Further 1903 Compatibility Issues about vmread HOT 2 CLOSED

This is occurring for me on one of my 1809 VMs

PML4:   1aa000  | KernelEntry:  fffff80168419e80
Kernel Base:    fffff8016849e000 (249d000)
PsInitialSystemProcess: fffff801689e12e0 (29e02e0)
System (PID 4): ffff938dace4c040 (3e24c040)
NT Version:     1000

->

PML4:   1aa000  | KernelEntry:  fffff8016c09ee80
Kernel Base:    fffff8016b614000 (2000000)
-------------------- InitializeContext error 5 --------------------

EDIT: starts working again with the new Kernel Base after a while randomly:

PML4:   1aa000  | KernelEntry:  fffff8016c09ee80
Kernel Base:    fffff8016b614000 (2000000)
PsInitialSystemProcess: fffff8016bb572e0 (25432e0)
System (PID 4): ffffbc0d8205d080 (3d45d080)
NT Version:     1000

btw I'm working on implementing page enumeration via VAD tree traversal and should have a PR soon

from vmread.

Apparently the initialization process would find false matches of the kernel base. It is rather interesting though, as WinDbg sees the false matches as unmapped memory. It is an issue I will have to look into. In 0daf4d3 I have adjusted the search process to prioritize megabyte aligned pages before going through the regular ones. This solves initialization for me, but from what I can tell the correct kernel base might be in a 4k sized page. We might have to return to this to find more reliable code signatures, but closing for now.

from vmread.