?{{X1YAK)OLx;=dG9FynORyarwY{w7>X*J0uiP>4>jQD!H_Z%q1faZZ_3
zS^|oh8sVmgT8N%FhO7~G!2O{v(N;Jo8eB%)Hr3DqaKyp!p@QQB?i;~&(_fzp7ofn8
z``2g%+c?Y*)&#9pm+0=2V&*tKR$^Qf+QJacR)(AfQ8Y2c1M)=^{cXtx@hU7{x+Y1r
z1Dwdk;qIkDmX5M^s*=g+g0gi?5p|U9a{gcLiedTk3TD{5LdB$>lG%IhJzaa+dwUxX
zcGK^!^p<`*!M1O0SNFlkZ!bCfbk{fA-D~@LdfNB9r(K4X#u#(Lm?#5g6jZ+IPg}lK
zJyd<F`lIT5)v}reHQE|Ojj^VxW_JzLN-zEqtC1Q{8%K;6jrWWXjE_vEtIAhxTLrk0
z5WIM%jKp-zblmhq(~nF)H@#^hc0vx*+SL{7>dc$X9p+y18|GW)m^q=Mw!&5Me8sJb
zWJ|8aY^kzXEp?W9%X*95(rDRgX|}Xj+AJ<hr={ECw)9&DELoL1DhV0>WVM<77eEq9
AWdHyG

