finish replacing everything commented in one block of code

#include <ntifs.h>
#include <ntddk.h>

// ==========================================================
// Definitions and Macros
// ==========================================================
#define WINDOWS_1803 17134
#define WINDOWS_1809 17763
#define WINDOWS_1903 18362
#define WINDOWS_1909 18363
#define WINDOWS_2004 19041
#define WINDOWS_20H2 19042
#define WINDOWS_21H1 19043
#define WINDOWS_22H2 19044

#define PAGE_OFFSET_SIZE 12
#define PAGE_SIZE 0x1000
#define PMASK (~0xFFFULL)

typedef unsigned __int64 QWORD;

// ==========================================================
// Function Declarations
// ==========================================================
NTSTATUS ReadPhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T* BytesRead);
NTSTATUS WritePhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T* BytesWritten);
DWORD GetUserDirectoryTableBaseOffset();
ULONG_PTR GetProcessCr3(PEPROCESS pProcess);

uint64_t TranslateLinearAddress(uint64_t directoryTableBase, uint64_t virtualAddress);

// Memory operations
NTSTATUS ReadVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T* bytesRead);
NTSTATUS WriteVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T* bytesWritten);

// Process memory operations
NTSTATUS ReadProcessMemory(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T* BytesRead);
NTSTATUS WriteProcessMemory(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T* BytesWritten);

// WNF communication
typedef NTSTATUS(EXSUBSCRIBEWNFSTATECHANGE)(
PVOID Subscription,
ULONG64 StateName,
ULONG ChangeStamp,
PVOID Callback,
PVOID CallbackContext,
PVOID TypeId,
ULONG SerializationGroup,
ULONG Unknown
);

typedef NTSTATUS(EXPUBLISHWNFSTATEDATA)(
ULONG64 StateName,
PVOID Buffer,
ULONG Length,
PVOID TypeId,
PVOID ExplicitScope,
ULONG MatchingChangeStamp
);

typedef NTSTATUS(EXUNSUBSCRIBEWNFSTATECHANGE)(
PVOID Subscription
);

EXSUBSCRIBEWNFSTATECHANGE ExSubscribeWnfStateChange = NULL;
EXPUBLISHWNFSTATEDATA ExPublishWnfStateData = NULL;
EXUNSUBSCRIBEWNFSTATECHANGE ExUnsubscribeWnfStateChange = NULL;

ULONG64 MY_WNF_STATE_NAME = 0x41C64E6DA3BC1074; // Replace with your WNF State Name

PVOID g_WnfSubscription = NULL;

// ==========================================================
// Structures
// ==========================================================
#pragma pack(push, 1)
typedef struct _INSTRUCTIONS {
BYTE close;
BYTE read;
BYTE write;
BYTE reqBase;
UINT64 processId;
UINT64 address;
UINT64 size;
PVOID bufferAddress;
PVOID output;
UINT64 baseAddress;
char moduleName[256];
BYTE data[1024]; // For data to write or for returning data read
} INSTRUCTIONS, * PINSTRUCTIONS;
#pragma pack(pop)

// ==========================================================
// Function Definitions
// ==========================================================
DWORD GetUserDirectoryTableBaseOffset()
{
RTL_OSVERSIONINFOW ver = { 0 };
RtlGetVersion(&ver);
switch (ver.dwBuildNumber)
{
case WINDOWS_1803:
case WINDOWS_1809:
return 0x0278;
case WINDOWS_1903:
case WINDOWS_1909:
return 0x0280;
case WINDOWS_2004:
case WINDOWS_20H2:
case WINDOWS_21H1:
case WINDOWS_22H2:
default:
return 0x0388;
}
}

NTSTATUS ReadPhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T BytesRead)
{
MM_COPY_ADDRESS AddrToRead;
AddrToRead.PhysicalAddress.QuadPart = (LONGLONG)TargetAddress;
return MmCopyMemory(lpBuffer, AddrToRead, Size, MM_COPY_MEMORY_PHYSICAL, BytesRead);
}

NTSTATUS WritePhysicalAddress(PVOID TargetAddress, PVOID lpBuffer, SIZE_T Size, SIZE_T BytesWritten)
{
if (!TargetAddress)
return STATUS_UNSUCCESSFUL;

PHYSICAL_ADDRESS AddrToWrite = { 0 };
AddrToWrite.QuadPart = (LONGLONG)TargetAddress;

