[myid]

Hi, everyone.
We all knows that it's not safe to use MmIsAddressValid to test a kernel address is valid or not.
Is exist a method to read any kernel address? if address is not valid, return fail, not BSOD.
PS: It's better to compatible with XP. Do not use HOOK or VT-x/AMD-V.

[Brock]

SEH wrapped MDL access can accomplish this

[myid]

SEH wrapped MDL access can accomplish this

That is not possible. Just do a simple test: use your method to access the memory of all kernel module (not include WIN32K), must lead to BSOD.

[tangptr]

Check validity of its physical address related to specified virtual address via PTE.
Additionally, you may use MmCopyMemory in systems higher than or equal to Windows 8.1, or ZwSystemDebugControl in Windows XP.
Using Intel VT-x or AMD-V to hook KiPageFault may also be an appropriate method. However, you rejected using it.

[myid]

Check validity of its physical address related to specified virtual address via PTE.
Additionally, you may use MmCopyMemory in systems higher than or equal to Windows 8.1, or ZwSystemDebugControl in Windows XP.
Using Intel VT-x or AMD-V to hook KiPageFault may also be an appropriate method. However, you rejected using it.

Maybe your method is OK. But how to read kernel memory safely on VISTA, WIN7, WIN8?

[tangptr]

Check validity of its physical address related to specified virtual address via PTE.
Additionally, you may use MmCopyMemory in systems higher than or equal to Windows 8.1, or ZwSystemDebugControl in Windows XP.
Using Intel VT-x or AMD-V to hook KiPageFault may also be an appropriate method. However, you rejected using it.

Maybe your method is OK. But how to read kernel memory safely on VISTA, WIN7, WIN8?

You may analyze the page table in order to judge whether the specified address is valid or not.
For detailed information, you may reference to "Volume 3A, Chapter 4, Intel 64 and IA-32 Architectures Software Developer's Manual."

[m5home]

Use MmGetPhysicalAddress to get the physical address of the your virtual address, if it return a none-zero value, use MmMapIoSpace to get a NEW virtual address and read it.
If you want to know more details about verify a virtual address is valid or not, try to read the source code of Cheat Engine.

[myid]

Use MmGetPhysicalAddress to get the physical address of the your virtual address, if it return a none-zero value, use MmMapIoSpace to get a NEW virtual address and read it.
If you want to know more details about verify a virtual address is valid or not, try to read the source code of Cheat Engine.

That sounds a good idea. I have read the source code of CE, I noticed that it use MmGetPhysicalAddress to test a VA is valid or not.