delta 3465
zcmcIleNa@_6~FJX3lCUeR~J}5gvSE13M9ML#@z=Zemq7;fn9VXieE%=R!fWm&X^8_
zH5)3M$D3lW>m)YmVC$rIsx1+wp_WYWD{8V$wh2y|=pQzkbaz%~$jD5YDb4nreSDd;
z)4#ei=k9&K^KsApoqNx9H@lmA12Kc+pPl@?n*HTYYGmGFob)zR#GI$!FtyAHx|%Iw
zs^|e2%>yUdZiXGtqgkqg*pWPj1S_bhx}>uk86t~8dn8q3W{3+6IQ1cxZ=lE2RdHre
z20zfy8|n%6PU66yVplNi`2;!<SH{?>nM=>8EMQ1zJwr%nEeyvyIF5hw&7&zpJlz9Y
zEou#@U8rcaik8q`E<N*pK4^mkv=3kaUxT6@$){Jiw9GzK521QMQS*x0oln2v(mMB`
zx*OFVMQuWL{7@y};nwgGh*zQ@JR*(Z-GG=CgdkEIt_Ebeg4~CVhF6Bm0I@1a0FmPG
z5<tooq#u!ta5^BByf(U6FG6u)^^n_0PscyXT@MsWtY>7oU8>eNWM5?@5~-8Bj=>)g
z+(yqP?B^95Fwi=J5snaVmlf2q4~^;~sm-(~(Zs&TQAc9hbDJQZqW8RyR;0rq%V_8T
zLtHEB8)ZOtPSm|F8thWidir)^cG<pJ*V*->9@UeP)GeU%bWD-9c&U0y`3&pl0@I1a
zrA#5s)tq74=w(fd?(0}gvmDcOx}!O+Oe)MgH;abTWpN62q?a5jP#>f1Nd~5w`jRY*
zl{DtLV%D>Z>SWOk#5B`KNu|tEnwf0Nb)y02xw70LIW@o?QfQyet&O%M*Jz^@a*l&U
za&oX<Jq;vh?N#`|mBL4)>PcXz9Vrl};6vHt97WMZbae;GG&fib$vFkF=H)w6Hib6i
ziPog#Cw#^dB7L><s-Do|WK-^I|0Cb4DgPl~UYiB{lxtV%l~PQQqxyL#;HTO}%xm<b
zHhs~5O=kkr`I|PMSw+>lazlM|tCOCNNz$Q~#L2KmA(?K|IjR)pJx|BIsPbO8QxYEn
z?LC<KcqG*X|7GJxwNmv%g{YxULPo;dZi-`YwV+%Nfy^E{uFIc3Irm6=7FI_R??aew
zYFdy>A1pXP?F)aX+XV%XYBW+67xU>djWt+9PcK}@jM2LbOV{50R?$5l)d|6m@mrkS
zy{iETy>?Ta#O1=b;qC-~4-G>SHMV+9+X5G<WXM+ObLm#_65XiJu515JoaShp328ki
z{WT<l=VbsQw#}Nh*Qb3y4mM&N+5)gY`im60VAnJA!}NxpX9s!ucfF5kr5&kmwjqy3
zQX3N#3mgY_rM<wU)-^Tm<Lxak?QLpp<*S=se5vJS;vcw^Ud+-Fw(n<|>t3vXfsn%>
zZjfJq41<h<jDx855@G-`gVccR1NkvXFUSRu4?(^F`5I&jBzYep*&qVQ%n$ng2As1X
zcKU8+t#OZqiGI~>Ubne_Q2NKMftFhN(9lVfdPxwi_6oE(t3ubGL&zXc2yz1`8KuXw
ziWBkc@m7XB*~-v&*=?7y3t7W>1GN46Pa+Y|b<Rbg`?*FCsiG@$EV29!n5NLSoC3WI
z7IyXLFl66Z3}`=oed1esA;-C>EFO=IMsjGp&VZ*QK#po|ivF+QRE79>nv+}dym==?
zS@vgKLL)gJdVLSEhFv(S$^HHNz0s-XeFQ2~PW%=cr6l7=${$XSZf8iOz}EwRaHdtQ
z7&{+hzfJpcbJ@FodL_4nuLYNz;uN?<LTh3Ew5f%oNqiye^3&yfDStO^*7l#FPv8TL
zxw*K*^f><<(?y4PzIYE_8s{*yifouc2N4JD(1?<DAg-%(0S|6T9D;jMPmkp3*}^!Q
zkypfQp{w%@h6m6x=NZFP><3FbS~Bm^pXBiwN<;9IcD)4DUFGUr<4E|8kLU+^h4Z!5
z0nZiA;p#{2iI3>N@)olhv9!?m3=^VTjBAqKQRAM*RFF{U4E>d{f@z>%8n-8tdH95i
zIttU6d$cisRnl8vI^)nwFXpE|dkhfBLSnsLn}9}Hw!`R<eE0zbY=SL&MZc%R4}B%H
zQAMBR=kb_7M1k8zLfPOCOseOYOi<C~1xr$%_WTQNF0dNVF+^j&%l&aWTwu}HD)_uw
zuZ*Eg;iAr*?<q8ZNYw#J=k=K(PpJz>d+^SUNCc7%J%$_cban3nGVNeO2QeV6S9xU(
z%%Qx#68MLg;_Td`<3lricg#%rJOWNZ9JxyiI=dvJ7j(^aQ8uO^B_MLNPU^y_@KOdG
z!D}DFF<sc1K7>?VlbV8XilH<k(`R-%QY5t!LMZW+<{ZlT-VQW#J5WLVnH_LA_u&W&
zqrx71^^Xb*U%;YxAzEn0V*OHuExaoDA`-O3Q(BHI<0~n3p)Pu)w=OOy0dpT3Nv~GI
z!d@n<L;9v6QxuY9G{86N*NcsvO8iNPA;~yKQmqhL7RP{zQFwR*kRRf(LJ26KOfz=T
zL-8dLgvrhwqX6=$L>&h|%z6U-55nz&bY%pAedXcvcTS(spM#g|9D`?TG+F}5hfYw)
z*+ubNVL5yR4@pa`r(;yr8b94&!aI;!&MQ9xJG>ZcRNk&2%nveHQptyN*bA!d!R9Mb
zu00*}W|7tgkEqLych!D9+E*c@7OD-;s3eYg*JNY6bo#vxgCzPPJFvE+wedRDnu=oN
z4TM@v<}_nHL-vDk+ZeJ7<WmsScKV8`h6YR<;`U%y)n6Onm-tw!RjFx0NflE<9VNS+
z|CeWJKwWBMR<DWK*yKFa+Sa)DN9&qkbWOjHgxEl{8S&L^PvO5&*;}WLw!D0}X<+3u
zI)?6g_LTw7{De^fFC10>;BoDS3RlIUiuQ``ic=MR6;~_zRy|n-HRRzDg+GniV78e>
zv%}J9>9+jNLd@`30zPFXmUfF9upY}P%Nv$H%Q*|N6VgLBEVI>guQ;<}ctw&m!+P3!
z-a2f(VV$&=+Nx|$8?{}w-L{nq4Z<OzN9Yw!32z8*34Ovj;k<A`=obcsAz@e;5v~ij
S1iugv4wPLi8@RR1%KjTALtixj

