KPM kernel module assists in reading physical memory . hooking IOCTL - View it on GitHub