Question Valorant HVCI Memory Reading — UWorld Returning 0x0

[byte_corvus]

Anyone currently digging into Valorant memory with HVCI enabled?

Had a look at a recent build and I am seeing more people hitting a wall where their driver responds, but UWorld and GameInstance return 0x0. If you are getting a valid PID and game base but null pointers, you aren't just missing an offset — you are missing how memory translation works under VBS/HVCI on the latest Windows builds.

The Implementation Issue
Most basic internal-to-external "pasta" bases fail here because they don't handle the Directory Table Base (DTB) correctly. When Hypervisor-Enforced Code Integrity is active, a standard kernel read isn't enough. Vanguard often relies on the hardware to handle translations that your driver might be failing to emulate or hook into correctly.

Here is how most are trying to read it:

void get_world() {
    if (!game_base) {
        game_base = g_mem.GetBase();
    }
    if (!game_base) {
        std::cout << xorstr_("[-] Game base null") << "\n";
        return;
    }
    
    // This is where standard reads usually fail under HVCI
    uint64_t uw_slot   = g_mem.Read<uint64_t>(game_base + offsets::Uworld);
    uintptr_t uw     = (uintptr_t)uw_slot;
    uintptr_t uw_ptr = g_mem.Read<uintptr_t>(uw);
    uintptr_t gi     = g_mem.Read<uintptr_t>(uw_ptr + offsets::game_instance);

    world_pointer = uw_ptr;
    cached_game_instance = gi;
    std::cout << xorstr_("[+] UWorld=0x") << std::hex << uw_ptr
              << xorstr_(" GI=0x") << gi << "\n";
}

Why it returns 0x0:

1. CR3 / DTB Miss: If you aren't using the correct Directory Table Base for the process, your virtual-to-physical translation will fail for specific guarded regions.
2. Pointer Decryption: Valorant doesn't just leave UWorld sitting there. You usually need to pull the encrypted value and run it through a specific bit-shuffle or XOR decryption found in the game's stub.
3. Guarded Regions: Check if the address is part of the guarded region. If it is, you need to add the guarded region base to your reads or handle the specific translation for that memory space.

Spoiler: Technical Troubleshooting

- Verify if your driver is actually resolving the process base correctly or if it is just returning a cached value.
- Look into PML4 and how to manually walk the page tables if your memory library doesn't support HVCI translation.
- Verify your communication method (named sections, IOCTL, etc.) isn't being flagged or stripped of permissions by VGK.

Don't let them tell you it is "just a simple read." If you're going external with HVCI on, you need to handle kernel-level translation properly or find a way to let the OS handle it without getting clapped by a CR3 mismatch check.

Anyone found a stable way to fetch the DTB without triggering the latest Vanguard check?