diff --git a/trunk/KProcessHacker/kph_nt.c b/trunk/KProcessHacker/kph_nt.c
index 5cf18306f..b24f7df8b 100644
--- a/trunk/KProcessHacker/kph_nt.c
+++ b/trunk/KProcessHacker/kph_nt.c
@@ -457,3 +457,41 @@ NTSTATUS KphTerminateProcess(
     
     return status;
 }
+
+NTSTATUS KphReadVirtualMemory(
+    HANDLE ProcessHandle,
+    PVOID BaseAddress,
+    PVOID Buffer,
+    ULONG BufferLength,
+    PULONG ReturnLength,
+    KPROCESSOR_MODE AccessMode
+    )
+{
+    NTSTATUS status = STATUS_SUCCESS;
+    PEPROCESS processObject;
+    ULONG returnLength = 0;
+    
+    if (BufferLength)
+    {
+        status = ObReferenceObjectByHandle(ProcessHandle, 0, *PsProcessType, KernelMode, &processObject, NULL);
+        
+        if (!NT_SUCCESS(status))
+            return status;
+        
+        status = MmCopyVirtualMemory(
+            processObject,
+            BaseAddress,
+            PsGetCurrentProcess(),
+            Buffer,
+            BufferLength,
+            AccessMode,
+            &returnLength
+            );
+        ObDereferenceObject(processObject);
+    }
+    
+    if (ReturnLength)
+        *ReturnLength = returnLength;
+    
+    return status;
+}
diff --git a/trunk/KProcessHacker/kph_nt.h b/trunk/KProcessHacker/kph_nt.h
index ecef9dd5e..27d91799f 100644
--- a/trunk/KProcessHacker/kph_nt.h
+++ b/trunk/KProcessHacker/kph_nt.h
@@ -26,7 +26,6 @@
 #include "kprocesshacker.h"
 #include "kernel_types.h"
 
-/* Kernel API */
 NTSTATUS NTAPI ObOpenObjectByName(
     POBJECT_ATTRIBUTES ObjectAttributes,
     POBJECT_TYPE ObjectType,
@@ -37,6 +36,16 @@ NTSTATUS NTAPI ObOpenObjectByName(
     PHANDLE Handle
     );
 
+NTSTATUS NTAPI MmCopyVirtualMemory(
+    PEPROCESS FromProcess,
+    PVOID FromAddress,
+    PEPROCESS ToProcess,
+    PVOID ToAddress,
+    ULONG BufferLength,
+    KPROCESSOR_MODE AccessMode,
+    PULONG ReturnLength
+    );
+
 NTSTATUS NTAPI PsLookupProcessThreadByCid(
     PCLIENT_ID ClientId,
     PEPROCESS *Process,
@@ -62,7 +71,7 @@ NTSTATUS PsResumeProcess(
     PEPROCESS Process
     );
 
-/* KProcessHacker versions */
+/* KProcessHacker */
 NTSTATUS KphOpenProcess(
     PHANDLE ProcessHandle,
     ACCESS_MASK DesiredAccess,
@@ -107,6 +116,15 @@ NTSTATUS KphTerminateProcess(
     NTSTATUS ExitStatus
     );
 
