PoC to retrieve the user CR3 for a process using the ShadowMapping field in the _EPROCESS struct. This approach relies on hardcoded offsets, valid for systems running Windows 10 2004 through Windows 11 23H2.
KVAS must be enabled. If KVAS is disabled, the
ShadowMappingfield in _EPROCESS is will be invalid and the CR3 cannot be extracted.