How do I use SUBMIT_CR3 to trace another process's coverage

[LeoneChen]

How do I use SUBMIT_CR3 to trace coverage another process (e.g. target rpc server process) ? Do I need to get CR3 register of target process, and then feed cr3 to SUBMIT_CR3 instead of 0? I've already read introducation in doc, but more detail information is helpful. Thanks so much~

[LeoneChen]

Do I must have to add a kernel driver to get cr3 value from pid of target process?