+NTSTATUS KphReadVirtualMemory(
+    HANDLE ProcessHandle,
+    PVOID BaseAddress,
+    PVOID Buffer,
+    ULONG BufferLength,
+    PULONG ReturnLength,
+    KPROCESSOR_MODE AccessMode
+    );
+
 NTSTATUS OpenProcess(
     PHANDLE ProcessHandle,
     int DesiredAccess,
diff --git a/trunk/KProcessHacker/kprocesshacker.c b/trunk/KProcessHacker/kprocesshacker.c
index 63804b19b..a502bfdb5 100644
--- a/trunk/KProcessHacker/kprocesshacker.c
+++ b/trunk/KProcessHacker/kprocesshacker.c
@@ -268,8 +268,8 @@ char *GetIoControlName(ULONG ControlCode)
         return "KphSuspendProcess";
     else if (ControlCode == KPH_RESUMEPROCESS)
         return "KphResumeProcess";
-    else if (ControlCode == KPH_READPROCESSMEMORY)
-        return "Read Process Memory";
+    else if (ControlCode == KPH_READVIRTUALMEMORY)
+        return "KphReadVirtualMemory";
     else if (ControlCode == KPH_SETPROCESSTOKEN)
         return "Set Process Token";
     else if (ControlCode == KPH_GETTHREADWIN32STARTADDRESS)
@@ -651,41 +651,26 @@ NTSTATUS KphIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
         }
         break;
         
-        case KPH_READPROCESSMEMORY:
+        case KPH_READVIRTUALMEMORY:
         {
             HANDLE processHandle;
             PVOID baseAddress;
-            PKPROCESS processObject;
-            KAPC_STATE apcState;
+            PVOID buffer;
+            ULONG bufferLength;
             
-            if (inLength < 8)
+            if (inLength < 8 || outLength < 4)
             {
                 status = STATUS_BUFFER_TOO_SMALL;
                 goto IoControlEnd;
             }
             
             processHandle = *(HANDLE *)dataBuffer;
-            baseAddress = *(PVOID *)(dataBuffer + 4);
+            baseAddress = *(PVOID *)(dataBuffer + 0x4);
+            buffer = *(PVOID *)(dataBuffer + 0x8);
+            bufferLength = *(PULONG)(dataBuffer + 0xc);
             
-            status = ObReferenceObjectByHandle(processHandle, 0, *PsProcessType, KernelMode, &processObject, 0);
-            
-            if (!NT_SUCCESS(status))
-                goto IoControlEnd;
-            
-            KeStackAttachProcess(processObject, &apcState);
-            
-            __try
-            {
-                RtlCopyMemory(dataBuffer, baseAddress, outLength);
-                retLength = outLength;
-            }
-            __except (EXCEPTION_EXECUTE_HANDLER)
-            {
-                status = STATUS_ACCESS_VIOLATION;
-            }
-            
-            KeUnstackDetachProcess(&apcState);
-            ObDereferenceObject(processObject);
+            status = KphReadVirtualMemory(processHandle, baseAddress, buffer, bufferLength, (PULONG)dataBuffer, UserMode);
+            retLength = 4;
         }
         break;
         
