NTSTATUS KeWriteVirtualMemory(PEPROCESS Process, PVOID SourceAddress, PVOID TargetAddress, SIZE_T Size)
{
	DbgBreakPoint();
	PSIZE_T Bytes;
	NTSTATUS status = STATUS_SUCCESS;
	status = MmCopyVirtualMemory(PsGetCurrentProcess(), SourceAddress, Process,
		TargetAddress, Size, KernelMode, &Bytes);
	if (NT_SUCCESS(status))
		return STATUS_SUCCESS;
	else
		return status;
}

BOOLEAN CopyProcessMemory(ULONG64 pDest, ULONG64 pSrc, ULONG ulSize, ULONG ulPID)
{
	ULONGLONG ullCR3 = 0;
	PEPROCESS  pEProcess;
	//ULONG ulOffset = DIRECTORY_TABLE_BASE;

	PsLookupProcessByProcessId((HANDLE)ulPID, &pEProcess);
	ULONG64 pDTB = Get64bitValue((UCHAR*)pEProcess + DIRECTORY_TABLE_BASE);
	if (pEProcess)
	{
		_disable();
		ullCR3 = __readcr3();
		__writecr3(pDTB);
		_enable();
		DbgPrintEx(0, 0, "Write Params:  pid: %d, src: %p, dst: %p \n", ulPID, pSrc, pDest);
		DbgBreakPoint();
		if (MmIsAddressValid(pDest))
		{
			RtlCopyMemory(pDest, pSrc, ulSize);
		}

		_disable();
		__writecr3(ullCR3);
		_enable();
		ObDereferenceObject(pEProcess);

		return TRUE;
	}

	return FALSE;
}