VOID *__stdcall MmGetSessionObjectByProcess(_EPROCESS *Process){ _MM_SESSION_SPACE *Session; Session = Process->Session; if( !Session || (Process->Flags3 & 0x1000) != 0 ) return 0i64; else return(VOID *)*((_QWORD *)Session + 9); }