|
crash spot = softice tries to get cr3 value from EPROCESS struct.
Only thing that comes to my mind is that internal structures might be changed.
Can you at least provide us with disassembly of ntoskrnl.exe!PsGetCurrentProcess , I just wanna be sure that internal structs haven't changed.
__________________
http://accessroot.com
|