Cheat Engine

[lylcheat]

The documented effect of KeStackAttachProcess is to attach the current thread to the address space of the target process. But how does Windows achieve this behind the scene? Does it mean the CR3 of the current process (stored in the KPROCESS->DirectoryTableBase member) is changed to that of the target process.

If that is true, and if I'm issuing the API call in a system thread, does it cause any issue since that would modify the system process's CR3 ?

[Dark Byte]

CR3 is changed yes, and probably some other internal structures are changed as well to deal with exceptions (like a timer interrupt signailing a task switch event)

If you're manually going to change CR3 then I recommend disabling interrupts for the current cpu, and don't trigger exceptions. (or capture them yourself by changing the local cpu's IDT to your own while external interrupts are disabled)