title: ZwReadVirtualMemory and PatchGuard
body: <p>I have a question about calling the routine ZwReadVirtualMemory from my driver. I noticed it is not exported by ntokskrnl after dumping the EAT. How and where can I find the virtual address for this routine?</p>
  
  <p>Is it located in the ssdt? if so, does not patchguard prevent me from reading there anyway? Or is that only for writing.</p>
  
  <p>Also, this is for windows 7 x64.</p>
  
  <p>Thanks!</p>