PVOID pmapped_mem = MmMapIoSpaceEx(AddrToWrite, Size, PAGE_READWRITE);

if (!pmapped_mem)
return STATUS_UNSUCCESSFUL;

memcpy(pmapped_mem, lpBuffer, Size);

BytesWritten = Size;
MmUnmapIoSpace(pmapped_mem, Size);
return STATUS_SUCCESS;
}

ULONG_PTR GetProcessCr3(PEPROCESS pProcess)
{
PUCHAR process = (PUCHAR)pProcess;
#ifdef _WIN64
ULONG_PTR process_dirbase = (PULONG_PTR)(process + 0x28); // dirbase for x64
#else
ULONG_PTR process_dirbase = (PULONG_PTR)(process + 0x18); // dirbase for x86
#endif
if (process_dirbase == 0)
{
DWORD UserDirOffset = GetUserDirectoryTableBaseOffset();
ULONG_PTR process_userdirbase = (PULONG_PTR)(process + UserDirOffset);
return process_userdirbase;
}
return process_dirbase;
}

uint64_t TranslateLinearAddress(uint64_t directoryTableBase, uint64_t virtualAddress)
{
directoryTableBase &= ~0xF;

uint64_t pageOffset = virtualAddress & 0xFFFULL;
uint64_t pteIndex = (virtualAddress >> 12) & 0x1FFULL;
uint64_t ptIndex = (virtualAddress >> 21) & 0x1FFULL;
uint64_t pdIndex = (virtualAddress >> 30) & 0x1FFULL;
uint64_t pdpIndex = (virtualAddress >> 39) & 0x1FFULL;

SIZE_T readsize = 0;
uint64_t pdpe = 0;
if (ReadPhysicalAddress((PVOID)(directoryTableBase + 8 * pdpIndex), &pdpe, sizeof(pdpe), &readsize) != STATUS_SUCCESS)
return 0;
if (!(pdpe & 1))
return 0;

uint64_t pde = 0;
if (ReadPhysicalAddress((PVOID)((pdpe & PMASK) + 8 * pdIndex), &pde, sizeof(pde), &readsize) != STATUS_SUCCESS)
return 0;
if (!(pde & 1))
return 0;

// 1GB large page
if (pde & 0x80)
return (pde & 0xFFFFFC0000000ULL) + (virtualAddress & 0x3FFFFFFFULL);

uint64_t pteAddr = 0;
if (ReadPhysicalAddress((PVOID)((pde & PMASK) + 8 * ptIndex), &pteAddr, sizeof(pteAddr), &readsize) != STATUS_SUCCESS)
return 0;
if (!(pteAddr & 1))
return 0;

// 2MB large page
if (pteAddr & 0x80)
return (pteAddr & PMASK) + (virtualAddress & 0x1FFFFFULL);

uint64_t pageTableEntry = 0;
if (ReadPhysicalAddress((PVOID)((pteAddr & PMASK) + 8 * pteIndex), &pageTableEntry, sizeof(pageTableEntry), &readsize) != STATUS_SUCCESS)
return 0;
if (!(pageTableEntry & 1))
return 0;

uint64_t physAddress = (pageTableEntry & PMASK) + pageOffset;
return physAddress;
}

NTSTATUS ReadVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T bytesRead)
{
SIZE_T totalBytesRead = 0;
SIZE_T bytesToRead = size;
NTSTATUS status = STATUS_SUCCESS;
while (bytesToRead)
{
uint64_t physAddress = TranslateLinearAddress(directoryTableBase, virtualAddress);
if (!physAddress)
{
status = STATUS_UNSUCCESSFUL;
break;
}

ULONG64 readSize = min(PAGE_SIZE - (physAddress & 0xFFFULL), bytesToRead);
SIZE_T localBytesRead = 0;
status = ReadPhysicalAddress((PVOID)physAddress, (PVOID)((ULONG_PTR)buffer + totalBytesRead), readSize, &localBytesRead);
if (status != STATUS_SUCCESS)
break;
if (localBytesRead == 0)
break;

bytesToRead -= localBytesRead;
virtualAddress += localBytesRead;
totalBytesRead += localBytesRead;
}
if (bytesRead)
bytesRead = totalBytesRead;
return status;
}

