Cheat Engine

[Polynomial]

I'm using \Device\PhysicalMemory to scan physical memory for a certain pattern (locating a particular pattern loaded into any executable) and as such I want to be able to map that physical memory address to the owner process. Any ideas?

[Dark Byte]

Look into NtOpenSection and NtMapViewOfSection (should work in usermode, but instead of the current process you give the target process)

memscan.c in ce's driver contains the routine ReadPhysicalMemory where those api's are used. They are of course the Zw versions but the nt versions 'should' work as well (Not sure if it still works though as I heard microsoft had put in security checks blocking this method as it could be used to bypass drm...)

And hey, if all else fails, just go kernelmode and edit the paging system yourself (0xc0000000 for 32-bit and 0xfffff68000000008 for 64-bit) , don't forget to flush after you're done