Hello everyone,
I’m a new NT developer. In my case, i want to monitor the address of kernel mode memory (EPROCESS memory for example), it can be 1byte, DWORD or larger like Windbg does.
In usermode, AddVectoredExceptionHandler can do this with PAGE_GUARD traps. Is it possible in kernel mode and how to do it?