NTSTATUS WriteVirtualMemory(ULONG_PTR directoryTableBase, ULONG_PTR virtualAddress, PVOID buffer, SIZE_T size, SIZE_T bytesWritten)
{
SIZE_T totalBytesWritten = 0;
SIZE_T bytesToWrite = size;
NTSTATUS status = STATUS_SUCCESS;
while (bytesToWrite)
{
uint64_t physAddress = TranslateLinearAddress(directoryTableBase, virtualAddress);
if (!physAddress)
{
status = STATUS_UNSUCCESSFUL;
break;
}

ULONG64 writeSize = min(PAGE_SIZE - (physAddress & 0xFFFULL), bytesToWrite);
SIZE_T localBytesWritten = 0;
status = WritePhysicalAddress((PVOID)physAddress, (PVOID)((ULONG_PTR)buffer + totalBytesWritten), writeSize, &localBytesWritten);
if (status != STATUS_SUCCESS)
break;
if (localBytesWritten == 0)
break;

bytesToWrite -= localBytesWritten;
virtualAddress += localBytesWritten;
totalBytesWritten += localBytesWritten;
}
if (bytesWritten)
bytesWritten = totalBytesWritten;
return status;
}

NTSTATUS ReadProcessMemory(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T BytesRead)
{
PEPROCESS pProcess = NULL;
NTSTATUS status = PsLookupProcessByProcessId(pid, &pProcess);
if (!NT_SUCCESS(status))
return status;

ULONG_PTR dirBase = GetProcessCr3(pProcess);
ObDereferenceObject(pProcess);

return ReadVirtualMemory(dirBase, (ULONG_PTR)Address, Buffer, Size, BytesRead);
}

NTSTATUS WriteProcessMemory(HANDLE pid, PVOID Address, PVOID Buffer, SIZE_T Size, SIZE_T BytesWritten)
{
PEPROCESS pProcess = NULL;
NTSTATUS status = PsLookupProcessByProcessId(pid, &pProcess);
if (!NT_SUCCESS(status))
return status;

ULONG_PTR dirBase = GetProcessCr3(pProcess);
ObDereferenceObject(pProcess);

return WriteVirtualMemory(dirBase, (ULONG_PTR)Address, Buffer, Size, BytesWritten);
}

// WNF Callback function
NTSTATUS OnWnfCallback(
PVOID Subscription,
ULONG64 StateName,
ULONG ChangeStamp,
PVOID TypeId,
PVOID CallbackContext,
PVOID Buffer,
ULONG BufferSize
)
{
UNREFERENCED_PARAMETER(Subscription);
UNREFERENCED_PARAMETER(StateName);
UNREFERENCED_PARAMETER(ChangeStamp);
UNREFERENCED_PARAMETER(TypeId);
UNREFERENCED_PARAMETER(CallbackContext);

if (Buffer && BufferSize >= sizeof(INSTRUCTIONS))
{
PINSTRUCTIONS instructions = (PINSTRUCTIONS)Buffer;
if (instructions->read)
{
// Handle read request
SIZE_T bytesRead = 0;
BYTE readBuffer[1024] = { 0 };