diff --git a/trunk/KProcessHacker/kprocesshacker.h b/trunk/KProcessHacker/kprocesshacker.h
index b97fdd62c..b64ee3b4d 100644
--- a/trunk/KProcessHacker/kprocesshacker.h
+++ b/trunk/KProcessHacker/kprocesshacker.h
@@ -53,7 +53,7 @@ typedef struct _SYSTEM_HANDLE_INFORMATION
 #define KPH_TERMINATEPROCESS KPH_CTL_CODE(8)
 #define KPH_SUSPENDPROCESS KPH_CTL_CODE(9)
 #define KPH_RESUMEPROCESS KPH_CTL_CODE(10)
-#define KPH_READPROCESSMEMORY KPH_CTL_CODE(11)
+#define KPH_READVIRTUALMEMORY KPH_CTL_CODE(11)
 #define KPH_SETPROCESSTOKEN KPH_CTL_CODE(12)
 #define KPH_GETTHREADWIN32STARTADDRESS KPH_CTL_CODE(13)
 #define KPH_GETOBJECTNAME KPH_CTL_CODE(14)
diff --git a/trunk/ProcessHacker/Forms/ThreadWindow.cs b/trunk/ProcessHacker/Forms/ThreadWindow.cs
index 7d33b3758..2c87a7893 100644
--- a/trunk/ProcessHacker/Forms/ThreadWindow.cs
+++ b/trunk/ProcessHacker/Forms/ThreadWindow.cs
@@ -259,8 +259,8 @@ namespace ProcessHacker
                             {
                                 try
                                 {
-                                    Array.Copy(Program.KPH.ReadProcessMemory(Win32.ProcessHandle.FromHandle(processHandle),
-                                        baseAddress, size), buffer, size);
+                                    Program.KPH.KphReadVirtualMemory(Win32.ProcessHandle.FromHandle(processHandle),
+                                        baseAddress, buffer, size, out bytesRead);
                                     bytesRead = size;
                                     return true;
                                 }
diff --git a/trunk/ProcessHacker/KProcessHacker.cs b/trunk/ProcessHacker/KProcessHacker.cs
index 315760c1e..4668d28ba 100644
--- a/trunk/ProcessHacker/KProcessHacker.cs
+++ b/trunk/ProcessHacker/KProcessHacker.cs
@@ -52,7 +52,7 @@ namespace ProcessHacker
             KphTerminateProcess,
             KphSuspendProcess,
             KphResumeProcess,
-            ReadProcessMemory,
+            KphReadVirtualMemory,
             SetProcessToken,
             GetThreadWin32StartAddress,
             GetObjectName,
@@ -261,6 +261,24 @@ namespace ProcessHacker
             _fileHandle.IoControl(CtlCode(Control.KphOpenThread), inData, outData);
 
             return Misc.BytesToInt(outData, Misc.Endianness.Little);
+        }  
+
+        public unsafe void KphReadVirtualMemory(Win32.ProcessHandle processHandle, int baseAddress, byte[] buffer, int length, out int bytesRead)
+        {
+            byte[] data = new byte[16];
+            byte[] result = new byte[4];
+
+            fixed (byte* bufferPointer = buffer)
+            {
+                Array.Copy(Misc.IntToBytes(processHandle, Misc.Endianness.Little), 0, data, 0, 4);
+                Array.Copy(Misc.IntToBytes(baseAddress, Misc.Endianness.Little), 0, data, 4, 4);
+                Array.Copy(Misc.IntToBytes((int)bufferPointer, Misc.Endianness.Little), 0, data, 8, 4);
+                Array.Copy(Misc.IntToBytes(length, Misc.Endianness.Little), 0, data, 12, 4);
+
+                _fileHandle.IoControl(CtlCode(Control.KphReadVirtualMemory), data, result);
+
+                bytesRead = Misc.BytesToInt(result, Misc.Endianness.Little);
+            }
         }
 
         public void KphResumeProcess(Win32.ProcessHandle processHandle)
@@ -304,19 +322,6 @@ namespace ProcessHacker
             return buffer;
         }
 
-        public byte[] ReadProcessMemory(Win32.ProcessHandle processHandle, int baseAddress, int length)
-        {
-            byte[] data = new byte[8];
-            byte[] readData = new byte[length];
-
-            Array.Copy(Misc.IntToBytes(processHandle, Misc.Endianness.Little), 0, data, 0, 4);
-            Array.Copy(Misc.IntToBytes(baseAddress, Misc.Endianness.Little), 0, data, 4, 4);
-
-            _fileHandle.IoControl(CtlCode(Control.ReadProcessMemory), data, readData);
-
-            return readData;
-        }
-
         public void SetProcessProtected(int pid, bool protecte)
         {
             byte[] data = new byte[5];
diff --git a/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs b/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
index a19ded021..ab1b3db06 100644
--- a/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
+++ b/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
@@ -643,8 +643,15 @@ namespace ProcessHacker
                 byte[] buf = new byte[length];
                 int readLen;
 
-                if (!ReadProcessMemory(this, offset, buf, length, out readLen))
-                    ThrowLastWin32Error();
+                if (Program.KPH != null)
+                {
+                    Program.KPH.KphReadVirtualMemory(this, offset, buf, length, out readLen);
+                }
+                else
+                {
+                    if (!ReadProcessMemory(this, offset, buf, length, out readLen))
+                        ThrowLastWin32Error();
+                }
 
                 return buf;
             }