!va2pa
!va2pa [VirtualAddress (hex)] [pid ProcessId (hex)]
nt!ExAllocatePoolWithTag
.nt!ExAllocatePoolWithTag+5
.fffff800`4ebc9370
.fffff800`4ebc9370
in the process layout of process id (0x4).IOCTL = IOCTL_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS
, you have to send it in the following structure.true
in the case of virtual-to-physical and set it to false
in the case of physical-to-virtual.0
.