NTSTATUS status = ReadProcessMemory(
(HANDLE)(ULONG_PTR)instructions->processId,
(PVOID)(ULONG_PTR)instructions->address,
readBuffer,
(SIZE_T)instructions->size,
&bytesRead
);
if (NT_SUCCESS(status))
{
// Copy the data back to user-mode via WNF
RtlZeroMemory(instructions->data, sizeof(instructions->data));
RtlCopyMemory(instructions->data, readBuffer, min(bytesRead, sizeof(instructions->data)));
instructions->size = bytesRead;
// Publish the data back
ExPublishWnfStateData(MY_WNF_STATE_NAME, instructions, sizeof(INSTRUCTIONS), NULL, NULL, 0);
}
else
{
// Handle read error
DbgPrint("[Driver] ReadProcessMemory failed with status: 0x%X\n", status);
}
}
else if (instructions->write)
{
// Handle write request
SIZE_T bytesWritten = 0;
NTSTATUS status = WriteProcessMemory(
(HANDLE)(ULONG_PTR)instructions->processId,
(PVOID)(ULONG_PTR)instructions->address,
instructions->data,
(SIZE_T)instructions->size,
&bytesWritten
);
if (NT_SUCCESS(status))
{
instructions->size = bytesWritten;
// Notify user-mode of success
ExPublishWnfStateData(MY_WNF_STATE_NAME, instructions, sizeof(INSTRUCTIONS), NULL, NULL, 0);
}
else
{
// Handle write error
DbgPrint("[Driver] WriteProcessMemory failed with status: 0x%X\n", status);
}
}
else if (instructions->close)
{
// Handle close instruction
// Perform any necessary cleanup
DbgPrint("[Driver] Received close instruction.\n");
}
else if (instructions->reqBase)
{
// Handle base address request
PEPROCESS pProcess = NULL;
NTSTATUS status = PsLookupProcessByProcessId((HANDLE)(ULONG_PTR)instructions->processId, &pProcess);
if (NT_SUCCESS(status))
{
PVOID baseAddress = PsGetProcessSectionBaseAddress(pProcess);
instructions->baseAddress = (UINT64)baseAddress;
ObDereferenceObject(pProcess);
// Send back the base address
ExPublishWnfStateData(MY_WNF_STATE_NAME, instructions, sizeof(INSTRUCTIONS), NULL, NULL, 0);
}
else
{
// Handle error
DbgPrint("[Driver] PsLookupProcessByProcessId failed with status: 0x%X\n", status);
}
}
// Handle other instructions as needed
}
else if (Buffer && BufferSize > 0)
{
// Handle simple messages like "Hi"
const char receivedMessage = (const char)Buffer;
if (strcmp(receivedMessage, "Hi") == 0)
{
// Send handshake response
const char* responseMessage = "Hello from kernel mode";
ExPublishWnfStateData(MY_WNF_STATE_NAME, (PVOID)responseMessage, (ULONG)strlen(responseMessage) + 1, NULL, NULL, 0);
}
}

return STATUS_SUCCESS;
}

// Driver unload function
VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
UNREFERENCED_PARAMETER(DriverObject);

// Unsubscribe from WNF
if (g_WnfSubscription && ExUnsubscribeWnfStateChange)
{
ExUnsubscribeWnfStateChange(g_WnfSubscription);
g_WnfSubscription = NULL;
}

DbgPrint("[Driver] Unloaded.\n");
}

// DriverEntry function
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
UNREFERENCED_PARAMETER(RegistryPath);

// Resolve WNF functions
UNICODE_STRING routineName;
RtlInitUnicodeString(&routineName, L"ExSubscribeWnfStateChange");
ExSubscribeWnfStateChange = (EXSUBSCRIBEWNFSTATECHANGE)MmGetSystemRoutineAddress(&routineName);
if (!ExSubscribeWnfStateChange)
{
DbgPrint("[Driver] ExSubscribeWnfStateChange not found.\n");
return STATUS_UNSUCCESSFUL;
}

RtlInitUnicodeString(&routineName, L"ExPublishWnfStateData");
ExPublishWnfStateData = (EXPUBLISHWNFSTATEDATA)MmGetSystemRoutineAddress(&routineName);
if (!ExPublishWnfStateData)
{
DbgPrint("[Driver] ExPublishWnfStateData not found.\n");
return STATUS_UNSUCCESSFUL;
}

RtlInitUnicodeString(&routineName, L"ExUnsubscribeWnfStateChange");
ExUnsubscribeWnfStateChange = (EXUNSUBSCRIBEWNFSTATECHANGE)MmGetSystemRoutineAddress(&routineName);
if (!ExUnsubscribeWnfStateChange)
{
DbgPrint("[Driver] ExUnsubscribeWnfStateChange not found.\n");
return STATUS_UNSUCCESSFUL;
}

// Subscribe to WNF state changes
NTSTATUS status = ExSubscribeWnfStateChange(
&g_WnfSubscription,
MY_WNF_STATE_NAME,
0,
(PVOID)OnWnfCallback,
NULL,
NULL,
0,
0
);
if (!NT_SUCCESS(status))
{
DbgPrint("[Driver] ExSubscribeWnfStateChange failed with status: 0x%X\n", status);
return status;
}

DriverObject->DriverUnload = DriverUnload;

// Send handshake message to user-mode
const char* handshakeMessage = "Kernel driver loaded";
ExPublishWnfStateData(MY_WNF_STATE_NAME, (PVOID)handshakeMessage, (ULONG)strlen(handshakeMessage) + 1, NULL, NULL, 0);

DbgPrint("[Driver] Loaded successfully.\n");

return STATUS_SUCCESS;
}